CVE-2006-4195
Peoplebook Component for Mambo < 1.1.2 - Remote Code Execution via mosConfig_absolute_path Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-4195. PoCs published by Matdhule.
AI-analyzed exploit summary The writeup describes a remote file inclusion vulnerability in the Peoplebook Mambo Component <= v1.0 due to unsanitized $mosConfig_absolute_path variable. Exploitation requires register_globals=on and allow_fopenurl=on, allowing an attacker to include remote PHP files.
Description
PHP remote file inclusion vulnerability in param.peoplebook.php in the Peoplebook Component for Mambo (com_peoplebook) 1.0 and earlier, and possibly 1.1.2, when register_globals and allow_url_fopen are enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Exploits (1)
The writeup describes a remote file inclusion vulnerability in the Peoplebook Mambo Component <= v1.0 due to unsanitized $mosConfig_absolute_path variable. Exploitation requires register_globals=on and allow_fopenurl=on, allowing an attacker to include remote PHP files.