The developers of PHPMailer have patched a critical vulnerability that can be exploited by a remote attacker for arbitrary code execution, a researcher said on Sunday.
With millions of installations, PHPMailer is considered the world’s most popular email creation and transfer class for PHP. It has been used by several major open-source projects, including WordPress, Drupal, 1CRM, SugarCRM, Yii and Joomla.
Researcher Dawid Golunski from Legal Hackers discovered that PHPMailer is affected by a serious flaw, to which MITRE assigned the CVE identifier CVE-2016-10033. While MITRE has considered the possibility of more than 9,999 identifiers being needed since 2014, this is the first time five-digit CVE IDs have actually been assigned.
The PHPMailer security hole can be exploited by a remote, unauthenticated attacker for arbitrary code execution in the context of the web server user. Exploitation of the flaw can result in the targeted web application getting compromised.
Golunski has not disclosed the technical details of the vulnerability, but he did say that the weakness can be exploited through website components such as registration forms, contact or feedback forms, and password reset features that use an affected version of PHPMailer for sending emails.
The vulnerability was patched by PHPMailer developers on December 24 with the release of version 5.2.18. All prior versions are affected.
Golunski says he has developed a proof-of-concept (PoC) exploit for CVE-2016-10033, along with an exploit specifically targeting a popular open-source application found on more than one million servers. The exploits and a demo video will be made available soon, after users get a chance to patch their installations and the vendor of the popular application resolves the flaws.
The researcher had previously reported finding serious code execution and privilege escalation flaws in MySQL and Nagios Core, an open-source alerting and monitoring software. This year, he also identified various types of issues in Wget, Nginx, Apache Tomcat, CakePHP, vBulletin and Adobe ColdFusion.
Related Reading: Hackers Can Exploit Roundcube Flaw by Sending an Email
Related Reading: Critical Vulnerability in Symantec AV Engine Exploited by Just Sending an Email
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- New York Man Arrested for Running BreachForums Cybercrime Website
- Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies
- Mozilla Patches High-Severity Vulnerabilities With Release of Firefox 111
- Microsoft: 17 European Nations Targeted by Russia in 2023 as Espionage Ramping Up
Latest News
- Verosint Launches Account Fraud Detection and Prevention Platform
- Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager
- Zoom Paid Out $3.9 Million in Bug Bounties in 2022
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- News Analysis: UK Commits $3 Billion to Support National Quantum Strategy
- Malicious NuGet Packages Used to Target .NET Developers
- Google Pixel Vulnerability Allows Recovery of Cropped Screenshots
