Description
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| phpList | phpList | < 3.6.17 | 3.6.17 |
References
- Researcher write-up technical-description exploit
- the handler acts on POST data with no token check technical-description
- 3.6.17 requires verifyCsrfGetToken patch
- https://github.com/phpList/phplist3 product
- VulnCheck Advisory: phpList before 3.6.17 Cross-Site Request Forgery via massremove.php third-party-advisory