PT-2007-1427 · Mambo · Mambo

Trueend5 · Published 2007-03-07 · Updated 2018-10-16 · CVE-2006-7149

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mambo versions 4.6.x

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the query string to "index.php", which reflects the string in an error message from "mod login.php". Additionally, the mcname parameter to "moscomment.php" and "com comment.php" is vulnerable.

Recommendations For Mambo version 4.6.x, consider disabling the mod login.php module and restricting access to "moscomment.php" and "com comment.php" until a patch is available. Avoid using the mcname parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-7149

Affected Products

Mambo

References · 6

• 🔥 http://kapda.ir/advisory-444.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-7149 · Security Note
• http://securityfocus.com/bid/20650 · Vendor Advisory
• http://securityreason.com/securityalert/2379 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29708 · Note
• http://securityfocus.com/archive/1/449305/100/0/threaded · Note