CSV Injection Vulnerability in phpList Affected by WeHackMX Research
CVE-2021-3188

9.8CRITICAL

Key Information:

Vendor

PHPlist

Status
PHPlist
Vendor
CVE Published:
21 January 2021

What is CVE-2021-3188?

phpList version 3.6.0 is susceptible to a CSV injection vulnerability that arises from improper handling of the email parameter in exports located at /lists/admin/. If exploited, this vulnerability can allow attackers to craft manipulative CSV files, leading to data manipulation or execution of unwanted commands when those files are subsequently opened in spreadsheet applications. Organizations using this version of phpList should review their security measures and apply necessary updates to mitigate this risk.

References

https://wehackmx.com/security-research/WeHackMX-2021-001/
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.