Test ID:	1.3.6.1.4.1.25623.1.0.809842
Category:	Web application abuses
Title:	PHPMailer < 5.2.18 Remote Code Execution Vulnerability.
Summary:	PHPMailer is prone to a remote code execution (RCE) vulnerability.
Description:	Summary: PHPMailer is prone to a remote code execution (RCE) vulnerability. Vulnerability Insight: The flaw exists due to: PHPMailer uses the Sender variable to build the params string, The validation is done using the RFC 3696 specification, which can allow emails to contain spaces when it has double quote. Vulnerability Impact: Successfully exploiting this issue allows an remote attacker to execute arbitrary code in the context of the web server and compromise the target web application. Affected Software/OS: PHPMailer versions prior to 5.2.18 Solution: Upgrade to PHPMailer 5.2.18 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-10033 BugTraq ID: 95108 http://www.securityfocus.com/bid/95108 Bugtraq: 20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] (Google Search) http://www.securityfocus.com/archive/1/539963/100/0/threaded https://www.exploit-db.com/exploits/40968/ https://www.exploit-db.com/exploits/40969/ https://www.exploit-db.com/exploits/40970/ https://www.exploit-db.com/exploits/40974/ https://www.exploit-db.com/exploits/40986/ https://www.exploit-db.com/exploits/41962/ https://www.exploit-db.com/exploits/41996/ https://www.exploit-db.com/exploits/42024/ https://www.exploit-db.com/exploits/42221/ http://seclists.org/fulldisclosure/2016/Dec/78 http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html http://www.securitytracker.com/id/1037533
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.