CyberRota Analysis
AI-GeneratedVersions of phpList prior to 3.6.17 are vulnerable to cross-site request forgery (CSRF) attacks, allowing malicious actors to exploit the mass subscriber removal form handler. This flaw enables attackers to trick logged-in administrators into visiting malicious pages, leading to unauthorized deletion and blacklisting of subscriber addresses without proper authentication checks. Organizations using affected phpList versions should prioritize patching to mitigate the risk of unauthorized subscriber management.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.