bugtraq - [TKADV2005-11-001] Multiple vulnerabilities in PHPlist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20051107195731.924B890006@www.strato-webmail.de>
Date: Mon,  7 Nov 2005 20:57:31 +0100 (CET)
From: tk@...pkit.de
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: [TKADV2005-11-001] Multiple vulnerabilities in
	PHPlist

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Advisory:            Multiple vulnerabilities in PHPlist           
Name:                TKADV2005-11-001
Revision:            1.0              
Release Date:        2005/11/07 
Last Modified:       2005/11/07 
Author:              Tobias Klein (tk at trapkit.de)
Affected Software:   PHPlist (all versions <= 2.10.1) 
Risk:                Critical ( ) High (x) Medium (x) Low (x) 
Vendor URL:          http://www.phplist.com/ 
Vendor Status:       Vendor has released an updated version         

========= 
Overview:
========= 

  PHPlist is a double opt-in newsletter manager. It is written in 
  PHP and uses a SQL database for storing the information.

  Version 2.10.1 and prior contain multiple Cross Site Scripting 
  and SQL Injection vulnerabilities. Furthermore it is possible to
  access and read arbitrary system files through a vulnerability in
  PHPlist.

========= 
Solution: 
=========

  Upgrade to PHPlist 2.10.2 or newer.

  http://www.phplist.com/files/

For more technical details see: 

  http://www.trapkit.de/advisories/TKADV2005-11-001.txt

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQ2+xMpF8YHACG4RBEQLokQCg7cyW6AfrNYY7WZ06mPBrH3uos/cAn06l
roUuWofKu3koFc4l62Za1mEY
=rRgy
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/