CVE-2007-2372

CVE-2007-2372 affects phpMyNewsletter 0.8 beta5 and earlier. The admin/send_mod.php path prints a Location header but does not exit when administrative credentials are missing, enabling remote attackers to craft an e-mail via a POST containing subject, message, format, and list_id, then send the ...