CVE:CVE-2009-4066
CNNVD:CNNVD-200911-257
Drupal PHPList Integration 模块5.x-1.2版本之前的5版本和6.x-1.1版本之前的6版本的"My Account" 特性中存在多个跨站请求伪造漏洞。 远程攻击者可以借助与(1) 订阅的或(2)未订阅的邮件列表相关的向量，劫持任意用户的权限。
solution:Upgrade drupal drupal to a higher version than *; Upgrade paul_beaney phplist to a higher version than 5.x-1.0,5.x-1.1,5.x-1.x:dev,6.x-1.0,6.x-1.x:dev,and avoid the version 5.x-1.0,5.x-1.1,5.x-1.x:dev,6.x-1.0,6.x-1.x:dev