Lyris ListManager Subscription Form Administrative Command Injection

high Nessus Plugin ID 20806

Language:

Synopsis

The remote web server is affected by an administrative command injection flaw.

Description

The remote host appears to be running ListManager, a web-based commercial mailing list management application from Lyris.

According to its banner, the version of ListManager installed on the remote host does not sufficiently sanitize input to the 'pw' parameter when processing new subscription requests via the web. Using a specially crafted request, an unauthenticated attacker may be able to leverage this flaw to inject administrative commands into the affected application.

Solution

Upgrade to ListManager 8.95 or later.

Plugin Details

Severity: High

ID: 20806

File Name: listmanager_895.nasl

Version: 1.17

Type: remote

Family: CGI abuses

Published: 1/25/2006

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 12/9/2005

Reference Information

CVE: CVE-2005-4142

BID: 15786

Detections

Analytics