Mambo OS v4.5/v4.6: remote command execution

Product: Mambo Open Source v4.5 Mambo Open Source v4.6 CVS Vendor: Miro International Pty Ltd. Author: FraMe frame at kernelpanik.org URL: http://www.kernelpanik.org CONTENTS 1. Overview 2. Description. 3. Details 4. Patches. 1. Overview. Mambo Open Source is an, open source, modular, web content...

Mambo Open Source 4.54.6 - mod_mainmenu.php Remote File Inclusion

Mambo Open Source 4.54.6 - modmainmenu.php Remote File Inclusion source: https://www.securityfocus.com/bid/9445/info It has been reported that Mambo Open Source may be prone to a remote file include vulnerability that may allow an attacker to include malicious external files containing arbitrary...

Mambo mod_mainmenu.php mosConfig_absolute_path Parameter Remote File Inclusion

There is a flaw in the installed version of Mambo Open Source that may allow an attacker to execute arbitrary remote PHP code on this host because it fails to sanitize input to the 'mosConfigabsolutepath' of 'modules/modmainmenu.php' before using it to include PHP code from another file. Note tha...

Mambo Open Source 4.5/4.6 - 'mod_mainmenu.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/9445/info It has been reported that Mambo Open Source may be prone to a remote file include vulnerability that may allow an attacker to include malicious external files containing arbitrary PHP code to be executed on a vulnerable system. The issue exists...

Mambo Open Source 4.0.14 SQL injection

Product ------- Mambo Open Source 4.0.14 Vendor ------ http://www.mamboserver.com Details ------- Mambo Open Source is the open source Web Content Management System. Mambo Open Source CMS is used by many websites including the commercial ones. The function show in mambo/articles.php file is like...

Mambo Open Source 4.0.14 Server - SQL Injection

Mambo Open Source 4.0.14 Server - SQL Injection source: https://www.securityfocus.com/bid/9196/info It has bee reported that Mambo Open Source 4.0.14 Server is prone to SQL injection attacks. The problem is said to occur due to insufficient sanitization of data passed to specific index.php...

Mambo Open Source 4.0.14 - PollBooth.php Multiple SQL Injections

Mambo Open Source 4.0.14 - PollBooth.php Multiple SQL Injections source: https://www.securityfocus.com/bid/9197/info Mambo Open Source is prone to SQL injection attacks. This is due to an input validation error in 'pollBooth.php'. In particular, various user-supplied variables are used in an SQL...

Mambo Open Source 4.0.14 - 'PollBooth.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/9197/info Mambo Open Source is prone to SQL injection attacks. This is due to an input validation error in 'pollBooth.php'. In particular, various user-supplied variables are used in an SQL query without proper sanitization of SQL syntax. As a result, a...

Mambo Open Source 4.0.14 Server - SQL Injection

source: https://www.securityfocus.com/bid/9196/info It has bee reported that Mambo Open Source 4.0.14 Server is prone to SQL injection attacks. The problem is said to occur due to insufficient sanitization of data passed to specific index.php variables. As a result, an attacker may be capable of...

Mambo Site Server 4.0.14 - emailarticle.php?id SQL Injection

Mambo Site Server 4.0.14 - emailarticle.php?id SQL Injection source: https://www.securityfocus.com/bid/8647/info It has been reported that Mambo Open Source Server is prone to multiple input validation vulnerabilities that may allow remote attackers to inject malicious SQL syntax into database...

Mambo Site Server 4.0.14 - 'banners.php?bid' SQL Injection

source: https://www.securityfocus.com/bid/8647/info It has been reported that Mambo Open Source Server is prone to multiple input validation vulnerabilities that may allow remote attackers to inject malicious SQL syntax into database queries and send anonymous e-mail to arbitrary users. The...