CVE-2008-2905 PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote attackers to execute arb...
MediumCVSS 6.8
EPSS 18.4%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mambo | = 4.0.14 | No fix listed |
| mambo | = 4.5 | No fix listed |
| mambo | = 4.5.0.2 | No fix listed |
| mambo | = 4.5.1.3 | No fix listed |
| mambo | = 4.5.1_1.0.9 | No fix listed |
| mambo | = 4.5.1_beta | No fix listed |
| mambo | = 4.5.1_beta2 | No fix listed |
| mambo | = 4.5.1a | No fix listed |
| mambo | = 4.5.2 | No fix listed |
| mambo | = 4.5.2.1 | No fix listed |
| mambo | = 4.5.2.2 | No fix listed |
| mambo | = 4.5.2.3 | No fix listed |
| mambo | = 4.5.3h | No fix listed |
| mambo | = 4.5.4 | No fix listed |
| mambo | = 4.5_1.0.0 | No fix listed |
| mambo | = 4.5_1.0.1 | No fix listed |
| mambo | = 4.5_1.0.2 | No fix listed |
| mambo | = 4.5_1.0.3_beta | No fix listed |
| mambo | = 4.5_1.0.9 | No fix listed |
| mambo | = 4.6 | No fix listed |
| mambo | = 4.6.1 | No fix listed |
| mambo | = 4.6.2 | No fix listed |
| mambo | = 4.6.4 | No fix listed |
References
- 30685 third-party-advisory vendor-advisory
- 29716 exploit vdb-entry
- 1020295 vdb-entry
- mambo-output-file-include(43101) vdb-entry
- 5808 exploit