PT-2023-21218 · Phplist · Phplist

Published 2023-08-18 · Updated 2024-10-07 · CVE-2023-27576

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.6.14

Description An issue was discovered due to an access error, allowing manipulation and editing of the system's super admin data, which enables an account takeover of the user with super-admin permission. Specifically, for a request with updatepassword=1, a modified request can bypass the intended email confirmation requirement by manipulating both the ID parameter and the associated username. This can be achieved by changing the ID number to 1, representing the super admin account, and changing the username to a desired value, such as admin2. The attacker can then change the super admin's email address to one under their control and perform a password reset for the super admin account, allowing login as the super admin.

Recommendations For versions prior to 3.6.14, update to version 3.6.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the updatepassword=1 request to minimize the risk of exploitation. Additionally, monitor and restrict changes to the super admin's email address and password reset requests to prevent potential account takeovers.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BIT-PHPLIST-2023-27576

CVE-2023-27576

Affected Products

Phplist

References · 7

• 🔥 https://cupc4k3.lol/cve-2023-27576-hacking-phplist-how-i-gained-super-admin-access-44c7c90d82da · Exploit
• https://osv.dev/vulnerability/BIT-phplist-2023-27576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27576 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27576 · Vendor Advisory
• https://github.com/phpList/phplist3/pull/986 · Note
• https://t.me/cvenotify/97357 · Telegram Post
• https://phplist.org/newslist/phplist-3-6-14-release-notes · Note