FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-1794

This CVE name corresponds to:

Entered	Topic
2006-07-05	mambo -- SQL injection vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-1794 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-1794
Phase	Assigned(20060417)

Description

SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) the $username variable in the mosGetParam function and (2) the $task parameter in the mosMenuCheck function in (a) includes/mambo.php; and (3) the $filter variable to the showCategory function in the com_content component (content.php).

References

Source	Reference
BUGTRAQ	20060224 Mambo Multiple Vulnerabilities
MISC	http://www.gulftech.org/?node=research&article_id=00104-02242006
CONFIRM	http://source.mambo-foundation.org/view/news/Announcements/Security_Patch_Released/
BID	16775
VUPEN	ADV-2006-0719
OSVDB	23402
OSVDB	23503
SECUNIA	18935
XF	mambo-index2-sql-injection(24951)