header-logo
Suggest Exploit
vendor:
Mambo Site Server
by:
SecurityFocus
5
CVSS
MEDIUM
Information Disclosure
200
CWE
Product Name: Mambo Site Server
Affected Version From: All versions
Affected Version To: All versions
Patch Exists: NO
Related CWE: N/A
CPE: a:mambo:mambo_site_server
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Unix, Linux, Windows
2002

Mambo Site Server phpinfo.php Information Disclosure Vulnerability

Mambo Site Server is a freely available, open source web content management tool. It is written in PHP, and available for Unix, Linux, and Microsoft Windows operating systems. It has been reported that Mambo enables a script by default that may reveal sensitive information. The phpinfo.php script is packaged with Mambo, and installed by default in the administrator subdirectory. A remote user may use this script to gain information about the server, including path and environment information.

Mitigation:

Disable the phpinfo.php script or restrict access to it.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/6376/info

Mambo Site Server is a freely available, open source web content management tool. It is written in PHP, and available for Unix, Linux, and Microsoft Windows operating systems.

It has been reported that Mambo enables a script by default that may reveal sensitive information. The phpinfo.php script is packaged with Mambo, and installed by default in the administrator subdirectory. A remote user may use this script to gain information about the server, including path and environment information.

http://www.example.com/mambo/administrator/phpinfo.php

Navigation

Suggest Exploit

Services By CQR