CVE-2016-10033 – PHPMailer Remote Code Execution

📌 Description

This repository contains a proof-of-concept (PoC) exploit for CVE-2016-10033,
a vulnerability in PHPMailer versions prior to 5.2.18.
The issue occurs when the $additional_parameters argument of PHP's built-in
mail() function is improperly handled, allowing attackers to inject additional
command-line parameters into sendmail. This can be abused to write arbitrary
PHP code to a web-accessible directory, leading to Remote Code Execution (RCE).

---

⚠️ Disclaimer

This project is for educational and authorized security testing purposes only.
Do not use this exploit against systems you do not own or have permission to test.
The author takes no responsibility for any misuse of this code.

---

🛠 Affected Versions

• PHPMailer ≤ 5.2.17
• PHP when configured to use sendmail
• sendmail_path defined and accessible

---