CVE-2016-10045: joomla joomla\! Command Injection
Vulnerability summary
CVE-2016-10045 is a critical (CVSS 9.8) Command Injection vulnerability in joomla joomla\!. EPSS estimates a 97.74% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 9 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 30-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
97.74%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 97.74% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
9 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (rapid7.com)
Maturity: unknown
Show all 9 exploits
Exploit Reference (securityfocus.com)
Maturity: unknown
Exploit Reference (legalhackers.com)
Maturity: unknown
PHPMailer < 5.2.20 - Remote Code Execution
Maturity: poc
PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution
Maturity: poc
PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution
Maturity: poc
PHPMailer Sendmail Argument Injection
exploit/multi/http/phpmailer_arg_injection
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Alpine2 products
- php-phpmailer< 5.2.4-r0
- php5-phpmailer< 5.2.0-r1 | < 5.2.4-r1
Joomla1 product
- joomla\!≥ 1.5.0, ≤ 3.6.5
Phpmailer_project1 product
- phpmailer< 5.2.20
Ubuntu1 product
- libphp-phpmailer< 5.2.14+dfsg-1ubuntu0.1~esm1
Wordpress1 product
- wordpress≤ 4.7
5 vendors · 6 products
References
19 links- packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB EntryREPORT
- packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- www.securityfocus.com/archive/1/539967/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilitiesX Refsource CONFIRMPatchVendor AdvisoryREPORT
- www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionX Refsource MISCExploitThird Party Advisory
Show all 19 references
- legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.htmlX Refsource MISCExploitPatchThird Party AdvisoryREPORT
- seclists.org/fulldisclosure/2016/Dec/81Mailing ListX Refsource FULLDISCPatchThird Party AdvisoryREPORT
- developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlX Refsource CONFIRMThird Party AdvisoryREPORT