CVE-2011-2917

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2011-2917
SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.exploit-db.com/exploits/18110 Exploit
http://www.openwall.com/lists/oss-security/2011/08/12/6 Exploit
http://www.osvdb.org/74502 Exploit
http://www.securityfocus.com/bid/49130 Exploit
http://yehg.net/lab/pr0js/advisories/%5Bmambo4.6_x%5D_sql_injection Exploit
http://www.exploit-db.com/exploits/18110 Exploit
http://www.openwall.com/lists/oss-security/2011/08/12/6 Exploit
http://www.osvdb.org/74502 Exploit
http://www.securityfocus.com/bid/49130 Exploit
http://yehg.net/lab/pr0js/advisories/%5Bmambo4.6_x%5D_sql_injection Exploit
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mambo-foundation:mambo:*:*:*:*:*:*:*:*
cpe:2.3:a:mambo-foundation:mambo:4.6:*:*:*:*:*:*:*
cpe:2.3:a:mambo-foundation:mambo:4.6:rc1:*:*:*:*:*:*
cpe:2.3:a:mambo-foundation:mambo:4.6:rc2:*:*:*:*:*:*
cpe:2.3:a:mambo-foundation:mambo:4.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mambo-foundation:mambo:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:mambo-foundation:mambo:4.6.2:pre1:*:*:*:*:*:*
cpe:2.3:a:mambo-foundation:mambo:4.6.2:pre2:*:*:*:*:*:*
cpe:2.3:a:mambo-foundation:mambo:4.6.3:*:*:*:*:*:*:*
cpe:2.3:a:mambo-foundation:mambo:4.6.4:*:*:*:*:*:*:*
History

21 Nov 2024, 01:29

Type Values Removed Values Added
References () http://www.exploit-db.com/exploits/18110 - Exploit () http://www.exploit-db.com/exploits/18110 - Exploit
References () http://www.openwall.com/lists/oss-security/2011/08/12/6 - Exploit () http://www.openwall.com/lists/oss-security/2011/08/12/6 - Exploit
References () http://www.osvdb.org/74502 - Exploit () http://www.osvdb.org/74502 - Exploit
References () http://www.securityfocus.com/bid/49130 - Exploit () http://www.securityfocus.com/bid/49130 - Exploit
References () http://yehg.net/lab/pr0js/advisories/%5Bmambo4.6_x%5D_sql_injection - Exploit () http://yehg.net/lab/pr0js/advisories/%5Bmambo4.6_x%5D_sql_injection - Exploit
Information

Published : 2011-12-08 19:55

Updated : 2024-11-21 01:29

NVD link : CVE-2011-2917

Mitre link : CVE-2011-2917

CVE.ORG link : CVE-2011-2917

JSON object : View

Products Affected

mambo-foundation

  • mambo
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')