Drupal PHPList Integration 'My Account' Cross Site Request Forgery Vulnerability

Bugtraq ID:	37054
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 18 2009 12:00AM
Updated:	Nov 18 2009 08:35PM
Credit:	Peter Wolanin of the Drupal Security Team
Vulnerable:	Drupal PHPList Integration 6.x-1.0 Drupal PHPList Integration 5.x-1.1
Not Vulnerable:	Drupal PHPList Integration 6.x-1.1 Drupal PHPList Integration 5.x-1.2

Drupal PHPList Integration 'My Account' Cross Site Request Forgery Vulnerability

Drupal PHPList Integration is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected application, or delete certain data. Other attacks are also possible.

Drupal PHPList Integration 'My Account' Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.

Drupal PHPList Integration 'My Account' Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for details.


Drupal PHPList Integration 5.x-1.1

• Drupal phplist-5.x-1.2.tar.gz
  http://ftp.drupal.org/files/projects/phplist-5.x-1.2.tar.gz

Drupal PHPList Integration 6.x-1.0

• Drupal phplist-6.x-1.1.tar.gz
  http://ftp.drupal.org/files/projects/phplist-6.x-1.1.tar.gz

Drupal PHPList Integration 'My Account' Cross Site Request Forgery Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2009-102 - PHPList Integration Module - Cross Site Request Forgery (Drupal)