Mambo Articleid And Mcname Parameter SQL Injection Vulnerability

Overview

» IDS/IPS Signatures

Security Sites

iPolicy Networks Security Advisory


Date Discovered:	05/28/2008
Severity:	High
Applications Affected	Mambo 4.6.4 and previous

Synopsis

SQL injection vulnerability has been identified the Mambo 4.6.4 and previous

Recommended Actions

Upgrade with latest patch.
http://forum.mambo-foundation.org/showthread.php?t=11799

Threat Analysis

Mambo is an open source content management system that will help user`s to build websites and other online applications. It consist of lot of modules and components. Content management system(CMS) is a computer software system for organizing and facilitating collaborative creation of documents and other contents. CMS is frequently used as web application for managing web sites and web contents.

An SQL injection vulnerabilities have been identified in Mambo 4.6.4 and previous. This issue is due to a failure in the index.php to properly sanitize user-supplied input through articleid and mcname parameter. An attacker can take advantage of this issue to execute arbitrary sql commands.

References

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2498
http://www.securityfocus.com/bid/29373/info
http://www.frsirt.com/english/advisories/2008/1660/references
http://www.mamboserver.com/
http://secunia.com/advisories/30343

Write-up by: Vinod Sharma

Security Sites

“iPolicy is one of the most visionary firewall vendors in the firewall Magic Quadrant. Its architecture of a central session processing engine and multiple content blades that are able to block based on signatures, rules and so on is the closest to the network security ideal.”

Greg Young, John Pescatore
Magic Quadrant for Network Firewalls, 2H04, Gartner

| | | | | | | | |