Mambo Vulnerabilities and new updates

By N-Stalker Team on August 20, 2007

N-Stalker has made available the latest database update for its Web Application Security Assessment Products. Following the support life-cycle, we are still distributing updates for previous version.

You will be able to download it automatically in the following versions:

  • N-Stalker Web Application Security Scanner 2006 (Enterprise, QA and Infrastructure Edition)
    • WSI Update (N-Stalker Update Manager)
  • N-Stealth HTTP Security Scanner (not updated)

You should be able to receive it automatically next time you execute the scanner.

If you prefer to download it manually, please, use the following url: https://customer.nstalker.com.

If you need any additional assistance during this process, please, contact us at:
Web: Open new support ticket at https://customer.nstalker.com
E-mail: http://www.nstalker.com/about/contact (24hs) or
Phone: +55-11-3675-7093 (9am to 18pm GMT-0300)

This release has included the following vulnerabilities:

  • DotClear 1.2.5 Index.PHP Cross-Site Scripting Vulnerability
  • DotClear 1.2.5 Trackback.PHP Cross-Site Scripting Vulnerability
  • Mambo Com-Zoom Module 25beta EXIF_Makernote.PHP Remote File Include Vulnerability
  • Mambo Com-Zoom Module 25beta EXIF.PHP Remote File Include Vulnerability
  • TOSMO/Mambo 1.4.13 Configuration.PHP Remote File Include Vulnerability
  • TOSMO/Mambo 1.4.13 Bb_Plugins.PHP Remote File Include Vulnerability
  • TOSMO/Mambo 1.4.13 Com_Minibb.PHP Remote File Include Vulnerability
  • Crea-Book 1.0 Uninstall.PHP SQL Injection Vulnerability
  • Crea-Book 1.0 Admin.PHP SQL Injection Vulnerability
  • CodeBreak 1.1.2 Codebreak.PHP Remote File Include Vulnerability
  • PL-PHP 0.9 SQL Injection Vulnerability
  • PL-PHP 0.9 Authentication Bypass Vulnerability
  • PL-PHP 0.9 Directory Traversal Vulnerability
  • @Mail 5.0 Atmail.PHP Cross-Site Scripting Vulnerability
  • Mambo Calendar Module 1.5.5 Mod_Calendar.PHP Remote File Include Vulnerability
  • Mambo Calendar Module 1.5.5 Com_Calendar.PHP Remote File Include Vulnerability
  • SimpCMS Light 6.4.2007 Index.PHP Remote File Include Vulnerability
  • MXBB MX Shotcast Module 1.0 MX_Root_Path Remote File Include Vulnerability
  • PHPWebNews 0.1 Bukutamu.PHP Cross-Site Scripting Vulnerability
  • PHPWebNews 0.1 Iklan.PHP Cross-Site Scripting Vulnerability
  • PHPWebNews 0.1 Index.PHP Cross-Site Scripting Vulnerability
  • RicarGBooK 1.2.1 Header.PHP Local File Include Vulnerability
  • TuMusika Evolution 1.6 Index.PHP Cross-Site Scripting Vulnerability
  • WebKalk2 1.9 Engine.Inc.PHP Remote File Include Vulnerability
  • Mambo MambWeather Module 1.8.1 Savant2_Plugin_Options.PHP Remote File Include Vulnerability
  • CHCounter 3.1.3 Stats/Index.PHP HTML Injection Vulnerability
  • Expow 0.8 Autoindex.PHP Remote File Include Vulnerability
  • VWar 1.5 Online.PHP SQL Injection Vulnerability
  • VWar 1.5 Login.PHP Cross Site Scripting Vulnerability
  • VWar 1.5 Today.PHP Cross Site Scripting Vulnerability
  • Frogss 0.7 CMS Viewtopic.PHP SQL Injection Vulnerability
  • Frogss 0.7 CMS Forum.PHP SQL Injection Vulnerability
  • Frogss 0.7 CMS Katalog.PHP SQL Injection Vulnerability
  • Garennes 0.6.7 Professeurs/Index.PHP Remote File Include Vulnerability
  • Garennes 0.6.7 Direction/Index.PHP Remote File Include Vulnerability
  • Garennes 0.6.7 Cpe/Index.PHP Remote File Include Vulnerability
  • QDBlog 0.4 Local File Inclusion Vulnerability
  • QDBlog 0.4 SQL Injection Vulnerability
  • Pixaria Gallery 1.4.2 Class.Smarty.PHP Remote File Include Vulnerability
  • BloofoxCMS 0.2.2 Img_Popup.PHP Cross-Site Scripting Vulnerability
  • Flowers 2.0 Cas.PHP Cross-Site Scripting Vulnerability
