CVE-2021-3188
📋 TL;DR
CVE-2021-3188 is a CSV injection vulnerability in phpList 3.6.0 that allows attackers to inject malicious formulas into exported CSV files via the email parameter. When victims open these CSV files in spreadsheet applications like Excel, the formulas execute, potentially leading to command execution or data theft. This affects all phpList 3.6.0 installations with admin export functionality enabled.
💻 Affected Systems
- phpList
📦 What is this software?
Phplist by Phplist
⚠️ Risk & Real-World Impact
Worst Case
Attackers achieve remote code execution on victim machines when malicious CSV files are opened in vulnerable spreadsheet applications, potentially compromising entire systems and networks.
Likely Case
Attackers steal sensitive data or execute limited commands on victim workstations when users open manipulated CSV exports in spreadsheet software.
If Mitigated
With proper user training and security controls, impact is limited to potential data leakage from exported files.
🎯 Exploit Status
Exploitation requires admin access to phpList and victim interaction with CSV files
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.1
Vendor Advisory: https://www.phplist.org/news/phplist-3-6-1-release-notes/
Restart Required: No
Instructions:
1. Backup your phpList installation and database. 2. Download phpList 3.6.1 from official sources. 3. Replace existing files with new version. 4. Run database update if required. 5. Verify functionality.
🔧 Temporary Workarounds
Disable CSV Export
allTemporarily disable CSV export functionality in admin interface
Input Sanitization
allAdd custom validation to sanitize email parameter inputs before export
🧯 If You Can't Patch
- Restrict admin access to trusted users only
- Educate users to never open CSV files directly in spreadsheet applications - use text editors or import with data-only settings
🔍 How to Verify
Check if Vulnerable:
Check phpList version in admin interface or config.php file for version 3.6.0Check Version:
grep 'VERSION' /path/to/phplist/config/config.phpVerify Fix Applied:
Verify phpList version shows 3.6.1 or higher in admin interface📡 Detection & Monitoring
Log Indicators:
- Unusual CSV export activity from admin accounts
- Multiple failed export attempts
Network Indicators:
- CSV file downloads from /lists/admin/exports endpoint
SIEM Query:
source="phpList" AND (uri="/lists/admin/exports" OR filetype="csv")