Intel

CVE-2016-10033

PHP PHPMailer — PHPMailer Command Injection Vulnerability

criticalKEV: actively exploitedPoCEPSS 100%

Description

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Source: CISA_KEVCVEORGCVELISTV5OSV

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-10033 carries an EPSS score of 99.71 % (100th percentile), indicating that virtually all observed exploit activity across the ecosystem targets this vulnerability. The attack is low-complexity: an adversary submits a crafted Sender value containing \" through any publicly reachable web form, injecting additional parameters into the underlying sendmail call and achieving remote code execution in the context of the web-server process — no authentication required. Typical targets are CMS deployments (WordPress plugins, Joomla extensions), Laravel applications, and any PHP web application with a contact or registration form running PHPMailer below 5.2.18. For NIS2-scoped organisations with internet-facing web applications, a critical rating is fully justified; CISA's addition to the KEV catalogue in July 2025 confirms continued active exploitation, and the network-accessible, unauthenticated CVSS vector with high impact on confidentiality and integrity makes immediate patching the only acceptable response.

Runbook · Step 1

Immediate response (0-24 h)

  • Update PHPMailer immediately to version 5.2.18 or later (recommended: current 6.x branch) — run composer require phpmailer/phpmailer:^6.9 in every affected project; all versions below 5.2.18 are vulnerable.
  • Inventory every application that includes class.phpmailer.php or pulls PHPMailer as a Composer dependency (composer show phpmailer/phpmailer in each project root).
  • Isolate applications that cannot be patched immediately, or temporarily disable the affected endpoints (contact forms, registration emails, password-reset flows) until the patch is deployed.
  • Hard-code the Sender property in all application configurations to a validated, static value — never populate it from user-supplied input until the patch is in place.
  • Inspect running PHP processes on affected hosts: ps aux | grep php and lsof -p <PID> — unexpected child processes spawned from sendmail//usr/sbin/sendmail are a strong exploitation indicator.
  • Activate WAF rules immediately (see Mitigation layers) to block in-progress attacks while the patch rollout proceeds.

Runbook · Step 2

Mitigation layers

  • WAF/IPS rule: Filter HTTP request bodies and parameters for the pattern \" (backslash followed by double quote) in any email-related field. ModSecurity rule concept: SecRule ARGS "@rx \\\\\"" "id:9001,phase:2,deny,msg:'CVE-2016-10033 PHPMailer Injection'".
  • Network segmentation: Web-server VMs should only be permitted outbound SMTP connections to defined mail-relay hosts (ports 25/587/465). Replace direct OS-level sendmail invocation with an SMTP relay to eliminate the attack surface entirely.
  • PHP hardening: Set disable_functions = exec,passthru,shell_exec,system,proc_open,popen in php.ini where the application does not require these functions — significantly limits post-exploitation capability.
  • Least privilege: Run PHP-FPM/Apache workers under a dedicated, non-privileged system account with no interactive shell (/sbin/nologin); restrict access to the sendmail binary to that account only.
  • Input validation as interim control: Wrap all assignments to PHPMailer::Sender with strict RFC-5321 validation (filter_var($addr, FILTER_VALIDATE_EMAIL)) before the patch can be deployed.
  • Switch to SMTP transport: Configure PHPMailer to use SMTP ($mail->isSMTP()) instead of the mail() function — the vulnerability is exclusive to the isMail transport; the SMTP transport is not affected.

Runbook · Step 3

Detection rules

  • Auditd / Linux: Monitor the process ancestry chain apache2/php-fpm → sh → sendmail with unexpected arguments. Create an auditd rule on execve for /usr/sbin/sendmail where the -f argument contains special characters (\\, ", ;, |).
  • Sysmon (Linux port or Windows): EID 1 — ParentImage contains php or httpd, Image is sh, bash, cmd.exe, or sendmail; CommandLine contains \" or a -f argument with special characters.
  • Web-server access logs: POST requests to contact-form endpoints with body parameters containing \" — SPL snippet: index=web sourcetype=access_combined method=POST | where match(_raw, "\\\\\"").
  • EDR process tree: Alert when sendmail or /usr/lib/sendmail spawns as a child of a PHP interpreter with arguments outside the expected -f sender@domain.tld pattern.
  • Sigma rule shape: 
    title: CVE-2016-10033 PHPMailer Command Injection
logsource: {category: process_creation, product: linux}
detection:
  selection:
    ParentImage|contains: 'php'
    Image|endswith: '/sendmail'
    CommandLine|contains: '\"'
  condition: selection

Metrics

Severity
critical
Priority score
170.66
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
100.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
99.7 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2025-07-07 00:00 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • packagist

    phpmailer/phpmailer5.0.0

  • packagist

    phpmailer/phpmailerv5.2.10

  • packagist

    phpmailer/phpmailerv5.2.11

  • packagist

    phpmailer/phpmailerv5.2.12

  • packagist

    phpmailer/phpmailerv5.2.13

  • packagist

    phpmailer/phpmailerv5.2.14

  • packagist

    phpmailer/phpmailerv5.2.15

  • packagist

    phpmailer/phpmailerv5.2.16

  • packagist

    phpmailer/phpmailerv5.2.17

  • packagist

    phpmailer/phpmailerv5.2.2

  • packagist

    phpmailer/phpmailerv5.2.4

  • packagist

    phpmailer/phpmailerv5.2.5

  • packagist

    phpmailer/phpmailerv5.2.6

  • packagist

    phpmailer/phpmailerv5.2.7

  • packagist

    phpmailer/phpmailerv5.2.8

  • packagist

    phpmailer/phpmailerv5.2.9

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-10033