CVE-2012-4246
phplist < 2.10.19 - Cross-Site Scripting via Page Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-4246.
AI-analyzed exploit summary The exploit demonstrates a CSRF vulnerability in phplist 2.10.9 that allows an attacker to add an admin account via a crafted POST request. It also includes an XSS payload delivery mechanism via a form submission to the send message functionality.
Description
Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.
Exploits (1)
The exploit demonstrates a CSRF vulnerability in phplist 2.10.9 that allows an attacker to add an admin account via a crafted POST request. It also includes an XSS payload delivery mechanism via a form submission to the send message functionality.