EUVD-2012-3897

Malware in sbrugna...

Sql injection

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

PT-2012-5083

Name of the Vulnerable Software and Affected Versions phplist versions prior to 2.10.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved via the delete parameter to the 'editattributes' page in 'admin/index.php'. Recommendations For versions...

CVE-2012-3953: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page...

CVE-2005-3555: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PHPlist 2.10.1 and earlier allow authenticated remote attackers with administrator privileges to execute arbitrary SQL commands via the id parameter in the 1 editattributes or 2 admin page...