Description
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
Remediation
References
Related Vulnerabilities
MySQL CVE-2016-0616 Vulnerability (CVE-2016-0616)
OpenSSL Improper Access Control Vulnerability (CVE-2016-7054)
WordPress Plugin Contact Form Manager Multiple Vulnerabilities (1.4.4)
WordPress Plugin WP-FB-AutoConnect Multiple Cross-Site Request Forgery Vulnerabilities (4.0.5)
Chamilo Improper Privilege Management Vulnerability (CVE-2022-27421)