BID:14117

Mambo Open Source Multiple Unspecified Injection Vulnerabilities

Info

Mambo Open Source Multiple Unspecified Injection Vulnerabilities

Bugtraq ID:	14117
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 30 2005 12:00AM
Updated:	Jun 30 2005 12:00AM
Credit:	The individual or individuals responsible for the discovery of this issue are currently unknown; the vendor disclosed this issue.
Vulnerable:	Mambo Mambo Open Source 4.5.2 .1 Mambo Mambo Open Source 4.5.2 Mambo Mambo Open Source 4.5.1 (1.0.9) Mambo Mambo Open Source 4.5.1 Beta 2 Mambo Mambo Open Source 4.5.1 Beta Mambo Mambo Open Source 4.5.1 Mambo Mambo Open Source 4.5 (1.0.3beta) Mambo Mambo Open Source 4.5 (1.0.3) Mambo Mambo Open Source 4.5 (1.0.2) Mambo Mambo Open Source 4.5 (1.0.1) Mambo Mambo Open Source 4.5 (1.0.0) Mambo Mambo Open Source 4.0.14

Not Vulnerable:	Mambo Mambo Open Source 4.5.2 .2

Discussion

Mambo Open Source Multiple Unspecified Injection Vulnerabilities

Mambo is prone to multiple unspecified injection vulnerabilities. These issues are most likely due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could lead to unauthorized access; other attacks may also be possible.

The vendor has addressed these issues in Mambo version 4.5.2.2 and later; earlier versions are reported vulnerable.

Exploit / POC

Mambo Open Source Multiple Unspecified Injection Vulnerabilities

No exploit is required.

Solution / Fix

Mambo Open Source Multiple Unspecified Injection Vulnerabilities

Solution:
The vendor has addressed these issues in Mambo version 4.5.2.2 and later:

Mambo Mambo Open Source 4.0.14