PT-2009-3076 · Phplist · Phplist

Published 2009-02-05 · Updated 2018-10-11 · CVE-2009-0422

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phplist versions 2.10.8 and earlier

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the SERVER[ConfigFile] parameter to admin/index.php. This is possible when register globals is disabled.

Recommendations For phplist versions 2.10.8 and earlier, consider disabling the admin/index.php endpoint until a patch is available. Restrict access to the lists/admin.php file to minimize the risk of exploitation. Avoid using the SERVER[ConfigFile] parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0422

Affected Products

Phplist

References · 7

• 🔥 http://bugreport.ir/index_60.htm · Exploit
• 🔥 https://exploit-db.com/exploits/7778 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0422 · Security Note
• http://secunia.com/advisories/33533 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47945 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0422 · Note
• http://securityfocus.com/archive/1/500057/100/0/threaded · Note