 |
Does this include the later post: Mambo Open Source 4.0.14 SQL injection There hasn't been any input validation for the variable artid. An attacker can thus insert his own sql query and get the administrator md5 pass from mod_users table and use it in cookie to gain admin access to the Mamboo CMS system. |
|
|
Lance update with wrappers: n response to the previous message I have changed apache config on www.caosity.org to only allow access to /administrator from specific listed ip addresses. They are :- 128.3.10.49 gmkurtzer 62.245.38.17 lsd office 62.245.38.33 lsd home 65.64.190.32 mpirun adsl in addition 63.207.100.120 has accessed it in the past days but as I dont know who it is I havent added it. |
|
|
I'm not at all impressed with the fact that the 'patches' are not published or mentioned on mambo website, but phpsecure, and they are not signed by mambo developers ... So I downloaded them from www.sourceforge.net/mambo It surprises me that they havent issued a new point release including the patches, whats the point of letting people install the insecure version ??? www.caosity.org now patched |
|
|
aha :- 63.207.100.120 == gmk_laptop added |
- Anonymous
