CVE-2006-4322

EstateAgent Component for Mambo - Remote File Inclusion via mosConfig_absolute_path Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4322. PoCs published by O.U.T.L.A.W.

AI-analyzed exploit summary The provided text describes a retired remote file inclusion vulnerability in the Mambo EstateAgent component, which was deemed non-exploitable. No functional exploit code is present, only a description and a retired BID reference.

Description

PHP remote file inclusion vulnerability in estateagent.php in the EstateAgent component (com_estateagent) for Mambo, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by O.U.T.L.A.W · textwebappsphp
https://www.exploit-db.com/exploits/28416

The provided text describes a retired remote file inclusion vulnerability in the Mambo EstateAgent component, which was deemed non-exploitable. No functional exploit code is present, only a description and a retired BID reference.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: Mambo EstateAgent component (version unspecified)
No auth needed
Prerequisites: Access to the vulnerable EstateAgent component
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/19625
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/443911/100/0/threaded
Third Party Advisory mailing-list x_refsource_vim
http://www.attrition.org/pipermail/vim/2006-August/000984.html

Scores

EPSS 0.0253
EPSS Percentile 83.3%

Details

Status published
Products (1)
bits-dont-bite/estateagent
Published Aug 24, 2006
Tracked Since Feb 18, 2026