CVE-2005-3556 Cross-site scripting in n/a

Medium 4.3 Published 16 Nov 2005 Updated 7 Aug 2024

Remote attackers can inject arbitrary web script or HTML into PHPlist admin pages, potentially leading to session hijacking or code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2005-3556?

CVE-2005-3556 is a medium-severity cross-site scripting vulnerability in n/a, published on 16 Nov 2005. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listname parameter in (a) admin/editlist.php, (2) title parameter in (b) admin/spageedit.php, (3) title field in (c) admin/template.php, (4) filter, (5) delete, and (6) start parameters in (d) admin/eventlog.php, (7) id parameter in (e) admin/configure.php, (8) find parameter in (f) admin/users.php, (9) start parameter in (g) admin/admin.php, and (10) action parameter in (h) admin/fckphplist.php.

Which versions are affected by CVE-2005-3556?

It affects 1 product.

Products include Tincan Phplist.

How do I fix CVE-2005-3556?

No fix has been published for CVE-2005-3556 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2005-3556 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-3556 exists.

Public exploit code: 3 Exploit-DB entries.

Sources

Also known as GHSA-3362-wc7m-63fx.