PT-2006-5074 · Mambo · Mambo

Published 2006-08-21 · Updated 2025-01-17 · CVE-2006-4264

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mambo com lmtg myhomepage component (affected versions not specified)

Description The issue concerns multiple PHP remote file inclusion vulnerabilities in the com lmtg myhomepage component for Mambo. These vulnerabilities allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig absolute path parameter in files such as install.lmtg homepage.php and mtg homepage.php. However, it's noted that a third party has disputed this issue, stating that the $mosConfig absolute path variable is only used within a function definition, and CVE source code analysis tends to concur with this dispute.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-4264

Affected Products

Mambo

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-4264 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2006-08/0431.html · Note
• http://securityfocus.com/bid/19584 · Note
• http://securityfocus.com/archive/1/443624/100/0/threaded · Note
• http://osvdb.org/28087 · Note
• http://osvdb.org/28088 · Note
• https://t.me/cvenotify/107749 · Telegram Post