The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5956-1 advisory.

    Dawid Golunski discovered that PHPMailer was not properly escaping user input data used as arguments to     functions executed by the system shell. An attacker could possibly use this issue to execute arbitrary     code. This issue only affected Ubuntu 16.04 ESM. (CVE-2016-10033, CVE-2016-10045)

    It was discovered that PHPMailer was not properly escaping characters in certain fields of the     code_generator.php example code. An attacker could possibly use this issue to conduct cross-site scripting     (XSS) attacks. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2017-11503)

    Yongxiang Li discovered that PHPMailer was not properly converting relative paths provided as user input     when adding attachments to messages, which could lead to relative image URLs being treated as absolute     local file paths and added as attachments. An attacker could possibly use this issue to access     unauthorized resources and expose sensitive information. This issue only affected Ubuntu 16.04 ESM.
    (CVE-2017-5223)

    Sehun Oh discovered that PHPMailer was not properly processing untrusted non-local file attachments, which     could lead to an object injection. An attacker could possibly use this issue to execute arbitrary code.
    This issue only affected Ubuntu 16.04 ESM. (CVE-2018-19296)

    Elar Lang discovered that PHPMailer was not properly escaping file attachment names, which could lead to a     misinterpretation of file types by entities processing the message. An attacker could possibly use this     issue to bypass attachment filters. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
    (CVE-2020-13625)

    It was discovered that PHPMailer was not properly handling callables in its validateAddress function,     which could result in untrusted code being called should the global namespace contain a function called     'php'. An attacker could possibly use this issue to execute arbitrary code. This issue was only fixed in     Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2021-3603)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An unauthenticated, remote attacker can exploit this to pass extra arguments to the sendmail binary, potentially allowing the attacker to execute arbitrary code. (CVE-2016-10033, CVE-2016-10045)

 - An information disclosure vulnerability exists in the REST API implementation due to a failure to properly restrict listings of post authors. An unauthenticated, remote attacker can exploit this, via a wp-json/wp/v2/users request, to disclose sensitive information. (CVE-2017-5487)

 - Multiple cross-site scripting (XSS) vulnerabilities exist in the update-core.php script due to improper validation of input to the plugin name or version header. An unauthenticated, remote attacker can exploit these, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-5488)

 - A cross-site request forgery (XSRF) vulnerability exists due to improper handling of uploaded Flash files. An unauthenticated, remote attacker can exploit this, via a specially crafted Flash file, to hijack the authentication of users. (CVE-2017-5489)

 - A cross-site scripting (XSS) vulnerability exists in the class-wp-theme.php script due to improper validation of input when handling theme name fallback. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-5490)

 - A security bypass vulnerability exists in the wp-mail.php script due to improper validation of mail server names. An unauthenticated, remote attacker can exploit this, via a spoofed mail server with the 'mail.example.com' name, to bypass intended security restrictions. (CVE-2017-5491)

 - A cross-site request forgery (XSRF) vulnerability exists in the widget-editing accessibility-mode feature due to a failure to require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions for HTTP requests. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted URL, to hijack the authentication of users or cause them to edit widgets. (CVE-2017-5492)

 - A security bypass vulnerability exists in the ms-functions.php script due to the use of weak cryptographic security for multisite activation keys. An unauthenticated, remote attacker can exploit this, via a specially crafted site sign-up or user sign-up, to bypass intended access restrictions. (CVE-2017-5493)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. (CVE-2016-10045)

Marina Glancy reports :

- MSA-17-0001: System file inclusion when adding own preset file in Boost theme

- MSA-17-0002: Incorrect sanitation of attributes in forums

- MSA-17-0003: PHPMailer vulnerability in no-reply address

- MSA-17-0004: XSS in assignment submission page

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.7.1.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the     PHPMailer component in the class.phpmailer.php script     due to improper handling of sender email addresses. An     unauthenticated, remote attacker can exploit this to     pass extra arguments to the sendmail binary, potentially     allowing the attacker to execute arbitrary code.
    (CVE-2016-10033, CVE-2016-10045)

  - An information disclosure vulnerability exists in the     REST API implementation due to a failure to properly     restrict listings of post authors. An unauthenticated,     remote attacker can exploit this, via a     wp-json/wp/v2/users request, to disclose sensitive     information. (CVE-2017-5487)

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the update-core.php script due to improper     validation of input to the plugin name or version     header. An unauthenticated, remote attacker can exploit     these, via a specially crafted request, to execute     arbitrary script code in a user's browser session.
    (CVE-2017-5488)

  - A cross-site request forgery (XSRF) vulnerability exists     due to improper handling of uploaded Flash files. An     unauthenticated, remote attacker can exploit this, via a     specially crafted Flash file, to hijack the     authentication of users. (CVE-2017-5489)

  - A cross-site scripting (XSS) vulnerability exists in the     class-wp-theme.php script due to improper validation of     input when handling theme name fallback. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session. (CVE-2017-5490)

  - A security bypass vulnerability exists in the     wp-mail.php script due to improper validation of mail     server names. An unauthenticated, remote attacker can     exploit this, via a spoofed mail server with the     'mail.example.com' name, to bypass intended security     restrictions. (CVE-2017-5491)

  - A cross-site request forgery (XSRF) vulnerability exists     in the widget-editing accessibility-mode feature due to     a failure to require multiple steps, explicit     confirmation, or a unique token when performing certain     sensitive actions for HTTP requests. An unauthenticated,     remote attacker can exploit this, by convincing a user     to follow a specially crafted URL, to hijack the     authentication of users or cause them to edit widgets.
    (CVE-2017-5492)

  - A security bypass vulnerability exists in the     ms-functions.php script due to the use of weak     cryptographic security for multisite activation keys. An     unauthenticated, remote attacker can exploit this, via a     specially crafted site sign-up or user sign-up, to     bypass intended access restrictions. (CVE-2017-5493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

**Version 5.2.22** (January 5th 2017)

  - **SECURITY** Fix     [CVE-2017-5223](https://web.nvd.nist.gov/view/vuln/detai     l?vulnId=CVE-2017-5223), local file disclosure     vulnerability if content passed to `msgHTML()` is     sourced from unfiltered user input. Reported by     Yongxiang Li of Asiasecurity. The fix for this means     that calls to `msgHTML()` without a `$basedir` will not     import images with relative URLs, and relative URLs     containing `..` will be ignored.

