SQL injection vulnerability in PhpList allows remote attackers to modify SQL statements via the id argument to admin pages such as (1) members or (2) admin.
https://exchange.xforce.ibmcloud.com/vulnerabilities/21576
http://www.securityfocus.com/bid/14403
http://securitytracker.com/id?1014607
http://secunia.com/advisories/16274