CVE-2009-3333

PHP remote file inclusion vulnerability in koesubmit.php in the koeSubmit comkoesubmit component 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter...

Joomla / Mambo Tupinambis SQL Injection

Exploit for unknown platform in category web applications ===================================== Joomla/Mambo Tupinambis SQL Injection ===================================== Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009...

Joomla! / Mambo Component Tupinambis - SQL Injection

Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009 -------------------------------------------------- .---..-..-..-.,-..-..-..-. .---..---..---..----. | |'| || || . | || || | | |- \ \ | |'| || | -' ----'-'-'----'----'---'---' -' ----'...

Joomla! Mambo Component Tupinambis - SQL Injection

Joomla! Mambo Component Tupinambis - SQL Injection Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009 -------------------------------------------------- .---..-..-..-.,-..-..-..-. .---..---..---..----. | |'| || || . | || || | | |- \ \ | |'| || | -'...

Mambo / Joomla Tupinambis SQL Injection

Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009 -------------------------------------------------- .---..-..-..-.,-..-..-..-. .---..---..---..----. | |'| || || . | || || | | |- \ \ | |'| || | -' ----'-'-'----'----'---'---' -' ----'...

Joomla/Mambo Tupinambis SQL Injection

No description provided by source. Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009 -------------------------------------------------- .---..-..-..-.,-..-..-..-. .---..---..---..----. | |'| || || . | || || | | |- \ \ | |'| || | -'...

Mambo 4.6.3 Arbitrary File Upload

Step 1 Using post method send file to: http://victim.com/mambo4.6.5/mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php?Command=FileUpload file should have one of the following extensions: zip, doc, xls, pdf, rtf, csv, jpg, gif, jpeg, png, avi, mpg, mpeg, swf, fla...

Mambo 4.6.3 arbitrary file upload

Step 1 Using post method send file to: http://victim.com/mambo4.6.5/mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php?Command=FileUpload file should have one of the following extensions: zip, doc, xls, pdf, rtf, csv, jpg, gif, jpeg, png, avi, mpg, mpeg, swf, fla...

Mambo Koesubmit 1.0.0 Remote File Inclusion

Mambo comkoesubmit 1.0.0 Remote File Inclusion Author : Don Tukulesto rootatindonesiancoderdotcom Homepage : http://www.indonesiancoder.com Date : Friday, Semptember 18, 2009 ------------------------------------------------------------------------------------------------------- | |.-----..--|...

Mambo Component com_koesubmit 1.0.0 RFI Vulnerability

No description provided by source. Mambo comkoesubmit 1.0.0 Remote File Inclusion Author : Don Tukulesto rootatindonesiancoderdotcom Homepage : http://www.indonesiancoder.com Date : Friday, Semptember 18, 2009...

Mambo Component com_koesubmit 1.0.0 RFI Vulnerability

Exploit for unknown platform in category web applications ===================================================== Mambo Component comkoesubmit 1.0.0 RFI Vulnerability ===================================================== Mambo comkoesubmit 1.0.0 Remote File Inclusion Homepage :...

Design/Logic Flaw

MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message...

CVE-2008-7214

Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...

CVE-2008-7215

The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...

Command injection

The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...

CVE-2008-7213

Cross-site scripting XSS vulnerability in mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter...

CVE-2008-7215

The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...

CVE-2008-7214

Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...

CVE-2008-7214

The CVE-2008-7214 entry describes a CSRF flaw in MOStlyCE before 2.4 (used in Mambo 4.6.3 and earlier) affecting administrator/index2.php. The vulnerability lets remote attackers hijack an administrator’s session to add new administrator accounts via the save task in a com_users action, with the ...