admin.php in Newsletter ZWS allows remote attackers to gain administrative privileges via a list_user operation with the ulevel parameter set to 1 (administrator level), which lists all users and their passwords.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Newsletter_zws | Zaireweb_solutions | * | * |
References
- http://marc.info/?l=bugtraq\u0026m=108811585025216\u0026w=2
- http://www.securityfocus.com/bid/10605
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16507
- http://marc.info/?l=bugtraq\u0026m=108811585025216\u0026w=2
- http://www.securityfocus.com/bid/10605
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16507