OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Security Advisory: Subscribe Me Lite 1.0 - 2.0 Unix or 1.0 - 2.0 NT and below.
From: Tom Pickles (tom_picklesHOTMAIL.COM)
Date: Tue Dec 12 2000 - 04:25:02 CST

note : This is not apparent in the commercial versions, (tested on three
different versions )
the author was notified and appropriate changes have since been made.

product page -

http://www.cgiscriptcenter.com/subscribe/index2.html

vendor notice -

Security Advisory:

Users of Subscribe Me Lite 1.0 - 2.0 Unix or 1.0 - 2.0 NT, update today to
protect your Subscribe Me Lite from outside access to your administration
panel.

[Full disclosure]

yes thats right, the malicious user can cause somewhat considerable damage
to a subscribe me lite
mailing list if you are using versions 1.0 - 2.0 Unix or 1.0 - 2.0 NT a
simple web browser pre-formatted
call, can allow an attacker to delete ANY user from the list in the form of

email.com">http://url.to.victim.com/subscribe.pl?someemail.com

The user will be deleted from the list without any kind of verification
whatsoever.

The vendor has updated with this information, please update yours.

Thanks
Tom (Digital Vampire)

IC-CRYPT.com // Enhancing communications since 1998