The developers of PHPMailer have patched a critical vulnerability that can be exploited by a remote attacker for arbitrary code execution, a researcher said on Sunday.
With millions of installations, PHPMailer is considered the world’s most popular email creation and transfer class for PHP. It has been used by several major open-source projects, including WordPress, Drupal, 1CRM, SugarCRM, Yii and Joomla.
Researcher Dawid Golunski from Legal Hackers discovered that PHPMailer is affected by a serious flaw, to which MITRE assigned the CVE identifier CVE-2016-10033. While MITRE has considered the possibility of more than 9,999 identifiers being needed since 2014, this is the first time five-digit CVE IDs have actually been assigned.
The PHPMailer security hole can be exploited by a remote, unauthenticated attacker for arbitrary code execution in the context of the web server user. Exploitation of the flaw can result in the targeted web application getting compromised.
Golunski has not disclosed the technical details of the vulnerability, but he did say that the weakness can be exploited through website components such as registration forms, contact or feedback forms, and password reset features that use an affected version of PHPMailer for sending emails.
The vulnerability was patched by PHPMailer developers on December 24 with the release of version 5.2.18. All prior versions are affected.
Golunski says he has developed a proof-of-concept (PoC) exploit for CVE-2016-10033, along with an exploit specifically targeting a popular open-source application found on more than one million servers. The exploits and a demo video will be made available soon, after users get a chance to patch their installations and the vendor of the popular application resolves the flaws.
The researcher had previously reported finding serious code execution and privilege escalation flaws in MySQL and Nagios Core, an open-source alerting and monitoring software. This year, he also identified various types of issues in Wget, Nginx, Apache Tomcat, CakePHP, vBulletin and Adobe ColdFusion.
Related Reading: Hackers Can Exploit Roundcube Flaw by Sending an Email
Related Reading: Critical Vulnerability in Symantec AV Engine Exploited by Just Sending an Email