Mambo Site Server Administrator Password Bypass Vulnerability

Bugtraq ID:	3093
Class:	Origin Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 25 2001 12:00AM
Updated:	Jul 25 2001 12:00AM
Credit:	Repoorted to bugtraq by Ismael Peinado Palomo <[email protected]> on July 25, 2001.
Vulnerable:	Miro Construct Pty Ltd Mambo Site Server 3.0.5 Miro Construct Pty Ltd Mambo Site Server 3.0.4 Miro Construct Pty Ltd Mambo Site Server 3.0.3 Miro Construct Pty Ltd Mambo Site Server 3.0.2 Miro Construct Pty Ltd Mambo Site Server 3.0.1 Miro Construct Pty Ltd Mambo Site Server 3.0
Not Vulnerable:

Mambo Site Server Administrator Password Bypass Vulnerability

Mambo Site Server is a PHP- and MySQL-based tool for website content management and administration.

Versions of Mambo Site Server make insecure use of global variables in URLS used to authenticate a remote Mambo administrator through HTTP.

This flaw allows any user to access the Mambo Server's administration functions which can lead to compromises of the site's function, confidentiality of data, and potentially allow a hostile user to obtain sensitive information which could be used to further compromise the host.

Mambo Site Server Administrator Password Bypass Vulnerability

See discussion.

Mambo Site Server Administrator Password Bypass Vulnerability

References:

• Mambo Site Server (Miro Construct Pty Ltd)