BID:14119

Mambo Open Source Session ID Spoofing Vulnerability

Info

Mambo Open Source Session ID Spoofing Vulnerability

Bugtraq ID:	14119
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 30 2005 12:00AM
Updated:	Jun 30 2005 12:00AM
Credit:	The individual or individuals responsible for the discovery of this issue are currently unknown; the vendor disclosed this issue.
Vulnerable:	Mambo Mambo Open Source 4.5.2 .1 Mambo Mambo Open Source 4.5.2 Mambo Mambo Open Source 4.5.1 (1.0.9) Mambo Mambo Open Source 4.5.1 Beta 2 Mambo Mambo Open Source 4.5.1 Beta Mambo Mambo Open Source 4.5.1 Mambo Mambo Open Source 4.5 (1.0.3beta) Mambo Mambo Open Source 4.5 (1.0.3) Mambo Mambo Open Source 4.5 (1.0.2) Mambo Mambo Open Source 4.5 (1.0.1) Mambo Mambo Open Source 4.5 (1.0.0) Mambo Mambo Open Source 4.0.14

Not Vulnerable:	Mambo Mambo Open Source 4.5.2 .2

Discussion

Mambo Open Source Session ID Spoofing Vulnerability

Mambo is prone to a session ID spoofing vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

The vendor has addressed this issue in Mambo 4.5.2.2 and later; earlier versions are reported vulnerable.

Exploit / POC

Mambo Open Source Session ID Spoofing Vulnerability

No exploit is required.

Solution / Fix

Mambo Open Source Session ID Spoofing Vulnerability

Solution:
The vendor has addressed this issue in Mambo version 4.5.2.2 and later:

Mambo Mambo Open Source 4.0.14