PHPList Remote File Include Vulnerability

Bugtraq ID:	9046
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 14 2003 12:00AM
Updated:	Nov 14 2003 12:00AM
Credit:	The disclosure of this issue has been credited to Michiel Dethmers <[email protected]>.
Vulnerable:	tincan ltd PHPlist 2.6.2
Not Vulnerable:	tincan ltd PHPlist 2.6.4 tincan ltd PHPlist 2.6.3

PHPList Remote File Include Vulnerability

It has been reported that PHPlist may be vulnerable to an access validation issue that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable system.

PHPlist versions 2.6.2 and prior have been reported to be vulnerable to this issue.

PHPList Remote File Include Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHPList Remote File Include Vulnerability

Solution:
It has been reported that PHPlist versions 2.6.3 and 2.6.4 are not vulnerable to this issue. Users are advised to download the fixed versions from the vendor site.

PHPList Remote File Include Vulnerability

References:

• PHPlist (tincan ltd)
  
• PHPlist, file injection vulnerability (Michiel Dethmers )