  - Add simple contact form example

  - Emoji in test content

----

**Version 5.2.21** (December 28th 2016)

  - Fix missed number update in version file - no functional     changes

----

**Version 5.2.20** (December 28th 2016)

  - **SECURITY** Critical security update for CVE-2016-10045     please update now! Thanks to [Dawid     Golunski](https://legalhackers.com) and Paul Buonopane     (Zenexer).

----

** Version 5.2.19** (December 26th 2016)

  - Minor cleanup

** Version 5.2.18** (December 24th 2016)

  - **SECURITY** Critical security update for CVE-2016-10033     please update now! Thanks to [Dawid     Golunski](https://legalhackers.com).

  - Add ability to extract the SMTP transaction ID from some     common SMTP success messages

  - Minor documentation tweaks

** Version 5.2.17** (December 9th 2016)

  - This is officially the last feature release of 5.2.
    Security fixes only from now on; use PHPMailer 6.0!

  - Allow DKIM private key to be provided as a string

  - Provide mechanism to allow overriding of boundary and     message ID creation

  - Improve Brazilian Portuguese, Spanish, Swedish,     Romanian, and German translations

  - PHP 7.1 support for Travis-CI

  - Fix some language codes

  - Add security notices

  - Improve DKIM compatibility in older PHP versions

  - Improve trapping and capture of SMTP connection errors

  - Improve passthrough of error levels for debug output

  - PHPDoc cleanup

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 5.2.21** (December 28th 2016)

  - Fix missed number update in version file - no functional     changes

----

**Version 5.2.20** (December 28th 2016)

  - **SECURITY** Critical security update for CVE-2016-10045     please update now! Thanks to [Dawid     Golunski](https://legalhackers.com) and Paul Buonopane     (Zenexer).

----

** Version 5.2.19** (December 26th 2016)

  - Minor cleanup

** Version 5.2.18** (December 24th 2016)

  - **SECURITY** Critical security update for CVE-2016-10033     please update now! Thanks to [Dawid     Golunski](https://legalhackers.com).

  - Add ability to extract the SMTP transaction ID from some     common SMTP success messages

  - Minor documentation tweaks

** Version 5.2.17** (December 9th 2016)

  - This is officially the last feature release of 5.2.
    Security fixes only from now on; use PHPMailer 6.0!

  - Allow DKIM private key to be provided as a string

  - Provide mechanism to allow overriding of boundary and     message ID creation

  - Improve Brazilian Portuguese, Spanish, Swedish,     Romanian, and German translations

  - PHP 7.1 support for Travis-CI

  - Fix some language codes

  - Add security notices

  - Improve DKIM compatibility in older PHP versions

  - Improve trapping and capture of SMTP connection errors

  - Improve passthrough of error levels for debug output

  - PHPDoc cleanup

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Legal Hackers reports :

An independent research uncovered a critical vulnerability in PHPMailer that could potentially be used by (unauthenticated) remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application.

To exploit the vulnerability an attacker could target common website components such as contact/feedback forms, registration forms, password email resets and others that send out emails with the help of a vulnerable version of the PHPMailer class.

The first patch of the vulnerability CVE-2016-10033 was incomplete.
This advisory demonstrates the bypass of the patch. The bypass allows to carry out Remote Code Execution on all current versions (including 5.2.19).

ID	Name	Product	Family	Severity
172589	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : PHPMailer vulnerabilities (USN-5956-1)	Nessus	Ubuntu Local Security Checks	critical
98260	WordPress 3.7.x < 3.7.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98259	WordPress 3.8.x < 3.8.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98258	WordPress 3.9.x < 3.9.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98257	WordPress 4.0.x < 4.0.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98256	WordPress 4.1.x < 4.1.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98255	WordPress 4.2.x < 4.2.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98254	WordPress 4.3.x < 4.3.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98253	WordPress 4.4.x < 4.4.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98252	WordPress 4.5.x < 4.5.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98251	WordPress 4.6.x < 4.6.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98250	WordPress 4.7.x < 4.7.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
100280	F5 Networks BIG-IP : PHPMailer vulnerability (K73926196)	Nessus	F5 Networks Local Security Checks	critical
97812	FreeBSD : moodle -- multiple vulnerabilities (f72d98d1-0b7e-11e7-970f-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical
96606	WordPress < 4.7.1 Multiple Vulnerabilities	Nessus	CGI abuses	critical
96574	Fedora 24 : php-PHPMailer (2017-c3dc97e1e1)	Nessus	Fedora Local Security Checks	critical
96319	Fedora 25 : php-PHPMailer (2016-6941d25875)	Nessus	Fedora Local Security Checks	critical
96172	FreeBSD : phpmailer -- Remote Code Execution (3c4693de-ccf7-11e6-a9a5-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-10045

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical