Description
Directory traversal vulnerability in PHPList 2.10.2 and earlier allows remote attackers to include arbitrary local files via the (1) GLOBALS[database_module] or (2) GLOBALS[language_module] parameters, which overwrite the underlying $GLOBALS variable.
References
- 1015889 vdb-entry
- 17429 vdb-entry
- 20061012 new version of phplist fix XSS vulnerability mailing-list
- phplist-index-file-include(25701) vdb-entry
- http://tincan.co.uk/?lid=851
- ADV-2006-1296 vdb-entry
- 20060411 Re: PHPList <= 2.10.2 remote commands execution mailing-list
- 20060410 PHPList <= 2.10.2 remote commands execution mailing-list
- http://downloads.securityfocus.com/vulnerabilities/exploits/PHPList-lfi.php