Mambo Open Source Tar.php Remote File Inclusion

The version of Mambo Open Source on the remote host fails to properly sanitize input passed through the 'mosConfigabsolutepath' parameter of the 'Tar.php' script. Provided PHP's 'registerglobals' setting is enabled, a remote attacker may exploit this vulnerability to cause code to be executed in...

CVE-2005-0512

PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfigabsolutepath parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2004-1693...

CVE-2004-1692

CVE-2004-1692 describes a cross‑site scripting (XSS) vulnerability in the Mambo 4.5 (1.0.9) index.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML by manipulating the (1) Itemid, (2) mosmsg, or (3) limit parameters. The issue is documented with a CVSS v2 base ...

CVE-2004-1693

PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 1.0.9 allows remote attackers to execute arbitrary PHP code by modifying the mosConfigabsolutepath parameter to reference a URL on a remote web server that contains the code...

CVE-2004-1693

CVE-2004-1693 affects Mambo 4.5 (1.0.9) via Function.php. The vulnerability arises from a PHP remote file inclusion: by setting mosConfig_absolute_path to reference a URL on a remote server that contains code, an attacker can execute arbitrary PHP on the affected system. This is a remote code exe...

CVE-2004-1692

Cross-site scripting XSS vulnerability in index.php in Mambo 4.5 1.0.9 allows remote attackers to inject arbitrary web script or HTML via the 1 Itemid, 2 mosmsg, or 3 limit parameters...

CVE-2004-1692: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in Mambo 4.5 1.0.9 allows remote attackers to inject arbitrary web script or HTML via the 1 Itemid, 2 mosmsg, or 3 limit parameters...

CVE-2004-1693: Undefined Security Weakness

PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 1.0.9 allows remote attackers to execute arbitrary PHP code by modifying the mosConfigabsolutepath parameter to reference a URL on a remote web server that contains the code...

Mambo Site Server mos_change_template XSS

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on this host because of its failure to sanitize input to the 'return' and 'moschangetemplate' parameters of the 'index.php' script. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Mambo Site Server Multiple Vulnerabilities

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on this host or execute arbitrary code through the gallery image uploader under the administrator directory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc...

[SA14124] Mambo Global Variables Security Bypass Vulnerability

TITLE: Mambo Global Variables Security Bypass Vulnerability SECUNIA ADVISORY ID: SA14124 VERIFY ADVISORY: http://secunia.com/advisories/14124/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: Mambo 4.x http://secunia.com/product/872/ DESCRIPTION: A vulnerability...

Mambo Global Variables Unauthorized Access

The remote version of Mambo Open Source contains a vulnerability that could allow a remote attacker to gain unauthorized access to the system. This arises due to improper implementation of global variables and not sanitizing user-supplied input. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Mambo Content Server < 4.5.1b Detection Global Variables Overwrite

Binary data 2589.prm...

CVE-2004-2143

SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 1.09 and earlier allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in the comremository option...

CVE-2004-2072

Cross-site scripting XSS vulnerability in index.php for Mambo Open Source 4.6, and possibly earlier versions, allows remote attackers to execute script on other clients via the Itemid parameter...

Vulnerabilities in Mambo

--------------------------------------------------------------------------- Two Vulnerabilities in Mambo --------------------------------------------------------------------------- Author: Jose Antonio Coret Joxean Koret Date: 2004 Location: Basque Country...

mambo45.jose.txt

--------------------------------------------------------------------------- Two Vulnerabilities in Mambo --------------------------------------------------------------------------- Author: Jose Antonio Coret Joxean Koret Date: 2004 Location: Basque Country...

mambo451.txt

Vendor www.mamboportal.com Message from vendor : Mambo is one of the most powerful Open Source Content Management Systems on the planet. It is used all over the world for everything from simple websites to complex corporate applications. Mambo is easy to install, simple to manage, and reliable. B...

Mambo Open Source Multiple Input Validation Vulnerabilities

Description Mambo open source is reportedly affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly validate user-supplied URI parameters. An attacker may leverage these issues to execute arbitrary server-side script code on an...

Mambo Open Source 4.5.1 (1.0.9) - Cross-Site Scripting

Mambo Open Source 4.5.1 1.0.9 - Cross-Site Scripting source: https://www.securityfocus.com/bid/11220/info Mambo open source is reportedly affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly validate user-supplied URI parameters. ...