Detections
Analytics
Mambo < 4.6.1 Login Function usercookie Cookie SQL Injection
high Nessus Network Monitor Plugin ID 3656
Synopsis
The remote host is vulnerable to a SQL Injection attack.Description
The remote host is running the Mambo Content Server, an application for generating dynamic content for web servers. The remote application is vulnerable to a flaw where remote attackers can execute arbitrary SQL commands on the database server utilized by Mambo. In order to exploit this flaw, an attacker would only need to send a malformed HTTP query containing SQL commands to the 'Name' field of the 'Submit Weblink' form. Successful exploitation would result in a potential loss of confidentiality, integrity, and availability on the remote database server.Solution
Upgrade to version 4.6.1 or higher.See Also
Plugin Details
Severity: High
ID: 3656
Family: Web Servers
Published: 6/19/2006
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:P/RL:U/RC:X
Vulnerability Information
CPE: cpe:/a:mambo:mambo
Reference Information
CVE: CVE-2006-3262