CVE-2009-0422 | BDVDB-2026-34722 Detail

Description#

Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SERVER[ConfigFile] parameter to admin/index.php.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://exchange.xforce.ibmcloud.com/vulnerabilities/47945
http://secunia.com/advisories/33533
http://www.bugreport.ir/index_60.htm
http://www.securityfocus.com/archive/1/500057/100/0/threaded
https://www.exploit-db.com/exploits/7778

Exploit#

https://www.exploit-db.com/exploits/7778

History#

Version 12009-02-05Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.