Vanilla Forums software is still affected by a critical remote code execution zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-10033 | Command Injection RCE in PHPMailer (Ships with WordPress and Joomla) CVE-2016-10033 is an argument/command injection flaw in the mailSend function of PHPMailer's isMail transport, affecting all PHPMailer releases before 5.2.18. When a crafted Sender (From) address containing a backslash-double-quote sequence is passed to the underlying mail command, extra arguments can be injected, allowing an unauthenticated remote attacker to execute arbitrary code on the hosting server. Because PHPMailer is one of the most widely distributed PHP mail libraries and is bundled with WordPress and Joomla, a very large population of sites and PHP applications is potentially affected, though exploitable deployments are those sending mail via the isMail transport with attacker-influenced sender addresses. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-07-07 and EPSS assigns a 99.7% probability of exploitation within 30 days, so active exploitation should be assumed. Ransomware association is currently listed as unknown. Do: Upgrade PHPMailer to 5.2.18 or later everywhere it is deployed, including bundled copies inside WordPress, Joomla, and other PHP applications, and bring CMS cores current. Audit internet-facing forms, contact handlers, and API endpoints that pass user-supplied email addresses as the Sender/From value, and identify which systems send mail via the isMail transport. Federal agencies must apply vendor mitigations per CISA instructions or follow BOD 22-01 guidance for cloud services; treat exploitation as likely given the KEV listing and 99.7% EPSS. | 9.8 | 100% | KEV PoC ×14 |
| masshundreds of millions of sites potentially affected (PHPMailer is bundled with WordPress, which runs roughly 40% of all websites, plus millions of Joomla… | |
| CVE-2016-10045 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary cod The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. NVD description · AI analysis pending | 9.8 | 98% | PoC ×6 |
| — | |
| CVE-2016-10073 | The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentiall The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request. NVD description · AI analysis pending | 7.5 | 84% | PoC ×3 |
| — |
Full article546 words · extracted from securityaffairs.com · click to collapse
The popular Vanilla Forums software is still affected by a critical remote code execution zero-day first reported to the development team in December 2016.
The exploit code was published by ExploitBox, a remote attacker can chain the flaw with the Host Header injection vulnerability CVE-2016-10073 to execute arbitrary code and take the control of the affected software.
Vanilla Forums is the software mentioned by the popular security researcher Dawid Golunski in the following critical PHPMailer advisories a few months ago:
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html
“The researcher also developed an Unauthenticated RCE exploit for a popular
open-source application (deployed on the Internet on more than a
million servers) as a PoC for real-world exploitation. It might be published after the vendor has fixed the vulnerabilities. ” wrote Golunski.
Another day another #RCE #0day – #Vanilla Forums 2.3 -Patch it up #infosec
Advisory&PoC #exploit at #Exploit_Box https://t.co/fSO697kMQh pic.twitter.com/l8TR9NZk0a— Dawid Golunski (@dawid_golunski) May 11, 2017
He has been waiting for a few months before publishing the Vanilla Forums RCE exploit together with the WordPress 4.6 RCE exploit.
The Vanilla Forums software leverages PHPMailer that uses PHP’s mail() function as its default transport, as explained by the expert.
The mail() function can then be used to call Sendmail and an attacker can inject extra parameters into Sendmail by chaining the flaw with the CVE-2016-10073 vulnerability.
For example:
“Attacker \” -Param2 -Param3″@test.com
when processed by the PHPMailer (and eventually sent to mail()) function would cause sendmail to execute with:
- Arg no. 0 == [/usr/sbin/sendmail]
- Arg no. 1 == [-t]
- Arg no. 2 == [-i]
- Arg no. 3 == [-fAttacker\]
- Arg no. 4 == [-Param2]
- Arg no. 5 == [-Param3″@test.com]
Dawid Golunski in the ExploitBox post demonstrates how an HTTP 1.0 Web request to the forum will allow code injection down to PHPMailer.
“It should be noted that this vulnerability can still be exploited even if Vanilla software is hosted on Apache web server with several name-based vhosts enabled, and despite not being the default vhost.” wrote Golunski.
“This is possible as the attacker can take advantage of HTTP/1.0 protocol and specify the exact vhost within the URL. This will allow the HOST header to be set to arbitrary value as the Apache server will obtain the SERVER_NAME from the provided URL. This will ensure that the malicious request will reach the affected code despite invalid vhost within the HOST header.”
Below a video PoC of the exploit:
“The exploits and techniques prove that these type of vulnerabilities could be exploited by unauthenticated attackers via server headers such as HOST header that may be used internally by a vulnerable application to dynamically create a sender address.” Golunski told me. “This adds to the originally presented attack surface of contact forms that take user input including From/Sender address.”
These vulnerabilities affect the latest Vanilla Forums stable version 2.3 which unfortunately remains unpatched.
The 0day Vanilla Forums advisories are at:
- https://exploitbox.io/vuln/Vanilla-Forums-Exploit-Host-Header-Injection-CVE-2016-10073-0day.html
- https://exploitbox.io/vuln/Vanilla-Forums-Exploit-RCE-0day-Remote-Code-Exec-CVE-2016-10033.html
ExploitBox suggests setting the sender’s address to a static value, in this way it is possible to do not use the HOST header.
Update
The vulnerability was patched as reported in the Vanilla forums.
The issue only open source and none of hosted customers were affected.
[adrotate banner=”9″]
(Security Affairs – Vanilla Forums, hacking)
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/59031/hacking/vanilla-forums-software-rce.html