Lyris ListManager Multiple Remote Vulnerabilities

Bugtraq ID:	36509
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 23 2009 12:00AM
Updated:	Sep 24 2009 05:10PM
Credit:	Richard Brain from ProCheckUp
Vulnerable:	Lyris ListManager 9.3D Lyris ListManager 9.3b Lyris ListManager 9.3a Lyris ListManager 9.3 Lyris ListManager 9.2c Lyris ListManager 9.2b Lyris ListManager 9.2a Lyris ListManager 9.2 Lyris ListManager 9.2 Lyris ListManager 8.95d Lyris ListManager 8.95c Lyris ListManager 8.95b Lyris ListManager 8.95a Lyris ListManager 8.95 Lyris ListManager 10.2 Lyris List Manager 8.9 b Lyris List Manager 8.8 a Lyris List Manager 8.0 Lyris List Manager 7.0 Lyris List Manager 6.0 Lyris List Manager 5.0 Lyris List Manager 4.0 Lyris List Manager 3.0 Lyris List Manager 8.8
Not Vulnerable:

Lyris ListManager Multiple Remote Vulnerabilities

Lyris ListManager is prone to multiple vulnerabilities:

- An information-disclosure weakness
- Information-disclosure vulnerabilities
- SQL-injection vulnerabilities
- HTML-injection vulnerabilities
- Cross-site scripting vulnerabilities

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.

Lyris ListManager Multiple Remote Vulnerabilities

An attacker can use a browser to exploit these issues. For a cross-site scripting issue, the attacker must entice an unsuspecting user to following a malicious link.

Lyris ListManager Multiple Remote Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Lyris ListManager Multiple Remote Vulnerabilities

References:

• Lyris ListManager Homepage (Lyris)
  
• PR09-06 Lyris Listmanager Security Research (ProCheckUp)