CVE-2012-2740

EPSS 3.3%

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/18639unverified exploitdbwww.exploit-db.com/exploits/18639unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://securitytracker.com/id?1027181 https://mantis.phplist.com/view.php?id=16557 https://www.phplist.com/?lid=567 http://www.exploit-db.com/exploits/18639 http://www.openwall.com/lists/oss-security/2012/06/16/1 http://www.openwall.com/lists/oss-security/2012/06/17/2 http://www.securityfocus.com/bid/52657 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php