Description

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GET request (?page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with enforce=false, so it only validates the token when a 'tk' parameter is present. A remote attacker can trick an authenticated administrator into loading a crafted URL (e.g., embedded in an image tag) to delete arbitrary bounce rules from the phplist_bounceregex table without a valid CSRF token.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-13T19:17:34.267Z",
  "pubdate": "2026-08-13T19:17:34.267Z",
  "executiveSummary": "This vulnerability is classified as a Cross-Site Request Forgery (CSRF) security flaw affecting phpList versions prior to 3.7.0-RC5. The vulnerability resides within the bounce rule deletion endpoint handled by bouncerules.php and bouncerule.php. The primary business impact includes unauthorized modification and deletion of bounce rules stored within the phplist_bounceregex database table.\nThe affected systems comprise instances of phpList deployed before the patched release. The risk implications involve the potential disruption of email bounce handling configurations through automated actions performed on behalf of an authenticated user.\nAttacker capabilities are limited to inducing side effects via forged requests, requiring the attacker to trick an authenticated administrator into interacting with a crafted URL. Exploitation requirements necessitate that the victim holds administrative privileges and maintains an active session while accessing attacker-controlled content, such as a malicious image tag embedded in an external webpage.",
  "technicalDetails": "The root cause of the vulnerability stems from improper enforcement of Cross-Site Request Forgery protections on state-changing operations within the affected endpoint. Specifically, the bounce rule deletion functionality is exposed via an HTTP GET request utilizing the parameter pattern ?page=bouncerules&del=N.\nDuring request processing, the central CSRF token validation mechanism, designated as verifyCsrfGetToken, is invoked with the enforcement parameter explicitly set to false. Consequently, the application only evaluates token validity when the 'tk' parameter is explicitly supplied in the request. If the parameter is omitted, the validation check is bypassed entirely.\nThe vulnerable component consists of the administrative routing and request handling logic located in bouncerules.php and bouncerule.php, affecting all phpList versions prior to 3.7.0-RC5.\nThe attack flow proceeds as follows: An attacker crafts a malicious URL pointing to the vulnerable endpoint with the deletion parameter set to a specific rule identifier (e.g., ?page=bouncerules&del=N). This URL is subsequently embedded into an external resource, such as an HTML image tag or an iframe, hosted on a remote server controlled by the attacker.\nWhen an authenticated phpList administrator visits the malicious page or loads the crafted content while maintaining an active session, the browser automatically dispatches an HTTP GET request to the vulnerable phpList installation. Due to the lack of strict CSRF enforcement for requests lacking the 'tk' parameter, the application processes the request and executes the deletion query against the phplist_bounceregex table.\nAuthentication and privilege requirements dictate that the target must be authenticated as an administrator with permissions to manage bounce rules. The network exposure is remote, as the attack relies on web-based vectors to induce the victim's browser into issuing unauthorized cross-site requests. Post-exploitation impact is limited to the deletion of arbitrary bounce rules, which may degrade the application's ability to process bounce messages correctly."
}