CVE-2009-0422: Code Injection
Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when registerglobals is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the SERVER[ConfigFile] parameter to admin/index.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0422?
CVE-2009-0422 has a high severity rating due to its ability to allow remote attackers to execute arbitrary files.
How do I fix CVE-2009-0422?
To fix CVE-2009-0422, update your phpList installation to version 2.10.9 or later.
What are the affected versions for CVE-2009-0422?
Affected versions of phpList include versions 2.10.8 and earlier, along with various earlier 1.x versions.
What kind of attacks can CVE-2009-0422 enable?
CVE-2009-0422 can enable directory traversal attacks that allow remote execution of arbitrary local files.
Is register_globals a factor in CVE-2009-0422?
Yes, the vulnerability can be exploited when the register_globals setting is disabled in phpList.