CVE-2006-3294
CBSMS Mambo Module 1.0 - Remote File Inclusion via mosConfig_absolute_path Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-3294. PoCs published by Kw3[R]Ln.
AI-analyzed exploit summary This is a writeup describing a remote file inclusion vulnerability in CBSMS Mambo Module <= 1.0 due to an unsanitized $mosConfig_absolute_path variable when register_globals is enabled. The exploit allows an attacker to include a remote PHP script by manipulating the mosConfig_absolute_path parameter.
Description
PHP remote file inclusion vulnerability in mod_cbsms_messages.php in CBSMS Mambo Module 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Exploits (1)
This is a writeup describing a remote file inclusion vulnerability in CBSMS Mambo Module <= 1.0 due to an unsanitized $mosConfig_absolute_path variable when register_globals is enabled. The exploit allows an attacker to include a remote PHP script by manipulating the mosConfig_absolute_path parameter.