Security Bulletins

Interspire Email Marketer version 6.0.0 up to and including 6.5.1 allows SQL injection in the Surveys module. If the survey id exists, an unauthenticated attacker could exploit this to extract potentially sensitive information from the database. We recommend that all users of Email Marketer immediately take one of the following corrective actions. If you are … Read more

Interspire Email Marketer version 6.0.0 to 6.5.0 that have the Surveys addon enabled allows arbitrary file upload via surveys_submit.php “create survey and submit survey” operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. We recommend that all users of Email Marketer immediately take one of the following corrective actions. If … Read more