CVE-2008-2905: Code Injection
PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the CacheLite package in Mambo 4.6.4 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2905?
CVE-2008-2905 is classified as a critical vulnerability due to its potential to allow remote attackers to execute arbitrary PHP code.
How do I fix CVE-2008-2905?
To fix CVE-2008-2905, disable register_globals in your PHP configuration and update to a secure version of Mambo that is not affected by this vulnerability.
Which versions of Mambo are affected by CVE-2008-2905?
CVE-2008-2905 affects Mambo versions 4.6.4 and earlier.
What kind of attacks can CVE-2008-2905 facilitate?
CVE-2008-2905 can facilitate remote code execution via crafted URLs, allowing an attacker to take full control of the affected Mambo application.
What is needed to exploit CVE-2008-2905?
Exploitation of CVE-2008-2905 requires the attacker to have knowledge of the Mambo configuration and the ability to send HTTP requests to the vulnerable server.