CSRF in phpList Admin Deletion via Malicious URL

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in phpList versions before 3.7.0-RC5. It allows an attacker to delete any non-self administrator account by tricking a logged-in super-administrator into loading a crafted URL, such as one embedded in an email. The vulnerability exists because the administrator deletion action in lists/admin/admins.php is performed via an unauthenticated GET request without verifying a CSRF token.

Useful 0 Not Useful 0

Detection Guidance

To detect this CSRF vulnerability in phpList, check if your version is prior to 3.7.0-RC5. Inspect the admins.php file for GET requests handling administrator deletion without CSRF token verification. Look for GET parameters like ?page=admins&delete=N in server logs or network traffic.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete administrator accounts without authorization, leading to loss of access for legitimate users. This could disrupt system operations, cause data loss, or allow further unauthorized actions if the attacker gains control of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, violating confidentiality and integrity requirements under GDPR and HIPAA. Organizations using affected phpList versions may face compliance violations, potential fines, and reputational damage due to inadequate security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade phpList to version 3.7.0-RC5 or later. Ensure CSRF tokens are enforced in deletion actions by verifying verifyCsrfGetToken() is called with enforce=1 in admins.php, bouncerule.php, and bouncerules.php. Review server logs for suspicious GET requests with delete parameters.

Useful 0 Not Useful 0