A vulnerability was found in PHPList 3.2.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Subscription. The manipulation leads to sql injection. Using CWE to declare the problem leads to CWE-89. The weakness was presented 03/17/2017 by Tim Coen with Curesec Research Team as phplist 3.2.6: SQL Injection as Mailinglist Post (Full-Disclosure). The advisory is available at seclists.org. The public availability has been coordinated in cooperation with the vendor. This vulnerability is handled as CVE-2017-20032. The attack may be launched remotely. There are no technical details available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. This vulnerability is assigned to T1505 by the MITRE ATT&CK project. It is declared as proof-of-concept. The exploit is available at seclists.org. As 0-day the estimated underground price was around $0-$5k. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

67 more entries are not shown