Skip to content

J-Security Center

Latest Attack Object Updates
  • IDP Daily Update #1247
    posted: 08/20/08
  • NSM Daily Update #1247
    posted: 08/20/08
  • Deep Inspection 5.3r5 and above, 5.4, 6.0 #1247
    posted: 08/20/08
  • Deep Inspection 5.1, 5.2, 5.3r4 and below #1227
    posted: 08/20/08
  • Deep Inspection 5.0 #1132
    posted: 04/01/08
  • Antivirus
    posted: 08/20/08

Title: Mambo Open Source Remote File Include Vulnerability

Severity: HIGH

Description:

Mambo is an Open Source Web-based content management system written in PHP.

Mambo is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

If 'register_globals' is off, a remote attacker can supply arbitrary values to multiple 'GLOBALS' parameters of the 'global.php' script. This permits attackers to specify remotely-hosted script files to be executed in the context of the Web server hosting the vulnerable software.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

Update: Reportedly, this issue is being actively exploited in the wild; multiple Web sites have been defaced, and the issue described in this BID is being cited as the attackers method of entry.

Update 12/5/2005 - Reports indicate that a bot is propagating in the wild by exploiting this vulnerability. Please see the References section for further details.

Affected Products:

  • Joomla Joomla 1.0.0
  • Joomla Joomla 1.0.1
  • Joomla Joomla 1.0.2
  • Joomla Joomla 1.0.3
  • Mambo Mambo Site Server 4.0.0
  • Mambo Mambo Site Server 4.0.10
  • Mambo Mambo Site Server 4.0.11
  • Mambo Mambo Site Server 4.0.12
  • Mambo Mambo Site Server 4.0.12 BETA
  • Mambo Mambo Site Server 4.0.12 BETA 2
  • Mambo Mambo Site Server 4.0.12 RC1
  • Mambo Mambo Site Server 4.0.12 RC2
  • Mambo Mambo Site Server 4.0.12 RC3
  • Mambo Mambo Site Server 4.0.14

References: