phpList < 3.6.16 XSS Vulnerability

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:phplist:phplist";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.171525");
  script_version("2026-05-27T08:10:51+0000");
  script_tag(name:"last_modification", value:"2026-05-27 08:10:51 +0000 (Wed, 27 May 2026)");
  script_tag(name:"creation_date", value:"2025-05-20 08:27:21 +0000 (Tue, 20 May 2025)");
  script_tag(name:"cvss_base", value:"6.4");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:P/A:N");

  script_cve_id("CVE-2025-28074");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("phpList < 3.6.16 XSS Vulnerability");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_phplist_http_detect.nasl");
  script_mandatory_keys("phplist/detected");

  script_tag(name:"summary", value:"phpList is prone to a cross-site scripting (XSS)
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"phpList is vulnerable to Cross-Site Scripting (XSS) due to
  improper input sanitization in lt.php. The vulnerability is exploitable when the application
  dynamically references internal paths and processes untrusted input without escaping, allowing an
  attacker to inject malicious JavaScript.");

  script_tag(name:"affected", value:"phpList prior to version 3.6.16.");

  script_tag(name:"solution", value:"Update to version 3.6.16 or later.");

  script_xref(name:"URL", value:"https://github.com/phpList/phplist3/issues/1078");
  script_xref(name:"URL", value:"https://github.com/mLniumm/CVE-2025-28074");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!port = get_app_port(cpe: CPE))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "3.6.16")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.6.16", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);