ID |
CVE-2005-3738
|
Summary |
globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfig_absolute_path parameter to content.html.php for remote PHP file inclusion. |
References |
|
Vulnerable Configurations |
-
cpe:2.3:a:mambo:mambo_site_server:4.0:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0:*:*:*:*:*:*:*
-
cpe:2.3:a:mambo:mambo_site_server:4.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0.10:*:*:*:*:*:*:*
-
cpe:2.3:a:mambo:mambo_site_server:4.0.11:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0.11:*:*:*:*:*:*:*
-
cpe:2.3:a:mambo:mambo_site_server:4.0.12:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0.12:*:*:*:*:*:*:*
-
cpe:2.3:a:mambo:mambo_site_server:4.0.12_beta:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0.12_beta:*:*:*:*:*:*:*
-
cpe:2.3:a:mambo:mambo_site_server:4.0.12_beta_2:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0.12_beta_2:*:*:*:*:*:*:*
-
cpe:2.3:a:mambo:mambo_site_server:4.0.12_rc1:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0.12_rc1:*:*:*:*:*:*:*
-
cpe:2.3:a:mambo:mambo_site_server:4.0.12_rc2:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0.12_rc2:*:*:*:*:*:*:*
-
cpe:2.3:a:mambo:mambo_site_server:4.0.12_rc3:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0.12_rc3:*:*:*:*:*:*:*
-
cpe:2.3:a:mambo:mambo_site_server:4.0.14:*:*:*:*:*:*:*
cpe:2.3:a:mambo:mambo_site_server:4.0.14:*:*:*:*:*:*:*
|
CVSS |
Base: | 2.6 (as of 19-10-2018 - 15:38) |
Impact: | |
Exploitability: | |
|
CWE |
NVD-CWE-Other |
CAPEC |
|
Access |
Vector | Complexity | Authentication |
NETWORK |
HIGH |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
NONE |
PARTIAL |
NONE |
|
cvss-vector
via4
|
AV:N/AC:H/Au:N/C:N/I:P/A:N
|
refmap
via4
|
bid | 15461 | bugtraq | - 20051118 Mambo 0day Exploit out in the wild - mambo/skype hacked
- 20060307 PHP-based CMS mass-exploitation
- 20060308 RE: [Full-disclosure] PHP-based CMS mass-exploitation
| confirm | http://forum.mamboserver.com/showthread.php?t=66154 | fulldisc | 20051116 mambo remote code sexecution | sectrack | 1015258 | secunia | 17622 | vupen | ADV-2005-2473 |
|
Last major update |
19-10-2018 - 15:38 |
Published |
22-11-2005 - 11:03 |
Last modified |
19-10-2018 - 15:38 |