Unscored severity · published Aug 22, 2006
CVE-2006-4286
PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to execute arbitrary PHP…
–
CVSS
1.5%
EPSS
No
On KEV
Description
PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: this issue has been disputed by third parties who state that contentpublisher.php protects against direct request in the most recent version. The original researcher is known to be frequently inaccurate
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mambo · Mambo
4.0.14; 4.5.0.2; 4.5.1.3; 4.5.1_1.0.9; 4.5.1a; 4.5.1a; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4286
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4286
securityreason.com
http://securityreason.com/securityalert/1431
www.osvdb.org
http://www.osvdb.org/28093
www.securityfocus.com
http://www.securityfocus.com/archive/1/443626/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/444244/100/0/threaded
More from Mambo
–
CVE-2008-5226
SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote attackers to execute arbitrary SQL commands via the ma_cat…
–
CVE-2008-3712
Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via…
–
CVE-2008-2905
PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote…
–
CVE-2008-0829
SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands…
–
CVE-2008-0795
SQL injection vulnerability in index.php in the MGFi XfaQ (com_xfaq) 1.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the aid…