Remote code injection in PHPMailer - CVE-2016-10033
Published: December 30, 2016 / Updated: July 7, 2025
Vulnerability identifier: #VU3118
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-10033
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient sanitization of user-supplied input passed via specially crafted “From” address to mailSend() function. A remote attacker can use backslashed double quote character (e.g. \") to pass additional commands to original mail command and execute them with privileges of the current web server user.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
PHPMailer
Arch Linux
Fedora
Ubuntu
php-phpmailer (Alpine package)
libphp-phpmailer (Ubuntu package)
php-PHPMailer
Arch Linux
Fedora
Ubuntu
php-phpmailer (Alpine package)
libphp-phpmailer (Ubuntu package)
php-PHPMailer
How to mitigate CVE-2016-10033
Install the latest version 5.2.21 from vendor's website.
php-phpmailer (Alpine package) - update to 5.2.4-r0
libphp-phpmailer (Ubuntu package) - update to Ubuntu Pro
php-PHPMailer - addressed in versions 5.2.19-1.el6, 5.2.19-1.el7, 5.2.19-1.fc24, 5.2.19-1.fc25, 5.2.21-1.el6, 5.2.21-1.el7, 5.2.21-1.fc24, 5.2.21-1.fc25, 5.2.22-1.el6, 5.2.22-1.el7, 5.2.22-1.fc24
libphp-phpmailer (Ubuntu package) - update to Ubuntu Pro
php-PHPMailer - addressed in versions 5.2.19-1.el6, 5.2.19-1.el7, 5.2.19-1.fc24, 5.2.19-1.fc25, 5.2.21-1.el6, 5.2.21-1.el7, 5.2.21-1.fc24, 5.2.21-1.fc25, 5.2.22-1.el6, 5.2.22-1.el7, 5.2.22-1.fc24
Links to Public Exploits and PoC-codes
- Exploit #8221 - exploit-CVE-2016-10033 (PHPMailer < 5.2.18 Remote Code Execution) (August 7, 2022)
- Exploit #2608 - CVE_2016-10033 (Exploiting PHPMail with back connection (reverse shell) from the target) (April 27, 2020)
- Exploit #2369 - exploit-CVE-2016-10034 (PHPMailer < 5.2.18 Remote Code Execution) (April 7, 2020)
- Exploit #2327 - CVE_2016-10033 (Exploiting PHPMail with back connection (reverse shell) from the target) (April 7, 2020)
- Exploit #2281 - Exploits (Containing Self Made Perl Reproducers / PoC Codes) (April 7, 2020)
- Exploit #2128 - CVE-2016-10033 (WordPress 4.6 - Remote Code Execution (RCE) PoC Exploit) (March 18, 2020)
- Exploit #2098 - CVE-2016-10033 (PHPMailer < 5.2.18 Remote Code Execution Exploit ) (March 18, 2020)
- Exploit #2036 - exploit-CVE-2016-10033 (PHPMailer < 5.2.18 Remote Code Execution exploit and vulnerable container) (March 18, 2020)
- Exploit #2003 - Alien-Framework (Alien-Framework, it is a framework with many CVE exploits and tools to use in pen-testing.) (March 18, 2020)
- Exploit #704 - PHPMailer < 5.2.18 - Remote Code Execution (Bash) (March 18, 2020)
- Exploit #1765 - PHPMailer Sendmail Argument Injection (March 18, 2020)
- Exploit #1724 - WordPress PHPMailer Host Header Command Injection (March 18, 2020)
- Exploit #113 - CVE-2016-10033 (RCE against WordPress 4.6; Python port of https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html) (March 18, 2020)
- Exploit #703 - PHPMailer < 5.2.18 - Remote Code Execution (PHP) (March 18, 2020)
- Exploit #702 - PHPMailer < 5.2.20 - Remote Code Execution (March 18, 2020)
- Exploit #701 - PHPMailer < 5.2.18 - Remote Code Execution (Python) (March 18, 2020)
- Exploit #700 - PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - (AIO) 'PwnScriptum' Remote Code Execution (March 18, 2020)
- Exploit #699 - WordPress 4.6 - Unauthenticated Remote Code Execution (March 18, 2020)
- Exploit #698 - Vanilla Forums < 2.3 - Remote Code Execution (March 18, 2020)
- Exploit #697 - WordPress PHPMailer 4.6 - Host Header Command Injection (Metasploit) (March 18, 2020)
- Exploit #696 - PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution (March 18, 2020)
- Exploit #115 - cve-2016-10033-45 (Exploits CVE-2016-10033 and CVE-2016-10045) (March 18, 2020)
- Exploit #114 - CVE-2016-10033 (Code and vulnerable WordPress container for exploiting CVE-2016-10033) (March 18, 2020)
External References
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2016/Dec/78
- http://www.securityfocus.com/archive/1/archive/1/539963/100/0/threaded
- http://www.securityfocus.com/bid/95108
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilit...
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- https://www.drupal.org/psa-2016-004
- https://www.exploit-db.com/exploits/40968/
- https://www.exploit-db.com/exploits/40970/
Related Security Bulletins
- Remote code execution in PHPMailer
- Arch Linux update for wordpress
- Multiple vulnerabilities in in phpmailer.sourceforge.net PHPMailer
- Remote code injection in php-phpmailer (Alpine package)
- Ubuntu update for libphp-phpmailer
- Ubuntu update for libphp-phpmailer
- Fedora EPEL 6 update for php-PHPMailer
- Fedora 25 update for php-PHPMailer
- Fedora 24 update for php-PHPMailer
- Fedora EPEL 7 update for php-PHPMailer
- Fedora EPEL 7 update for php-PHPMailer
- Fedora 25 update for php-PHPMailer
- Fedora 24 update for php-PHPMailer
- Fedora EPEL 6 update for php-PHPMailer
- Fedora EPEL 7 update for php-PHPMailer
- Fedora EPEL 6 update for php-PHPMailer
- Fedora 24 update for php-PHPMailer