Lucene search
K

phpList 2.10.18 Cross Site Scripting

🗓️ 01 Jul 2012 00:00:00Reported by HTTPCSType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 13 Views

A vulnerability in phpList 2.10.18 allows for cross-site scripting attacks via the 'id' parameter in the '/lists/admin/' page, potentially executing arbitrary HTML and script code

Code
`HTTPCS Advisory : HTTPCS1  
  
Product : phpList  
  
Version : 2.10.18  
  
Date : 2012-06-13  
  
Criticality level : Less Critical  
  
Description : A vulnerability has been discovered in phpList, which can be  
exploited by malicious people to conduct cross-site scripting attacks. Input  
passed via the 'id' parameter to '/lists/admin/' is not properly sanitised  
before being returned to the user. This can be exploited to execute arbitrary  
HTML and script code in a user's browser session in context of an affected site.  
  
Page : /lists/admin/  
  
Variables : page=bouncerule&id=[VulnHTTPCS]  
  
Type : XSS  
  
Method : GET  
  
References : https://www.httpcs.com/advisory/httpcs1  
  
Credit : HTTPCS [Web Vulnerability Scanner]  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation