HTB23100: phpList 2.10.18 cross-site scripting and SQL injection vulnerabilities

phpList version 2.10.18 suffers from SQL injection and cross-site scripting (XSS) vulnerabilities.

1. SQL injection: Input passed via the "delete" GET parameter to "admin/index.php" script (when "page" is set to "editattributes") is not properly sanitised before being used in SQL query.
2. Cross-site scripting (XSS): Input passed via the "unconfirmed" GET parameter to "admin/index.php" script (when "page" is set to "user") is not properly sanitised before being returned to the user.

Vulnerability ID: HTB23100
Vendor Notification / Patch / Public Disclosure Dates: July 11 / August 2 / August 8, 2012
Vulnerabilities Type: XSS, SQL Injection
Risk level: Medium
Solution Status: Fixed by Vendor, upgrade to phpList 2.10.19

See details and PoC-examples for this advisory: phpList multiple vulnerabilities.