CVE-2009-3333

CVE-2009-3333 affects the koeSubmit (com_koesubmit) component version 1.0 used by Mambo, specifically koesubmit.php. The vulnerability is a PHP remote file inclusion that allows an attacker to cause the web server to execute arbitrary PHP code by supplying a crafted URL in the mosConfig_absolute_...

Mambo / Joomla Tupinambis SQL Injection

Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009 -------------------------------------------------- .---..-..-..-.,-..-..-..-. .---..---..---..----. | |'| || || . | || || | | |- \ \ | |'| || | -' ----'-'-'----'----'---'---' -' ----'...

Joomla / Mambo Tupinambis SQL Injection

Exploit for unknown platform in category web applications ===================================== Joomla/Mambo Tupinambis SQL Injection ===================================== Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009...

Joomla/Mambo Tupinambis SQL Injection

No description provided by source. Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009 -------------------------------------------------- .---..-..-..-.,-..-..-..-. .---..---..---..----. | |'| || || . | || || | | |- \ \ | |'| || | -'...

Joomla! Mambo Component Tupinambis - SQL Injection

Joomla! Mambo Component Tupinambis - SQL Injection Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009 -------------------------------------------------- .---..-..-..-.,-..-..-..-. .---..---..---..----. | |'| || || . | || || | | |- \ \ | |'| || | -'...

Joomla! / Mambo Component Tupinambis - SQL Injection

Mambo/Joomla SQL Injection Vulneralbility Component : comtupinambis Release : September 23, 2009 -------------------------------------------------- .---..-..-..-.,-..-..-..-. .---..---..---..----. | |'| || || . | || || | | |- \ \ | |'| || | -' ----'-'-'----'----'---'---' -' ----'...

Mambo 4.6.3 Arbitrary File Upload

Step 1 Using post method send file to: http://victim.com/mambo4.6.5/mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php?Command=FileUpload file should have one of the following extensions: zip, doc, xls, pdf, rtf, csv, jpg, gif, jpeg, png, avi, mpg, mpeg, swf, fla...

Mambo 4.6.3 arbitrary file upload

Step 1 Using post method send file to: http://victim.com/mambo4.6.5/mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php?Command=FileUpload file should have one of the following extensions: zip, doc, xls, pdf, rtf, csv, jpg, gif, jpeg, png, avi, mpg, mpeg, swf, fla...

Mambo Koesubmit 1.0.0 Remote File Inclusion

Mambo comkoesubmit 1.0.0 Remote File Inclusion Author : Don Tukulesto rootatindonesiancoderdotcom Homepage : http://www.indonesiancoder.com Date : Friday, Semptember 18, 2009 ------------------------------------------------------------------------------------------------------- | |.-----..--|...

Mambo Component com_koesubmit 1.0.0 RFI Vulnerability

No description provided by source. Mambo comkoesubmit 1.0.0 Remote File Inclusion Author : Don Tukulesto rootatindonesiancoderdotcom Homepage : http://www.indonesiancoder.com Date : Friday, Semptember 18, 2009...

Mambo Component com_koesubmit 1.0.0 RFI Vulnerability

Exploit for unknown platform in category web applications ===================================================== Mambo Component comkoesubmit 1.0.0 RFI Vulnerability ===================================================== Mambo comkoesubmit 1.0.0 Remote File Inclusion Homepage :...

Command injection

The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...

CVE-2008-7215

The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...

CVE-2008-7213

Cross-site scripting XSS vulnerability in mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter...

Design/Logic Flaw

MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message...

CVE-2008-7214

Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...

CVE-2008-7212

The CVE-2008-7212 vulnerability affects MOStlyCE before 2.4 used with Mambo 4.6.3 and earlier. It allows remote attackers to trigger error messages via requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, revealing the installation path. No exploitation...

CVE-2008-7213

CVE-2008-7213 describes an XSS vulnerability in MOStlyCE (used with Mambo 4.6.3 and earlier) via the Command parameter in the PHP connector for TinyMCE filemanager (path: mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php). The issue arises in MOStlyCE before vers...

CVE-2008-7215

The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...