medium6.8Public exploit code
CVE-2008-2905
PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enable…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Mambo - Cache_Lite Class MosConfig_absolute_path Remote File Inclusion (Metasploit)2010-11-24 · webapps · php · Verified
- Mambo 4.6.4 - Cache Lite Output Remote File Inclusion (Metasploit)2008-06-14 · webapps · php · Verified
- Mambo 4.6.4 - 'Output.php' Remote File Inclusion2008-06-13 · webapps · php · Verified
Impact
PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mambo | Mambo | Versions 4.0.14, 4.5, 4.5.0.2, 4.5.1.3, 4.5.1_1.0.9, 4.5.1_beta |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/30685
- http://www.securityfocus.com/bid/29716
- http://www.securitytracker.com/id?1020295
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43101
- https://www.exploit-db.com/exploits/5808
- http://secunia.com/advisories/30685
- http://www.securityfocus.com/bid/29716
- http://www.securitytracker.com/id?1020295
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43101
- https://www.exploit-db.com/exploits/5808