CVE-2006-3294

The CBSMS Mambo Module (1.0 and earlier) contains a PHP remote file inclusion in mod_cbsms_messages.php. The vulnerability arises when register_globals is enabled and an attacker supplies a URL in mosConfig_absolute_path, enabling arbitrary PHP code execution. Root cause: lack of input sanitizati...