cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Document phplist SQL injection and XSS.

Browse Source 
Submitted by:	Krzysztof Stryjek <wtp@bsdserwis.com>
This commit is contained in:
Wesley Shields 2012-07-02 20:05:25 +00:00
parent 653ca08290
commit 0b3802356b
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=300396
1 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
security/vuxml/vuln.xml
View File

@ -52,6 +52,40 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="fd8bac56-c444-11e1-864b-001cc0877741">
<topic>phpList -- SQL injection and XSS vulnerability</topic>
<affects>
<package>
<name>phplist</name>
<range><le>2.10.17</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zero Science Lab reports:</p>
<blockquote cite="http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php">
<p>Input passed via the parameter 'sortby' is not properly
sanitised before being returned to the user or used in SQL queries.
This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code. The param 'num' is vulnerable to a XSS issue
where the attacker can execute arbitrary HTML and script code in
a user's browser session in context of an affected site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2740</cvename>
<cvename>CVE-2012-2741</cvename>
<bid>52657</bid>
<url>https://www.phplist.com/?lid=567</url>
<url>http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php</url>
</references>
<dates>
<discovery>2012-03-21</discovery>
<entry>2012-07-02</entry>
</dates>
</vuln>
<vuln vid="ff922811-c096-11e1-b0f4-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>