PT-2006-5073 · Mambo+1 · Mambo+1

Published 2006-08-21 · Updated 2018-10-17 · CVE-2006-4263

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mambo and Joomla! com phpshop (affected versions not specified)

Description The issue concerns remote file inclusion vulnerabilities in various modules of mambo-phpshop for Mambo and Joomla!. Remote attackers can execute arbitrary PHP code via a URL in the mosConfig absolute path parameter in multiple modules, including mod phpshop.php, mod phpshop allinone.php, mod phpshop cart.php, mod phpshop featureprod.php, mod phpshop latestprod.php, mod product categories.php, mod productscroller.php, and mosproductsnap.php.

Recommendations As a temporary workaround, consider disabling the affected modules until a patch is available. Restrict access to the mosConfig absolute path parameter in the affected modules to minimize the risk of exploitation. Avoid using the mosConfig absolute path parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-4263

Affected Products

Joomla!

Mambo

References · 11

• 🔥 http://securityfocus.com/bid/19591 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4263 · Security Note
• http://osvdb.org/28154 · Note
• http://osvdb.org/28151 · Note
• http://osvdb.org/28155 · Note
• http://osvdb.org/28158 · Note
• http://osvdb.org/28156 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28441 · Note
• http://osvdb.org/28152 · Note
• http://securityfocus.com/archive/1/443623/100/0/threaded · Note
• http://osvdb.org/28153 · Note