Description
phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.
Remediation
References
Related Vulnerabilities
WordPress Plugin Custom Add User Cross-Site Scripting (2.0.2)
Atlassian Jira Observable Discrepancy Vulnerability (CVE-2020-4028)
MySQL CVE-2020-14614 Vulnerability (CVE-2020-14614)
Drupal Core 5.x Local File Inclusion (5.0 - 5.15)
WordPress Plugin Multilanguage by BestWebSoft Cross-Site Scripting (1.2.1)