critical9.8Public exploit code
CVE-2020-8547
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e fol…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- phpList 3.5.0 - Authentication Bypass2020-02-03 · webapps · php
Impact
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phplist | Phplist | Version 3.5.0 |