Description
Directory traversal vulnerability in admin/defaults.php in PHPlist 2.10.1 and earlier allows remote attackers to access arbitrary files via a .. (dot dot) in the selected%5B%5D parameter in an HTTP POST request.
References
- http://www.trapkit.de/advisories/TKADV2005-11-001.txt
- 20051107 [TKADV2005-11-001] Multiple vulnerabilities in PHPlist mailing-list
- ADV-2005-2345 vdb-entry
- 20569 vdb-entry
- 17476 third-party-advisory
- 15350 vdb-entry