PT-2006-4825 · Mambo · Mambo Gallery Manager

Black-Code + 2 · Publicado 2006-08-05 · Atualizado 2018-10-17 · CVE-2006-3980

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mambo Gallery Manager (MGM) versions 0.95r2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig absolute path parameter in the administrator/components/com mgm/help.mgm.php file.

Recommendations For Mambo Gallery Manager (MGM) versions 0.95r2 and earlier, avoid using the mosConfig absolute path parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2006-3980

Produtos afetados

Mambo Gallery Manager

Referências · 9

• 🔥 http://securityfocus.com/bid/19224 · Exploit
• 🔥 https://exploit-db.com/exploits/2084 · Exploit
• http://securityfocus.com/archive/1/441533/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3980 · Nota de Segurança
• http://secunia.com/advisories/21268 · Aviso do Fabricante
• http://securityreason.com/securityalert/1322 · Nota
• http://vupen.com/english/advisories/2006/3054 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28072 · Nota
• http://osvdb.org/27650 · Nota