high7.5Public exploit code
CVE-2006-6634
Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai (com_extcalendar) 0.9.1 and earlier component for Mambo allow remote attackers to execute …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MamboLaiThai ExtCalThai 0.9.1 - 'mail.inc.php?CONFIG_EXT[LIB_DIR]' Remote File Inclusion2006-10-12 · webapps · php · Verified
- MamboLaiThai ExtCalThai 0.9.1 - 'admin_events.php?CONFIG_EXT[LANGUAGES_DIR]' Remote File Inclusion2006-10-12 · webapps · php · Verified
Impact
Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai (com_extcalendar) 0.9.1 and earlier component for Mambo allow remote attackers to execute arbitrary PHP code via a URL in (1) the CONFIG_EXT[LANGUAGES_DIR] parameter to admin_events.php, (2) the mosConfig_absolute_path parameter to extcalendar.php, or (3) the CONFIG_EXT[LIB_DIR] parameter to lib/mail.inc.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mambo | Extcalthai Module | through 0.9.1 |
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2006-10/0179.html
- http://securityreason.com/securityalert/2041
- http://www.securityfocus.com/bid/20487
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29499
- http://archives.neohapsis.com/archives/bugtraq/2006-10/0179.html
- http://securityreason.com/securityalert/2041
- http://www.securityfocus.com/bid/20487
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29499