phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e.g., embedded as an image in an email) to delete any non-self administrator account.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/phpList/phplist3/commit/5159c3ed33a5674a8169472b50d146d97f63…
disclosure@vulncheck.com
https://github.com/phpList/phplist3/issues/1117
disclosure@vulncheck.com
https://github.com/phpList/phplist3/pull/1121
disclosure@vulncheck.com
https://github.com/phpList/phplist3/releases/tag/v3.7.0-RC5
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/phplist-rc5-cross-site-request-forgery-via…
disclosure@vulncheck.com