PHPMailer < 5.2.18 Remote Code Execution (RCE) and Argument Injection Vulnerability (CVE-2016-10033)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2016-10033) exists in the mailSend function within the isMail transport of PHPMailer before version 5.2.18. PHPMailer utilizes PHP's native mail() function to dispatch emails. The root cause lies in the insufficient validation of the Sender property (which populates the From address). When an attacker injects a backslash and double quotes (\") into the Sender field, it bypasses sanitization routines and allows the injection of additional command-line arguments (CWE-88) passed to the underlying sendmail binary.

2. Exploitation Mechanics & Attack Scenario

PHP's mail() function allows passing additional parameters to the Mail Transfer Agent (MTA) via its fifth argument. PHPMailer uses this argument to pass the -f option (envelope sender address). By crafting a payload such as "attacker(at)example.com\" -OQueueDirectory=/tmp -X/var/www/html/rce.php some", an attacker can manipulate the sendmail execution parameters. The -O option redefines the queue directory, and the -X option writes the transaction log to a specified path within the web root. By embedding PHP web shell code in the email body, the attacker forces sendmail to write a malicious PHP file to the web directory, achieving unauthenticated Remote Code Execution (RCE).

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and active exploitation history (listed in CISA KEV), this vulnerability poses an extreme risk. An unauthenticated attacker can exploit public-facing forms (e.g., contact forms, registration, password resets) to gain full shell access to the underlying server. This can lead to complete system compromise, database exfiltration, ransomware deployment, and lateral movement within the internal network.