phpList Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in phpList version 3.6.3. The issue arises in the /lists/dl.php endpoint, where the id parameter is not properly sanitized, allowing attackers to inject arbitrary JavaScript code.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the /lists/dl.php endpoint with a crafted id parameter that includes malicious JavaScript. The lack of proper sanitization will allow the injected script to execute in the victim's browser.

Remediation

Users are advised to upgrade to phpList version 3.6.16 or later, where this vulnerability has been addressed.