PT-2006-4825 · Mambo · Mambo Gallery Manager

Black-Code + 2 · Published 2006-08-05 · Updated 2018-10-17 · CVE-2006-3980

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mambo Gallery Manager (MGM) versions 0.95r2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig absolute path parameter in the administrator/components/com mgm/help.mgm.php file.

Recommendations For Mambo Gallery Manager (MGM) versions 0.95r2 and earlier, avoid using the mosConfig absolute path parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2006-3980

Affected Products

Mambo Gallery Manager

References · 9

• 🔥 http://securityfocus.com/bid/19224 · Exploit
• 🔥 https://exploit-db.com/exploits/2084 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3980 · Security Note
• http://secunia.com/advisories/21268 · Vendor Advisory
• http://securityfocus.com/archive/1/441533/100/0/threaded · Note
• http://securityreason.com/securityalert/1322 · Note
• http://vupen.com/english/advisories/2006/3054 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28072 · Note
• http://osvdb.org/27650 · Note