PHPList Public Pages MultipleCross-Site Scripting Vulnerabilities

Bugtraq ID:	20483
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 12 2006 12:00AM
Updated:	Oct 13 2006 01:09PM
Credit:	Michiel Dethmers is credited with the discovery of these vulnerabilities. MustLive also discovered one of these issues.
Vulnerable:	PHPList Mailing List Manager 2.10.1 PHPList Mailing List Manager 2.8.12 PHPList Mailing List Manager 2.6.4 PHPList Mailing List Manager 2.6.3 PHPList Mailing List Manager 2.6.2 PHPList Mailing List Manager 2.6.1 PHPList Mailing List Manager 2.6
Not Vulnerable:	PHPList Mailing List Manager 2.0.13

PHPList Public Pages MultipleCross-Site Scripting Vulnerabilities

phpList is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to 2.10.3 are vulnerable to this issue.

PHPList Public Pages MultipleCross-Site Scripting Vulnerabilities

These issues can be exploited through a web client.

The following proof of concept is available:

http://www.example.com/phplist_path/?p=unsubscribe&id=1&unsubscribeemail=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

PHPList Public Pages MultipleCross-Site Scripting Vulnerabilities

Solution:
The vendor has released an update to address these issues. Please see the references for more information.

mailto:[email protected]

PHPList Public Pages MultipleCross-Site Scripting Vulnerabilities

References:

• Cross-Site Scripting ? phplist (MustLive)
  
• phpList Change Log (phpList)
  
• PHPList Homepage (PHPList)
  
• new version of phplist fix XSS vulnerability ([email protected])