  • Joomla/Mambo Autostand Category Module 1.1 MosConfig_Absolute_Path Remote File Include Vulnerability
  • Joomla/Mambo Autostand Category Module 1.1 MosConfig_Absolute_Path Remote File Include Vulnerability
  • Web Slider 0.6 Highlight.PHP Remote File Include Vulnerability
  • Web Slider 0.6 Modules.PHP Remote File Include Vulnerability
  • Web Slider 0.6 Pdf.PHP Remote File Include Vulnerability
  • Web Slider 0.6 Index.PHP Remote File Include Vulnerability
  • Arash AudioCMS 0.1.4 List_Features.Inc.PHP Remote File Include Vulnerability
  • Arash AudioCMS 0.1.4 Arash_Gadmin.Class.PHP Remote File Include Vulnerability
  • Arash AudioCMS 0.1.4 Arash_Sadmin.Class.PHP Remote File Include Vulnerability
  • Arash AudioCMS 0.1.4 Edit.Inc.PHP Remote File Include Vulnerability
  • Web Service Deluxe News Manager Deluxe 1.0.1 Footer.PHP Local File Include Vulnerability
  • Papoo 3.02 Kontakt.PHP SQL Injection Vulnerability
  • CNStats 2.9 Who_S.PHP Remote File Include Vulnerability
  • CNStats 2.9 Who_R.PHP Remote File Include Vulnerability
  • Actionpoll 1.1.1 Actionpoll.PHP Remote File Include Vulnerability
  • Actionpoll 1.1.1 DataReaderWriter.PHP Remote File Include Vulnerability
  • OE2edit OE2edit.CGI Cross-Site Scripting Vulnerability
  • Mambo/Joomla New Article Component 1.1 Components/Com_Articles.PHP Remote File Include Vulnerability
  • Mambo/Joomla New Article Component 1.1 Classes/Html/Com_Articles.PHP Remote File Include Vulnerability
  • StoreFront for Gallery Ui_Functions.PHP Remote File Include Vulnerability
  • StoreFront for Gallery Business_Functions.PHP Remote File Include Vulnerability
  • XOOPS TeamSpeak Display Module 0.1 TSDisplay4xoops_Block2.PHP Remote File Include Vulnerability
  • Anthologia 0.5.2 Index.PHP Remote File Include Vulnerability
  • AJPortal2PHP Begin.Inc.PHP Remote File Include Vulnerability
  • AJPortal2PHP Events.Inc.PHP Remote File Include Vulnerability
  • AJPortal2PHP Footer.Inc.PHP Remote File Include Vulnerability
  • AJPortal2PHP Header.Inc.PHP Remote File Include Vulnerability
  • AJPortal2PHP Menuleft.Inc.PHP Remote File Include Vulnerability
  • AJPortal2PHP Connection.Inc.PHP Remote File Include Vulnerability
  • AJPortal2PHP Pages.Inc.PHP Remote File Include Vulnerability
  • Wabbit Gallery Script 0.9 Showpic.PHP PIC Parameter Cross-Site Scripting Vulnerability
  • Wabbit Gallery Script 0.9 Showpic.PHP GAL Parameter Cross-Site Scripting Vulnerability
  • PHPTrafficA 1.4.1 Banref.PHP Directory Traversal Vulnerability
  • PHPTrafficA 1.4.1 PlotStat.PHP Directory Traversal Vulnerability
  • Cabron Connector 1.1 InclusionService.PHP Remote File Include Vulnerability
  • Joomla/Mambo JoomlaPack Module 1.0.4a2 MosConfig_Absolute_Path Remote File Include Vulnerability
  • Gizzar 03162002 Index.php Remote File Include Vulnerability
  • MailBee WebMail Pro 3.4 Check_login.ASP Cross-Site Scripting Vulnerability
  • TurnkeyWebTools Sunshop 3.5 Checkout.PHP Remote File Include Vulnerability
  • TurnkeyWebTools Sunshop 3.5 Index.PHP Remote File Include Vulnerability
  • Joomla Template Module Be2004-2 Index.PHP Remote File Include Vulnerability
  • Rezervi 0.9 Footer.Inc.PHP Remote File Include Vulnerability
  • Rezervi 0.9 Header.Inc.PHP Remote File Include Vulnerability
  • Rezervi 0.9 Stylesheets.PHP Remote File Include Vulnerability
  • Rezervi 0.9 Wochenuebersicht.Inc.PHP Remote File Include Vulnerability
  • Rezervi 0.9 Monatsuebersicht.Inc.PHP Remote File Include Vulnerability
  • Rezervi 0.9 Jahresuebersicht.Inc.PHP Remote File Include Vulnerability
  • Rezervi 0.9 Tagesuebersicht.Inc.PHP Remote File Include Vulnerability
  • Rezervi 0.9 DatumVonDatumBis.Inc.PHP Remote File Include Vulnerability

This entry was posted in N-Stalker Latest Updates. Bookmark the permalink.