Description
globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfig_absolute_path parameter to content.html.php for remote PHP file inclusion.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Mambo 4.5.2 - Globals Overwrite / Remote Command Execution EDB-1337 · webapps · Nov 22, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20060307 PHP-based CMS mass-exploitation mailing-list
- 15461 vdb-entry
- 17622 third-party-advisory
- http://forum.mamboserver.com/showthread.php?t=66154
- 1015258 vdb-entry
- 20051116 mambo remote code sexecution mailing-list
- 20060308 RE: [Full-disclosure] PHP-based CMS mass-exploitation mailing-list
- 20051118 Mambo 0day Exploit out in the wild - mambo/skype hacked mailing-list
- ADV-2005-2473 vdb-entry