int21.de
http://int21.de/cve/CVE-2011-0748-phplist.html CVE-2011-0748
phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting
Record summary
CVE-2011-0748 has a selected CVSS score of 6.8; EIP currently links 1 catalogued exploit.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in phpList before 2.10.13 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) edit administrator accounts.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBphpList 2.10.9 - Cross-Site Request Forgery / Cross-Site ScriptingExploitDB exploitby Cyber-CrystalNot analyzed1 file
References
1078549vdb entry
http://osvdb.org/78549 44041Third-party advisory
http://secunia.com/advisories/44041 8199Third-party advisory
http://securityreason.com/securityalert/8199 18419exploit
http://www.exploit-db.com/exploits/18419 phplist.comConfirmation
http://www.phplist.com/?lid=516 20110407 phplist: cross site request forgery (CSRF), CVE-2011-0748mailing list
http://www.securityfocus.com/archive/1/517400/100/0/threaded 51681vdb entry
http://www.securityfocus.com/bid/51681 phplist-admin-csrf(72746)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/72746 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2011-0748