CVE-2006-3846

Mambo Multibanners - Code Injection

Title source: rule
STIX 2.1

Description

PHP remote file inclusion vulnerability in extadminmenus.class.php in the MultiBanners 1.0.1 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Blue|Spy · textwebappsphp
https://www.exploit-db.com/exploits/2066

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/27916
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/19100
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2933
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1277
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21168
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/440881/100/0/threaded

Scores

EPSS 0.0505
EPSS Percentile 89.9%

Details

CWE
CWE-94
Status published
Products (1)
mambo/mambo_multibanners 1.0.1
Published Jul 25, 2006
Tracked Since Feb 18, 2026