SQL Injection in Phplist

CVE-2012-2740

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.

Vulnerability class: SQL Injection

EPSS: 0.033 (87.4th percentile) — read the EPSS interpretation.

Affected products

  • Phplist — versions 2.10.1, 2.10.2, 2.10.3
  • N/a — versions n/a

Weakness classification (CWE)

References