CVE-2003-1204

CVE-2003-1204 involves multiple cross-site scripting (XSS) flaws in Mambo Site Server 4.0.12 BETA and earlier. The authenticated-remote issue allows attackers to inject script via various parameters across several PHP scripts (sectionswindow.php, gallery.php, navigation.php, uploadimage.php, view...

CVE-2004-1826

CVE-2004-1826 affects Mambo Open Source 4.5 stable 1.0.3 and earlier, where index.php is vulnerable to SQL injection via the id parameter. The vulnerability arises from improper input handling in the application, enabling remote attackers to craft SQL payloads and potentially influence database q...

CVE-2004-1825

CVE-2004-1825 is a cross-site scripting (XSS) vulnerability in Mambo Open Source’s index.php, specifically in the mos_change_template and return parameters. Multiple connected sources (OpenVAS NASL 16316/136141256231016316, NVD, and CVE records) confirm that vulnerable versions include Mambo Open...

CVE-2004-1825

Cross-site scripting XSS vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 return or 2 moschangetemplate parameters...

CVE-2004-1826

SQL injection vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

Mambo Detection

The remote host is running Mambo, a content management system written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17672; scriptversion"1.24"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"; scriptnameenglish:"Mambo Detection";...

CVE-2005-0512

The CVE-2005-0512 entry describes a remote file inclusion in Mambo Open Source 4.5.2, via Tar.php, where the mosConfig_absolute_path parameter can be altered to reference a URL on a remote server containing PHP code. This allows an attacker to execute arbitrary PHP code on the affected web server...

CVE-2005-0512

PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfigabsolutepath parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2004-1693...

[SA14337] Mambo "GLOBALS['mosConfig_absolute_path']" File Inclusion

TITLE: Mambo "GLOBALS'mosConfigabsolutepath'" File Inclusion SECUNIA ADVISORY ID: SA14337 VERIFY ADVISORY: http://secunia.com/advisories/14337/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: Mambo 4.x http://secunia.com/product/872/ DESCRIPTION: A vulnerability has...

Mambo Content Server Detection Global Variables Overwrite

Binary data 2638.prm...

Mambo Open Source Tar.php Remote File Inclusion

The version of Mambo Open Source on the remote host fails to properly sanitize input passed through the 'mosConfigabsolutepath' parameter of the 'Tar.php' script. Provided PHP's 'registerglobals' setting is enabled, a remote attacker may exploit this vulnerability to cause code to be executed in...

CVE-2005-0512

PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfigabsolutepath parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2004-1693...

CVE-2004-1693

PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 1.0.9 allows remote attackers to execute arbitrary PHP code by modifying the mosConfigabsolutepath parameter to reference a URL on a remote web server that contains the code...

CVE-2004-1692

Cross-site scripting XSS vulnerability in index.php in Mambo 4.5 1.0.9 allows remote attackers to inject arbitrary web script or HTML via the 1 Itemid, 2 mosmsg, or 3 limit parameters...

CVE-2004-1693

CVE-2004-1693 affects Mambo 4.5 (1.0.9) via Function.php. The vulnerability arises from a PHP remote file inclusion: by setting mosConfig_absolute_path to reference a URL on a remote server that contains code, an attacker can execute arbitrary PHP on the affected system. This is a remote code exe...

CVE-2004-1692

CVE-2004-1692 describes a cross‑site scripting (XSS) vulnerability in the Mambo 4.5 (1.0.9) index.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML by manipulating the (1) Itemid, (2) mosmsg, or (3) limit parameters. The issue is documented with a CVSS v2 base ...

Mambo Site Server Multiple Vulnerabilities

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on this host or execute arbitrary code through the gallery image uploader under the administrator directory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc...

Mambo Site Server mos_change_template XSS

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on this host because of its failure to sanitize input to the 'return' and 'moschangetemplate' parameters of the 'index.php' script. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[SA14124] Mambo Global Variables Security Bypass Vulnerability

TITLE: Mambo Global Variables Security Bypass Vulnerability SECUNIA ADVISORY ID: SA14124 VERIFY ADVISORY: http://secunia.com/advisories/14124/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: Mambo 4.x http://secunia.com/product/872/ DESCRIPTION: A vulnerability...

Mambo Global Variables Unauthorized Access

The remote version of Mambo Open Source contains a vulnerability that could allow a remote attacker to gain unauthorized access to the system. This arises due to improper implementation of global variables and not sanitizing user-supplied input. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...