Detections
Analytics
CVE-2016-10033
critical
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
References
https://www.drupal.org/psa-2016-004
https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
https://thehackernews.com/2025/07/cisa-adds-four-critical-vulnerabilities.html
https://www.exploit-db.com/exploits/42221/
https://www.exploit-db.com/exploits/42024/
https://www.exploit-db.com/exploits/41996/
https://www.exploit-db.com/exploits/41962/
https://www.exploit-db.com/exploits/40986/
https://www.exploit-db.com/exploits/40974/
https://www.exploit-db.com/exploits/40970/
https://github.com/sudichai/cve-destroyer
https://github.com/sealldeveloper/CVE-2016-2098-PoC
https://github.com/eb613819/CTF_CVE-2016-10033
https://github.com/advisories/GHSA-5f37-gxvh-23v6
https://github.com/advisories/GHSA-4pc3-96mx-wwc8
https://github.com/pedro823/cve-2016-10033-45
https://github.com/Zenexer/safeshell
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
http://www.securitytracker.com/id/1037533
http://www.securityfocus.com/bid/95108
http://www.securityfocus.com/archive/1/539963/100/0/threaded
http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html