CVE-2006-4372

Mambo com_lurm_constructor <0.6b - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4372. PoCs published by mdx.

AI-analyzed exploit summary This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in the Mambo CMS com_lurm_constructor component. The vulnerability allows an attacker to include and execute arbitrary remote files by manipulating the lm_absolute_path parameter.

Description

PHP remote file inclusion vulnerability in admin.lurm_constructor.php in the Lurm Constructor component (com_lurm_constructor) 0.6b and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the lm_absolute_path parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by mdx · textwebappsphp
https://www.exploit-db.com/exploits/2222

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in the Mambo CMS com_lurm_constructor component. The vulnerability allows an attacker to include and execute arbitrary remote files by manipulating the lm_absolute_path parameter.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Mambo CMS with com_lurm_constructor component
No auth needed
Prerequisites: Target must have the vulnerable com_lurm_constructor component installed · Remote file inclusion must be enabled on the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/2222
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/28475

Scores

EPSS 0.0222
EPSS Percentile 80.4%

Details

Status published
Products (1)
constructor_component/constructor_component < 0.6b
Published Aug 26, 2006
Tracked Since Feb 18, 2026