CVEvulnerability

CVE-2005-3738

2.6 LOW Published 2005-11-22 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-11-22
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:N/I:P/A:N

Description

globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfig_absolute_path parameter to content.html.php for remote PHP file inclusion.

Affected configurations

• mambo mambo site server 4.0 • mambo mambo site server 4.0.10 • mambo mambo site server 4.0.11 • mambo mambo site server 4.0.12 • mambo mambo site server 4.0.12 beta • mambo mambo site server 4.0.12 beta 2 • mambo mambo site server 4.0.12 rc1 • mambo mambo site server 4.0.12 rc2 • mambo mambo site server 4.0.12 rc3 • mambo mambo site server 4.0.14

References