PHPList SQL Injection and Multiple Cross Site Scripting Vulnerabilities
BID:49745
Info
PHPList SQL Injection and Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 49745 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 22 2011 12:00AM |
| Updated: | Sep 22 2011 12:00AM |
| Credit: | Secunia Research |
| Vulnerable: |
PHPList PHPList 2.10.14 PHPList PHPList 2.10.8 PHPList PHPList 2.10.7 PHPList PHPList 2.10.6 PHPList PHPList 2.10.5 PHPList PHPList 2.10.4 PHPList PHPList 2.10.4 PHPList PHPList 2.10.3 PHPList PHPList 2.10.2 PHPList PHPList 2.10.1 PHPList PHPList 2.10.13 |
| Not Vulnerable: |
PHPList PHPList 2.10.17 |
Discussion
PHPList SQL Injection and Multiple Cross Site Scripting Vulnerabilities
PHPList is prone to an SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHPList 2.10.14 is vulnerable; other versions may also be affected.
PHPList is prone to an SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHPList 2.10.14 is vulnerable; other versions may also be affected.
Exploit / POC
PHPList SQL Injection and Multiple Cross Site Scripting Vulnerabilities
Attackers can use a browser to exploit the SQL-injection issues. The attacker must trick an unsuspecting victim into following a malicious URI to exploit the cross-site scripting issues.
Attackers can use a browser to exploit the SQL-injection issues. The attacker must trick an unsuspecting victim into following a malicious URI to exploit the cross-site scripting issues.
Solution / Fix
PHPList SQL Injection and Multiple Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
PHPList SQL Injection and Multiple Cross Site Scripting Vulnerabilities
References:
References:
- PHPList Homepage (PHPList)
- New stable version 2.10.16 (PHPLIST)
- New stable version 2.10.17 (PHPLIST)