^{CVE-2006-3947:}PHP remote file inclusion vulnerability in the Mambatstaff component for Mambo (<= 3.1b) that allows attackers to execute arbitrary PHP code via a URL supplied in the mosConfig_absolute_path parameter.

Overview

The CVE relates to a PHP remote file inclusion vulnerability in the Mambatstaff component (components/com_mambatstaff/mambatstaff.php) used with Mambo, affecting version 3.1b and earlier. By supplying a crafted URL in the mosConfig_absolute_path parameter, an attacker can cause the application to include remote PHP code, resulting in arbitrary code execution on the server. This security flaw was publicly disclosed in 2006, highlighting the risk of remote control of affected systems and potential data compromise.

Remediation

• Upgrade or remove: Update the Mambo CMS and the Mambatstaff component to a patched version or remove the vulnerable Mambatstaff component if a fixed version is not available.
• If upgrading is not possible: Disable the susceptible functionality by removing or disabling the Mambatstaff component from the site; minimize exposure by removing any code paths that use mosConfig_absolute_path for remote includes.
• PHP configuration hardening: Disable remote file inclusion features where feasible (set allow_url_fopen and allow_url_include to Off in php.ini) and implement input validation to reject external URLs in inclusion parameters.
• Defense-in-depth: Deploy a web application firewall (WAF) to detect and block remote file inclusion attempts; monitor logs for suspicious mosConfig_absolute_path usage; perform periodic vulnerability scans.
• Verifications: After remediation, re-test to ensure the vulnerability is no longer exploitable and confirm that the Mambatstaff component is secure or removed.

References

• 21292 — SECUNIA advisory: http://secunia.com/advisories/21292
• 27653 — OSVDB entry: http://www.osvdb.org/27653
• 1313 — SREASON security alert: http://securityreason.com/securityalert/1313
• ADV-2006-3055 — VUPEN advisory: http://www.vupen.com/english/advisories/2006/3055
• 2086 — EXPLOIT-DB exploit: https://www.exploit-db.com/exploits/2086
• 19222 — BID security advisory: http://www.securityfocus.com/bid/19222
• mambatstaff-mambatstaff-file-include(28074) — XF vulnerability entry: https://exchange.xforce.ibmcloud.com/vulnerabilities/28074
• 20060729 mambatstaff Mambo Component <= Remote Include Vulnerability — BUGTRAQ: http://www.securityfocus.com/archive/1/441538/100/0/threaded