FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-0871

This CVE name corresponds to:

Entered	Topic
2006-07-05	mambo -- SQL injection vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-0871 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-0871
Phase	Assigned(20060224)

Description

Directory traversal vulnerability in the _setTemplate function in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to read and include arbitrary files via the mos_change_template parameter. NOTE: CVE-2006-1794 has been assigned to the SQL injection vector.

References

Source	Reference
BUGTRAQ	20060224 Mambo Multiple Vulnerabilities
MISC	http://www.gulftech.org/?node=research&article_id=00104-02242006
CONFIRM	http://source.mambo-foundation.org/view/news/Announcements/Security_Patch_Released/
VUPEN	ADV-2006-0719
OSVDB	23505
SECUNIA	18935
SREASON	493