SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user_rating parameter.

A Secunia Advisory reports :

Some vulnerabilities have been reported in Mambo, where some have unknown impacts and others can be exploited by malicious people to conduct spoofing and SQL injection attacks.

- Input passed to the 'user_rating' parameter when voting isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

- Some unspecified vulnerabilities in the 'mosDBTable' class and the 'DOMIT' library have an unknown impact.

- An unspecified error in the 'administrator/index3.php' script can be exploited to spoof session IDs.

The installed version of Mambo Open Source on the remote host suffers from the following flaws :

  - Session ID Spoofing Vulnerability     An unspecified flaw in the script 'administrator/index3.php'     can be exploited to spoof session IDs.

  - Local File Disclosure Vulnerability     The 'includes/DOMIT/testing_domit.php' script may be used     to read the contents of local files such as Mambo's     configuration file, which holds database credentials.

  - A SQL Injection Vulnerability     The application fails to properly sanitize user-supplied     input to the 'user_rating' parameter of the     'components/com_content/content.php' script before using     it in SQL statements.

  - Multiple Unspecified Injection Vulnerabilities     Various class 'check' methods fail to properly     sanitize input, although it's unknown precisely     what dangers these flaws present.

The remote host is running the Mambo Content Server, an application for generating dynamic content for web servers.  The remote application is vulnerable to a flaw where remote attackers can upload malicious code. The code can then be executed by simply requesting the code via an HTTP session.  The specific flaw is within the Tar.php script, which does not properly sanitize user-supplied content.  Versions of Mambo through 4.5.2.3 are prone to a remote 'file include' flaw.  An attacker exploiting this flaw would be able to specify malicious code that would be run by the Mambo server.

ID	Name	Product	Family	Severity
21385	FreeBSD : mambo -- multiple vulnerabilities (0bf9d7fb-05b3-11da-bc08-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
18495	Mambo Open Source < 4.5.2.3 Multiple Vulnerabilities	Nessus	CGI abuses	high
2638	Mambo Content Server Detection Global Variables Overwrite	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2005-2002

critical

Tenable Plugins

high

high

high