writeups.xyz / Partial File Read in phpList <= 3.6.12 (CVE-2023-35834)

Submitter : c2a

Date: 4 July 2023

Bounty : undisclosed

Vulnerabilities :

• Arbitrary File Read
• PHP Filter Chain
• Security Code Review

Programs :

• PhpList

Authors :

• Vincent Herbulot
• Rémi Matasse (@_Remsio_)

Link :
https://www.synacktiv.com/sites/default/files/2023-07/synacktiv-phplist-partial-file-read.pdf