Vulnerability in Gregory Kokanosky Phpmynewsletter
CVE-2007-2372
admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and list_id fields; and send the message via a direct request for the MsgId value under admin/.
EPSS: 0.082 (94.3th percentile) — read the EPSS interpretation.
Affected products
- Gregory_kokanosky Phpmynewsletter
- N/a — versions n/a
References
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)