CVE-2006-4286

Published: Aug 22, 2006Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: this issue has been disputed by third parties who state that contentpublisher.php protects against direct request in the most recent version. The original researcher is known to be frequently inaccurate

Affected (21)

Products: Mambo: Mambo

Mambo

1 product

Mambo

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Mambo Mambo	Version 4.0.14
Mambo Mambo	Version 4.5.0.2
Mambo Mambo	Version 4.5.1.3
Mambo Mambo	Version 4.5.1_1.0.9
Mambo Mambo	Version 4.5.1a
Mambo Mambo	Version 4.5.1a a
Mambo Mambo	Version 4.5.1a beta
Mambo Mambo	Version 4.5.1a beta_2
Mambo Mambo	Version 4.5.2.1
Mambo Mambo	Version 4.5.2.2
Mambo Mambo	Version 4.5.2.3
Mambo Mambo	Version 4.5.2
Mambo Mambo	Version 4.5.3h
Mambo Mambo	Version 4.5.3h h
Mambo Mambo	Version 4.5_1.0.0
Mambo Mambo	Version 4.5_1.0.1
Mambo Mambo	Version 4.5_1.0.2
Mambo Mambo	Version 4.5_1.0.3_beta
Mambo Mambo	Version 4.5_1.0.3_beta beta
Mambo Mambo	Version 4.5_1.0.9
Mambo Mambo	Version 4.6 rc1