← Vulnerability feed

Vulnerability record · CVE-2007-4456 · published 21 August 2007

CVE-2007-4456: Mambo sql injection vulnerability

Mambo · Mambo

SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remote attackers to execute arbitrary SQL commands via the aid parameter. NOTE: it was later reported that 2.40 is also affected, and that the component can be used in Joomla! in addition to Mambo.

7.5 CVSS 2.0 High EPSS 2.4% · top 16.8% CWE-89 · SQL injection
7.5CVSS 2.0 base score
2.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
14References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remote attackers to execute arbitrary SQL commands via the aid parameter. NOTE: it was later reported that 2.40 is also affected, and that the component can be used in Joomla! in addition to Mambo.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/26556
http://securityreason.com/securityalert/3041
http://www.securityfocus.com/archive/1/477174/100/0/threaded
http://www.securityfocus.com/archive/1/477232/100/0/threaded
http://www.securityfocus.com/bid/25376 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/36113
https://www.exploit-db.com/exploits/4296
http://secunia.com/advisories/26556
http://securityreason.com/securityalert/3041
http://www.securityfocus.com/archive/1/477174/100/0/threaded
http://www.securityfocus.com/archive/1/477232/100/0/threaded
http://www.securityfocus.com/bid/25376 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/36113
https://www.exploit-db.com/exploits/4296

Track CVE-2007-4456 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.6CVE-2006-1794Mambo vulnerabilitySQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) t…EPSS 5.5%7.5CVE-2008-5226Mambads sql injection vulnerabilitySQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote attackers to execute arbitrary SQ…EPSS 1.0%7.5CVE-2008-0829Joomla sql injection vulnerabilitySQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo allows remote attackers to ex…EPSS 1.1%7.5CVE-2008-0795Joomla sql injection vulnerabilitySQL injection vulnerability in index.php in the MGFi XfaQ (com_xfaq) 1.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary…EPSS 0.97%7.5CVE-2008-0561Arthur konze webdesign akogallery sql injection vulnerabilitySQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo and Joomla! allows remote attac…EPSS 1.1%7.5CVE-2008-0510Joomla com newsletter sql injection vulnerabilitySQL injection vulnerability in index.php in the Newsletter (com_newsletter) component for Mambo 4.5 and Joomla! allows remote attackers to execute ar…EPSS 0.97%7.5CVE-2008-0517Darko selesi estateagent sql injection vulnerabilitySQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote at…EPSS 1.0%7.5CVE-2007-5177Mambads sql injection vulnerabilitySQL injection vulnerability in index.php in the MambAds (com_mambads) 1.5 and earlier component for Mambo allows remote attackers to execute arbitrar…EPSS 0.99%

Source: NIST National Vulnerability Database (record CVE-2007-4456), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.