Upgrade to sympa version 5.4.2. Changes since version 5.2.4:

Fix CVE-2008-1648 (denial of service)
Several new translations (some of them disabled, because of missing locale
  support on NetBSD-3).
Introduction of HTTP session in order to replace a lot of cookies, for better
  usability and security. This also allows some new features, from
  listing active session in admin page to crawler detection.
per list custom user attributes (defined by the list owner)
per list custom list parameters for use in authorization scenarios and
  mail templates
LDAP alias manager can now be LDAPS
XSS protection
Session hijacking protection
The performances  mainly regarding the web interface  have been
  significantly improved.

new SOAP features allow remote list creation, ADD and DEL of list members
Automatic list creation when a message is sent for the list.
each operations that changes the status of messages/subscriptions/list config
  is now logged in a structured DB entry.
Generalization of UTF-8

and more ...  See http://www.sympa.org/ for complete list.

(bouyer)