CVE-2011-2917: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter...

PT-2011-4185

Name of the Vulnerable Software and Affected Versions Mambo CMS versions 4.6.5 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the zorder parameter in the administrator/index2.php file. Recommendations For Mambo CMS versions 4.6.5...

CVE-2008-7214: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...