PT-2005-4492 · Mambo · Mambo Site Server

Publicado 2005-11-22 · Atualizado 2018-10-19 · CVE-2005-3738

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mambo Site Server versions 4.0.14 and earlier

Description The issue allows remote attackers to overwrite variables in the GLOBALS array, which can lead to various attacks. This is demonstrated by using the mosConfig absolute path parameter to content.html.php for remote PHP file inclusion.

Recommendations For Mambo Site Server versions 4.0.14 and earlier, consider disabling the register globals setting to prevent variable overwriting in the GLOBALS array. As a temporary workaround, restrict access to the content.html.php file and avoid using the mosConfig absolute path parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2005-3738

Produtos afetados

Mambo Site Server

Referências · 11

• 🔥 https://exploit-db.com/exploits/1337 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0520.html · Exploit
• 🔥 http://securityfocus.com/archive/1/417215 · Exploit
• http://forum.mamboserver.com/showthread.php?t=66154 · Nota
• http://securityfocus.com/bid/15461 · Nota
• http://securitytracker.com/id?1015258 · Nota
• http://vupen.com/english/advisories/2005/2473 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3738 · Nota de Segurança
• http://secunia.com/advisories/17622 · Nota
• http://securityfocus.com/archive/1/426942/100/0/threaded · Nota
• http://securityfocus.com/archive/1/427196/100/0/threaded · Nota