Lyris ListManager 8.5, and possibly other versions before 8.8, includes sensitive information in the env hidden variable, which allows remote attackers to obtain information such as the installation path by requesting a non-existent page and reading the env variable from the resulting error message page.

The remote host appears to be running ListManager, a web-based commercial mailing list management application from Lyris. 

In response to a request for a nonexistent page, the version of ListManager on the remote host returns sensitive information such as the installation path and software version as well as possibly SQL queries, code blocks, or the entire CGI environment.

The remote host appears to be running ListManager, a web-based commercial mailing list management application from Lyris. 

The version of ListManager installed on the remote host is affected by a number of input validation flaws.  An unauthenticated attacker may be able to exploit these issues to launch SQL injection attacks against the backend database, view the source of any 'tml' script available to the application, bypass authentication, or obtain information about the server configuration.

The remote host is running Lyris List Manager, a mailing list manager.  This version of Lyris is vulnerable to multiple flaws.  There is a flaw in the way that Lyris handles SQL queries that an attacker could use to execute arbitrary commands on the backend database.  There is a flaw that would allow an attacker to execute arbitrary commands with the permissions of the web server.  Finally, there are several flaws that would allow an attacker to access information that was not intended for public consumption.  An attacker exploiting these flaws would likely be able to access confidential data and tarnish the integrity of both the web server and the database.

ID	Name	Product	Family	Severity
20295	ListManager Error Message Information Disclosure	Nessus	CGI abuses	medium
20294	ListManager < 8.9b Multiple Vulnerabilities	Nessus	CGI abuses	high
3324	Lyris List Manager <= 8.8a Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-4148

medium

Tenable Plugins

medium

high

high