CVE-2006-3947

Published: Aug 1, 2006Modified: Apr 16, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

PHP remote file inclusion vulnerability in components/com_mambatstaff/mambatstaff.php in the Mambatstaff 3.1b and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Affected (1)

Products: Mambo: Mambatstaff

Mambo

1 product

Mambatstaff

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mambo Mambatstaff	Up to 3.1b

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (16)

http://secunia.com/advisories/21292

Source: cve@mitre.org

Vendor Advisory

http://securityreason.com/securityalert/1313

Source: cve@mitre.org

http://www.osvdb.org/27653

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/441538/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/19222

Source: cve@mitre.org

Exploit

http://www.vupen.com/english/advisories/2006/3055

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/28074

Source: cve@mitre.org

https://www.exploit-db.com/exploits/2086

Source: cve@mitre.org

http://secunia.com/advisories/21292