PHPList Remote File Inclusion Vulnerability

Affected Versions:
PHPlist 2.6.2

Vulnerability description:

PHPlist is a newsletters application written by PHP.
Because PHPlist does not fully filter user-submitted requests, remote attackers can exploit this vulnerability to include malicious PHP files on the remote server for WEB execution.

<* Reference
Michiel Dethmers (secfoc@kipu.co.uk)
Http://marc.theaimsgroup.com /? L = bugtraq & m = 106883977911662 & w = 2
*>

SEBUG Security suggestions:

Temporary solution:
If you cannot install or upgrade the patch immediately, we recommend that you take the following measures to reduce the threat:
* If Apache is used, use the. htaccess file to restrict "admin" Directory Access:
<FilesMatch ". (php | inc) $">
Order allow, deny
Deny from all
</FilesMatch>
<FilesMatch "index. php $">
Order allow, deny
Allow from all
</FilesMatch>

Vendor patch:
Tincan ltd
----------
The vendor has released a patch to fix this security issue. Please download PHPlist versions 2.6.3 or 2.6.4 from the vendor's homepage:
Http://www.phplist.com/

// Sebug.net [2009-09-05]