phplistSQL.txt

`-----------------------------------------  
PhpList Sql Injection and Path Disclosure  
-----------------------------------------  
  
Vulnerabilities  
---------------  
  
1) There is an sql injection in the id parameter of public_html/lists/admin/?page=admin&id=INJECT HERE  
  
2) Because of the heavy use of classes without proper checking of whether the script is directly called there is many path disclosures. The following pages are all affected under the preceding directory.  
  
public_html/lists/admin:  
about.php  
connect.php  
domainstats.php  
usercheck.php  
  
admin/commonlib/pages:  
attributes.php  
dbcheck.php  
importcsv.php  
user.php  
usermgt.php  
users.php  
  
public_html/lists/admin/plugins:  
helloworld.php  
sidebar.php  
  
public_html/lists/admin/plugsins/defaultplugin:  
main.php  
  
Solution  
--------  
  
1) cleanse the id parameter before processing  
  
2) check to see if the script is being directly called and then have the script die  
  
Credit  
------  
  
[email protected]  
`