CVE-2016-10033
Phpmailer Project Phpmailer ≤ 5.2.18
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2016-10033 is a critical-severity Argument Injection (CWE-88) vulnerability in Phpmailer Project Phpmailer. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability CVE-2016-10033 is present in the mailSend function of the isMail transport in PHPMailer versions before 5.2.18. It arises from insufficient neutralization of the Sender property, allowing a backslash double quote sequence to inject additional arguments into the mail command and is tracked as CWE-88 with a CVSS 3.1 score of 9.8.
Unauthenticated remote attackers can supply a crafted Sender value when an application uses the vulnerable PHPMailer instance to send mail. This permits arbitrary parameters to be passed to the mail binary, enabling execution of attacker-controlled commands on the underlying system.
Public exploit code and Metasploit modules demonstrating the injection are referenced in disclosures on PacketStorm, Seclists full-disclosure, and Rapid7, confirming that the issue is remotely exploitable in default configurations without requiring user interaction.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-0331
Vulnerability Data
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
- CWE(s)
- KEV Date Added
- 07 July 2025
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and command construction to prevent argument injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect argument injection but does not prevent it at the source.
Secure development lifecycle mandates input validation and command construction practices that directly prevent argument injection.
Application security requirements include explicit rules for safe command-line argument handling and escaping.
Secure architecture principles discourage unsafe command invocation patterns and favor safer APIs.
Secure coding standards explicitly require proper neutralization of command arguments, directly eliminating CWE-88.
Change management can catch unsafe command patterns during reviews but is not a direct mitigation.