Lucene search

MitreCVE-2006-4375

HistoryAug 26, 2006 - 9:04 p.m.

CVE-2006-4375

2006-08-2621:04:00

mitre

web.nvd.nist.gov

cve-2006-4375

php

remote file inclusion

contxtd.class.php

mambo

com_contxtd

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.012

Percentile

85.0%

JSON

PHP remote file inclusion vulnerability in contxtd.class.php in the Contacts XTD (ContXTD) component for Mambo (com_contxtd) allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: another researcher has disputed this issue, saying that the software prevents the attack by checking whether _VALID_MOS is defined

Affected configurations

Nvd

Node

mambocontacts_xtd_component

VendorProductVersionCPE
mambocontacts_xtd_component*cpe:2.3:a:mambo:contacts_xtd_component:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mambo	contacts_xtd_component	*	cpe:2.3:a:mambo:contacts_xtd_component::::::::

References

securityreason.com/securityalert/1451

www.osvdb.org/28091

www.securityfocus.com/archive/1/443892/100/0/threaded

www.securityfocus.com/archive/1/444063/100/0/threaded

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.012

Percentile

85.0%

JSON

Related for CVE-2006-4375