PT-2006-4357 · Php · Phpmaillist

Lostmon · Published 2006-07-10 · Updated 2011-03-08 · CVE-2006-3482

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHPMailList versions 1.8.0 and earlier

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the email parameter in the maillist.php file.

Recommendations For PHPMailList versions 1.8.0 and earlier, avoid using the email parameter in the maillist.php file until a fix is available. As a temporary workaround, consider validating and sanitizing user input for the email parameter to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-3482

Affected Products

Phpmaillist

References · 7

• http://secunia.com/advisories/20959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3482 · Security Note
• http://vupen.com/english/advisories/2006/2690 · Note
• http://osvdb.org/27016 · Note
• http://lostmon.blogspot.com/2006/07/multiple-vulnerabilities-in.html · Note
• http://securitytracker.com/id?1016439 · Note
• http://securityfocus.com/bid/18840 · Note