CVE:CVE-2008-2905
CNNVD:CNNVD-200806-408
Mambo 4.6.4及其早期版本下的includes/Cache/Lite/Output.php中存在PHP远程文件包含漏洞, 在 register_globals被激活时, 远程攻击者通过mosConfig_absolute_path参数的一个URL来执行任意PHP代码。
solution:Upgrade mambo mambo to a higher version than 4.0.14,4.5,4.5.0.2,4.5.1.3,4.5.1_1.0.9,4.5.1_beta,4.5.1_beta2,4.5.1a,4.5.2,4.5.2.1,4.5.2.2,4.5.2.3,4.5.3h,4.5.4,4.5_1.0.0,4.5_1.0.1,4.5_1.0.2,4.5_1.0.3_beta,4.5_1.0.9,4.6,4.6.1,4.6.2,4.6.4,and avoid the version 4.0.14,4.5,4.5.0.2,4.5.1.3,4.5.1_1.0.9,4.5.1_beta,4.5.1_beta2,4.5.1a,4.5.2,4.5.2.1,4.5.2.2,4.5.2.3,4.5.3h,4.5.4,4.5_1.0.0,4.5_1.0.1,4.5_1.0.2,4.5_1.0.3_beta,4.5_1.0.9,4.6,4.6.1,4.6.2,4.6.4