CVE-2020-8547

published 2020-02-03

CVE-2020-8547: phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e…

Priority P2 64 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
phplist	phplist	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /admin↗

hash 0e66298694359207596086558843543959518835691168370379069085300385↗

• → Audit phpListAdminAuthentication.php for use of loose comparison operator '==' when comparing $encryptedPass to $passwordDB; presence of '==' in that context confirms the vulnerable code path. ↗
• → Flag any stored password hash in the phpList database that begins with '0e' followed exclusively by numerical characters, as these hashes are exploitable via PHP type-juggling authentication bypass. ↗

• · The bypass only works when the victim admin account's stored SHA-256 password hash begins with '0e' followed exclusively by digits (a 'magic hash'). Accounts whose hashes do not match this pattern are not directly exploitable via this technique. ↗
• · The exploit requires the attacker to know (or guess) a plaintext password whose SHA-256 hash is a 'magic hash' (0e + all digits), such as 'TyNOQHUS', to first set up the vulnerable hash state, or to target an account already using such a password. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-843