PT-2007-1427 · Mambo · Mambo

Trueend5 · Publicado 2007-03-07 · Atualizado 2018-10-16 · CVE-2006-7149

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mambo versions 4.6.x

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the query string to "index.php", which reflects the string in an error message from "mod login.php". Additionally, the mcname parameter to "moscomment.php" and "com comment.php" is vulnerable.

Recommendations For Mambo version 4.6.x, consider disabling the mod login.php module and restricting access to "moscomment.php" and "com comment.php" until a patch is available. Avoid using the mcname parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-7149

Produtos afetados

Mambo

Referências · 6

• 🔥 http://kapda.ir/advisory-444.html · Exploit
• http://securityreason.com/securityalert/2379 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7149 · Nota de Segurança
• http://securityfocus.com/bid/20650 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29708 · Nota
• http://securityfocus.com/archive/1/449305/100/0/threaded · Nota