Mambo Open Source Remote File Include Vulnerability
BID:15461
Info
Mambo Open Source Remote File Include Vulnerability
| Bugtraq ID: | 15461 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3738 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 16 2005 12:00AM |
| Updated: | Nov 16 2005 12:00AM |
| Credit: | peter MC tachatte <[email protected]> is credited with the discovery of this vulnerability. |
| Vulnerable: |
Mambo Mambo Site Server 4.0.14 Mambo Mambo Site Server 4.0.12 RC3 Mambo Mambo Site Server 4.0.12 RC2 Mambo Mambo Site Server 4.0.12 RC1 Mambo Mambo Site Server 4.0.12 BETA 2 Mambo Mambo Site Server 4.0.12 BETA Mambo Mambo Site Server 4.0.12 Mambo Mambo Site Server 4.0.11 Mambo Mambo Site Server 4.0.10 Mambo Mambo Site Server 4.0 Joomla Joomla 1.0.3 Joomla Joomla 1.0.2 Joomla Joomla 1.0.1 Joomla Joomla 1.0 |
| Not Vulnerable: |
Mambo Mambo Open Source 4.5.2 .3 Joomla Joomla 1.0.4 |
Discussion
Mambo Open Source Remote File Include Vulnerability
Mambo is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.
Update: Reportedly, this issue is being actively exploited in the wild; multiple Web sites have been defaced, and the issue described in this BID is being cited as the attackers method of entry.
Update 12/5/2005 - Reports indicate that a bot is propagating in the wild by exploiting this vulnerability.
Mambo is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.
Update: Reportedly, this issue is being actively exploited in the wild; multiple Web sites have been defaced, and the issue described in this BID is being cited as the attackers method of entry.
Update 12/5/2005 - Reports indicate that a bot is propagating in the wild by exploiting this vulnerability.
Exploit / POC
Mambo Open Source Remote File Include Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Mambo Open Source Remote File Include Vulnerability
Solution:
The vendor has released a patch addressing this issue. Users are advised to contact the vendor for more information on obtaining the appropriate patch.
Joomla has released version 1.0.4 to address this, and other issues. Joomla is a fork of Mambo, and is susceptible to this issue.
Joomla Joomla 1.0
Joomla Joomla 1.0.1
Joomla Joomla 1.0.2
Joomla Joomla 1.0.3
Solution:
The vendor has released a patch addressing this issue. Users are advised to contact the vendor for more information on obtaining the appropriate patch.
Joomla has released version 1.0.4 to address this, and other issues. Joomla is a fork of Mambo, and is susceptible to this issue.
Joomla Joomla 1.0
-
Joomla Joomla 1.0.4
http://developer.joomla.org/sf/frs/do/viewRelease/projects.joomla/frs. joomla_1_0.1_0_4
Joomla Joomla 1.0.1
-
Joomla Joomla 1.0.4
http://developer.joomla.org/sf/frs/do/viewRelease/projects.joomla/frs. joomla_1_0.1_0_4
Joomla Joomla 1.0.2
-
Joomla Joomla 1.0.4
http://developer.joomla.org/sf/frs/do/viewRelease/projects.joomla/frs. joomla_1_0.1_0_4
Joomla Joomla 1.0.3
References
Mambo Open Source Remote File Include Vulnerability
References:
References:
- [Full-disclosure] mambo remote code sexecution (peter MC tachatte
- ezPortal/ztml Homepage (ezPortal/ztml)
- Joomla 1.0.4 Changelog (Joomla)
- Mambo Changelog (Mambo)
- Mambo Open Source Homepage (Mambo)
- Mambo 0day Exploit out in the wild - mambo/skype hacked ([email protected])
- Outpost24 Public Security Note: Linux/Elxbot (David Jacoby