CVE-2016-10045

Related Files

PHPMailer Sendmail Argument Injection

Posted Jan 4, 2017

Authored by Dawid Golunski, Spencer McIntyre | Site metasploit.com

PHPMailer versions up to and including 5.2.19 are affected by a vulnerability which can be leveraged by an attacker to write a file with partially controlled contents to an arbitrary location through injection of arguments that are passed to the sendmail binary. This Metasploit module writes a payload to the web root of the webserver before then executing it with an HTTP request. The user running PHPMailer must have write access to the specified WEB_ROOT directory and successful exploitation can take a few minutes.

tags | exploit, web, arbitrary, root

advisories | CVE-2016-10033, CVE-2016-10045

MD5 | a8dc72e0680b992ed76e35257184f274

Download | Favorite | Comments (0)

PHPMailer / Zend-mail / SwiftMailer Remote Code Execution

Posted Jan 3, 2017

Authored by Dawid Golunski

This proof of concept exploit aims to execute a reverse shell on the target in the context of the web server user via a vulnerable PHP email library.

tags | exploit, web, shell, php, proof of concept

advisories | CVE-2016-10033, CVE-2016-10034, CVE-2016-10045, CVE-2016-10074

MD5 | a0be91defae2564f4405c81fdeab38cd

Download | Favorite | Comments (0)

PHPMailer Remote Code Execution

Posted Dec 28, 2016

Authored by Dawid Golunski

PHPMailer versions prior to 5.2.20 zero day remote code execution exploit. This bypasses the CVE-2016-10033 patch.

tags | exploit, remote, code execution

advisories | CVE-2016-10033, CVE-2016-10045

MD5 | 866aa935950ebe6d9acfd7e53a16846c

Download | Favorite | Comments (0)