PT-2003-2154 · Mambo · Mambo Site Server

Published 2003-12-31 · Updated 2017-07-11 · CVE-2003-1204

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mambo Site Server versions 4.0.12 BETA and earlier

Description The issue allows remote attackers to execute scripts on other clients via multiple parameters in various PHP files, including the link parameter in "sectionswindow.php", the directory parameter in "gallery.php", "navigation.php", or "uploadimage.php", the path parameter in "view.php", the choice parameter in "upload.php", the sitename parameter in "mambosimple.php", the type parameter in "upload.php", or the id parameter in "emailarticle.php", "emailfaq.php", or "emailnews.php".

Recommendations For Mambo Site Server versions 4.0.12 BETA and earlier, update to a version later than 4.0.12 BETA to resolve the issue. As a temporary workaround, consider restricting access to the affected PHP files until a patch is available. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2003-1204

Affected Products

Mambo Site Server

References · 15

• 🔥 http://securityfocus.com/archive/1/306206 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1204 · Security Note
• http://osvdb.org/7502 · Note
• http://securityfocus.com/bid/6571 · Note
• http://osvdb.org/7501 · Note
• http://osvdb.org/7498 · Note
• http://osvdb.org/7505 · Note
• http://osvdb.org/7497 · Note
• http://osvdb.org/7503 · Note
• http://osvdb.org/7500 · Note
• http://osvdb.org/7499 · Note
• http://osvdb.org/7495 · Note
• http://osvdb.org/7504 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11050 · Note
• http://osvdb.org/7496 · Note