PT-2006-5074 · Mambo · Mambo

Publicado 2006-08-21 · Atualizado 2025-01-17 · CVE-2006-4264

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mambo com lmtg myhomepage component (affected versions not specified)

Description The issue concerns multiple PHP remote file inclusion vulnerabilities in the com lmtg myhomepage component for Mambo. These vulnerabilities allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig absolute path parameter in files such as install.lmtg homepage.php and mtg homepage.php. However, it's noted that a third party has disputed this issue, stating that the $mosConfig absolute path variable is only used within a function definition, and CVE source code analysis tends to concur with this dispute.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-4264

Produtos afetados

Mambo

Referências · 7

• http://archives.neohapsis.com/archives/bugtraq/2006-08/0431.html · Nota
• http://securityfocus.com/bid/19584 · Nota
• http://securityfocus.com/archive/1/443624/100/0/threaded · Nota
• http://osvdb.org/28087 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4264 · Nota de Segurança
• http://osvdb.org/28088 · Nota
• https://t.me/cvenotify/107749 · Publicação no Telegram