A vulnerability has been identified in Mambo, which could be exploited by attackers to execute arbitrary SQL queries. This issue is due to an unspecified input validation error in the cancel edit functions when processing certain parameters, which could be exploited by malicious people to conduct SQL injection attacks.

Affected Products

Mambo version 4.5.4 and prior

Solution

Upgrade to Mambo version 4.5.5 :
http://mamboxchange.com/frs/?group_id=5

References

http://www.vupen.com/english/advisories/2007/0480
http://sourceforge.net/forum/forum.php?forum_id=660981

Credits

Vulnerability reported by the vendor

Changelog

2007-02-05 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.