Phplist3
Monthly
Administrator account deletion in phpList before 3.7.0-RC5 is exploitable via CSRF, allowing a remote attacker to permanently remove any non-self administrator account by tricking a logged-in super-administrator into loading a single crafted GET URL. The root cause is that the deletion endpoint in admins.php bypasses CSRF token validation when the token parameter is absent and the central verifyCsrfGetToken check is called with enforce=false, making the action trivially triggerable via an embedded image in an HTML email. A publicly available exploit is confirmed by VulnCheck; the vendor-released fix is v3.7.0-RC5, and no CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Administrator account deletion in phpList before 3.7.0-RC5 is exploitable via CSRF, allowing a remote attacker to permanently remove any non-self administrator account by tricking a logged-in super-administrator into loading a single crafted GET URL. The root cause is that the deletion endpoint in admins.php bypasses CSRF token validation when the token parameter is absent and the central verifyCsrfGetToken check is called with enforce=false, making the action trivially triggerable via an embedded image in an HTML email. A publicly available exploit is confirmed by VulnCheck; the vendor-released fix is v3.7.0-RC5, and no CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.