critical10.0Public exploit code
CVE-2007-2372
admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are mi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- phpMyNewsletter 0.8 (beta5) - Multiple Vulnerabilities2007-04-05 · webapps · php · Verified
Impact
admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and list_id fields; and send the message via a direct request for the MsgId value under admin/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gregory Kokanosky | Phpmynewsletter | through 0.8_beta_5 |