CVE-2016-10033 PoC — PHPMailer 安全漏洞

Readme

# CVE-2016-10033 – PHPMailer Remote Code Execution

## 📌 Description
This repository contains a proof-of-concept (PoC) exploit for **CVE-2016-10033**,  
a vulnerability in **PHPMailer** versions prior to **5.2.18**.  
The issue occurs when the `$additional_parameters` argument of PHP's built-in  
`mail()` function is improperly handled, allowing attackers to inject additional  
command-line parameters into **sendmail**. This can be abused to write arbitrary  
PHP code to a web-accessible directory, leading to **Remote Code Execution (RCE)**.

---

## ⚠️ Disclaimer
This project is for **educational and authorized security testing purposes only**.  
Do not use this exploit against systems you do not own or have permission to test.  
The author takes **no responsibility** for any misuse of this code.

---

## 🛠 Affected Versions
- PHPMailer ≤ **5.2.17**  
- PHP when configured to use `sendmail`  
- `sendmail_path` defined and accessible  

---

File Snapshot

Remarks