CVE-2016-10045

EPSS 98.0%

Vexday Risk Score

60Atenção

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

CVSS —EPSS 98.0%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Ciclo de vida

26 dez 2016Exploit Metasploit disponível

27 dez 2016PoC pública

30 dez 2016Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 8

cve_referencepacketstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.htmlnão verificado cve_referencepacketstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlnão verificado cve_referencewww.exploit-db.com/exploits/40969/não verificado cve_referencewww.exploit-db.com/exploits/40986/não verificado cve_referencewww.exploit-db.com/exploits/42221/não verificado exploitdbwww.exploit-db.com/exploits/40969não verificado exploitdbwww.exploit-db.com/exploits/40986não verificado exploitdbwww.exploit-db.com/exploits/42221não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://openwall.com/lists/oss-security/2016/12/28/1 http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html http://seclists.org/fulldisclosure/2016/Dec/81 https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20 https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html https://www.exploit-db.com/exploits/40969/https://www.exploit-db.com/exploits/40986/https://www.exploit-db.com/exploits/42221/http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection