← Vulnerability feed

Vulnerability record · CVE-2008-2905 · published 30 June 2008

CVE-2008-2905: Mambo code injection vulnerability

Mambo · Mambo

PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

6.8 CVSS 2.0 Medium EPSS 18% · top 2.9% CWE-94 · Code injection
6.8CVSS 2.0 base score
18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/30685 Vendor Advisory
http://www.securityfocus.com/bid/29716 Exploit
http://www.securitytracker.com/id?1020295
https://exchange.xforce.ibmcloud.com/vulnerabilities/43101
https://www.exploit-db.com/exploits/5808
http://secunia.com/advisories/30685 Vendor Advisory
http://www.securityfocus.com/bid/29716 Exploit
http://www.securitytracker.com/id?1020295
https://exchange.xforce.ibmcloud.com/vulnerabilities/43101
https://www.exploit-db.com/exploits/5808

Track CVE-2008-2905 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.6CVE-2006-1794Mambo vulnerabilitySQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) t…EPSS 5.5%7.5CVE-2008-5226Mambads sql injection vulnerabilitySQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote attackers to execute arbitrary SQ…EPSS 1.0%7.5CVE-2008-0829Joomla sql injection vulnerabilitySQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo allows remote attackers to ex…EPSS 1.1%7.5CVE-2008-0795Joomla sql injection vulnerabilitySQL injection vulnerability in index.php in the MGFi XfaQ (com_xfaq) 1.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary…EPSS 0.97%7.5CVE-2008-0561Arthur konze webdesign akogallery sql injection vulnerabilitySQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo and Joomla! allows remote attac…EPSS 1.1%7.5CVE-2008-0510Joomla com newsletter sql injection vulnerabilitySQL injection vulnerability in index.php in the Newsletter (com_newsletter) component for Mambo 4.5 and Joomla! allows remote attackers to execute ar…EPSS 0.97%7.5CVE-2008-0517Darko selesi estateagent sql injection vulnerabilitySQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote at…EPSS 1.0%7.5CVE-2007-5177Mambads sql injection vulnerabilitySQL injection vulnerability in index.php in the MambAds (com_mambads) 1.5 and earlier component for Mambo allows remote attackers to execute arbitrar…EPSS 0.99%

Source: NIST National Vulnerability Database (record CVE-2008-2905), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.