FreeBSD : mambo -- SQL injection vulnerabilities (f70d09cb-0c46-11db-aac7-000c6ec775d9)

high Nessus Plugin ID 22041

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

The Team Mambo reports that two SQL injection vulnerabilities have been found in Mambo. The vulnerabilities exists due to missing sanitation of the title and catid parameters in the weblinks.php page and can lead to execution of arbitrary SQL code.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 22041

File Name: freebsd_pkg_f70d09cb0c4611dbaac7000c6ec775d9.nasl

Version: 1.21

Type: local

Family: FreeBSD Local Security Checks

Published: 7/13/2006

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:mambo, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/5/2006

Vulnerability Publication Date: 6/19/2006

Reference Information

CVE: CVE-2006-0871, CVE-2006-1794, CVE-2006-3262, CVE-2006-3263

BID: 16775

Secunia: 18935, 20745

Detections

Analytics