CVE-2006-7092

CVE-2006-7092 describes an SQL injection in Mambo LaiThai software (versions 4.5.4 SP2 and earlier) via the usercookie[password] cookie parameter in includes/mambo.php. Remote attackers could execute arbitrary SQL commands. The CVSS metrics indicate a network-accessible high-severity issue with l...

CVE-2006-7093

The CVE-2006-7093 entry describes a cross-site scripting (XSS) vulnerability in Mambo LaiThai, affecting versions 4.5.4 Security Patch 2 and earlier. The issue is an XSS flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected PT-2007-1371 en...

PT-2007-1371 · Laithai · Mambo

Name of the Vulnerable Software and Affected Versions: Mambo LaiThai versions 4.5.4 Security Patch 2 and earlier Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations: For versions 4.5.4 Security Patch...

CVE-2006-7092

SQL injection vulnerability in includes/mambo.php in Mambo LaiThai 4.5.4 SP2 and earlier allows remote attackers to execute arbitrary SQL commands via the usercookiepassword cookie parameter...

CVE-2006-7093

Cross-site scripting XSS vulnerability in Mambo LaiThai 4.5.4 Security Patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Sql injection

SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter...

CVE-2007-0789

SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter...

CVE-2007-0789

Affected software: Mambo before 4.5.5. Vulnerable component: cancel edit functions (via id parameter). Issue: SQL injection that allows remote attackers to execute arbitrary SQL commands. Impact: potential data compromise via arbitrary queries. Remediation: upgrade to Mambo 4.5.5 or later; as a t...

CVE-2007-0789

SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter...

CVE-2007-0789: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter...

PT-2007-2234 · Mambo · Mambo

Name of the Vulnerable Software and Affected Versions: Mambo versions prior to 4.5.5 Description: The issue allows remote attackers to execute arbitrary SQL commands, possibly related to the id parameter in cancel edit functions. Recommendations: For versions prior to 4.5.5, update to version 4.5...

joomla150beta-sql.txt

Hi, These bugs were published in full-disclosure about 2 weeks ago CVE : CVE-2007-0373, CVE-2007-0374 and CVE-2007-0375, CVE-2007-0387 . In Mambo 4.6.1 and Joomla 1.0.11 and 1.5 Beta , the 'id' parameter can cause sql injection when cancelling content editting . Other versions maybe affected too...

CVE-2007-0374

SQL injection vulnerability in 1 Joomla! 1.0.11 and 1.5 Beta, and 2 Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing...

Sql injection

SQL injection vulnerability in 1 Joomla! 1.0.11 and 1.5 Beta, and 2 Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing...

CVE-2007-0374

SQL injection vulnerability CVE-2007-0374 affects Joomla! 1.0.11, Joomla! 1.5 Beta and Mambo 4.6.1, exploitable via the id parameter when cancelling content editing. The root cause is improper input handling in the affected code path, allowing remote attackers to execute arbitrary SQL commands. I...

CVE-2007-0374

SQL injection vulnerability in 1 Joomla! 1.0.11 and 1.5 Beta, and 2 Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing...

CVE-2007-0374: Undefined Security Weakness

SQL injection vulnerability in 1 Joomla! 1.0.11 and 1.5 Beta, and 2 Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing...

CVE-2006-6634

Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai comextcalendar 0.9.1 and earlier component for Mambo allow remote attackers to execute arbitrary PHP code via a URL in 1 the CONFIGEXTLANGUAGESDIR parameter to adminevents.php, 2 the mosConfigabsolutepath parameter to...

CVE-2006-6634

The CVE-2006-6634 entry describes multiple PHP remote file inclusion vulnerabilities in ExtCalThai (com_extcalendar) 0.9.1 and earlier for Mambo. The issue allows an attacker to execute arbitrary PHP code via crafted URLs in three parameters: CONFIG_EXT[LANGUAGES_DIR] to admin_events.php, mosConf...

CVE-2006-6634

Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai comextcalendar 0.9.1 and earlier component for Mambo allow remote attackers to execute arbitrary PHP code via a URL in 1 the CONFIGEXTLANGUAGESDIR parameter to adminevents.php, 2 the mosConfigabsolutepath parameter to...