CVE-2008-6221: Code Injection
PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (comdadamail) component 2.6 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfigabsolutepath] parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Configure a web application firewall (WAF), reverse proxy, or firewall rule to block or drop HTTP requests targeting the Joomla! com_dadamail component (version 2.6) that include the parameter GLOBALS[mosConfig_absolute_path] or that supply a URL in that parameter (i.e., RFI patterns). As an alternative or additional measure, restrict access to the com_dadamail management endpoints to trusted IP addresses only.
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6221?
CVE-2008-6221 has a severity rating of high with a score of 7.5.
How do I fix CVE-2008-6221?
To fix CVE-2008-6221, you should update to the latest version of the Dada Mail Manager component for Joomla! that addresses this vulnerability.
What type of vulnerability is CVE-2008-6221?
CVE-2008-6221 is a PHP remote file inclusion vulnerability that allows remote attackers to execute arbitrary PHP code.
Which software is affected by CVE-2008-6221?
CVE-2008-6221 affects the Dada Mail Manager component 2.6 for Joomla!.
Can CVE-2008-6221 be exploited without authentication?
Yes, CVE-2008-6221 can be exploited without authentication as it allows for remote execution of code.