National Cyber Awareness System

Vulnerability Summary for CVE-2006-3990

Overview

Multiple PHP remote file inclusion vulnerabilities in Paul M. Jones Savant2, possibly when used with the com_mtree component for Mambo and Joomla!, allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) Savant2_Plugin_stylesheet.php, (2) Savant2_Compiler_basic.php, (3) Savant2_Error_pear.php, (4) Savant2_Error_stack.php, (5) Savant2_Filter_colorizeCode.php, (6) Savant2_Filter_trimwhitespace.php, (7) Savant2_Plugin_ahref.php, (8) Savant2_Plugin_ahrefcontact.php, (9) Savant2_Plugin_ahreflisting.php, (10) Savant2_Plugin_ahreflistingimage.php, (11) Savant2_Plugin_ahrefmap.php, (12) Savant2_Plugin_ahrefownerlisting.php, (13) Savant2_Plugin_ahrefprint.php, (14) Savant2_Plugin_ahrefrating.php, (15) Savant2_Plugin_ahrefrecommend.php, (16) Savant2_Plugin_ahrefreport.php, (17) Savant2_Plugin_ahrefreview.php, (18) Savant2_Plugin_ahrefvisit.php, (19) Savant2_Plugin_checkbox.php, (20) Savant2_Plugin_cycle.php, (21) Savant2_Plugin_dateformat.php, (22) Savant2_Plugin_editor.php, (23) Savant2_Plugin_form.php, (24) Savant2_Plugin_image.php, (25) Savant2_Plugin_input.php, (26) Savant2_Plugin_javascript.php, (27) Savant2_Plugin_listalpha.php, (28) Savant2_Plugin_listingname.php, (29) Savant2_Plugin_modify.php, (30) Savant2_Plugin_mtpath.php, (31) Savant2_Plugin_options.php, (32) Savant2_Plugin_radios.php, (33) Savant2_Plugin_rating.php, or (34) Savant2_Plugin_textarea.php.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: savant-multiple-plugin-file-include(27906)

Hyperlink:http://xforce.iss.net/xforce/xfdb/27906

External Source: BID

Name: 19151

Hyperlink:http://www.securityfocus.com/bid/19151

External Source: BUGTRAQ

Name: 20060721 [Kurdish Security # 13] Savant2 Remote File Include Vulnerability [For Mambo, Joomla]

Type: Advisory; Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/440835/100/200/threaded

External Source: SECTRACK

Name: 1016560

Hyperlink:http://securitytracker.com/id?1016560

External Source: OSVDB

Name: 28712

Hyperlink:http://www.osvdb.org/28712

External Source: OSVDB

Name: 28711

Hyperlink:http://www.osvdb.org/28711

External Source: OSVDB

Name: 28710

Hyperlink:http://www.osvdb.org/28710

External Source: OSVDB

Name: 28709

Hyperlink:http://www.osvdb.org/28709

External Source: OSVDB

Name: 28708

Hyperlink:http://www.osvdb.org/28708

External Source: OSVDB

Name: 28707

Hyperlink:http://www.osvdb.org/28707

External Source: OSVDB

Name: 28706

Hyperlink:http://www.osvdb.org/28706

External Source: OSVDB

Name: 28705

Hyperlink:http://www.osvdb.org/28705

External Source: OSVDB

Name: 28704

Hyperlink:http://www.osvdb.org/28704

External Source: OSVDB

Name: 28703

Hyperlink:http://www.osvdb.org/28703

External Source: OSVDB

Name: 28702

Hyperlink:http://www.osvdb.org/28702

External Source: OSVDB

Name: 28701

Hyperlink:http://www.osvdb.org/28701

External Source: OSVDB

Name: 28700

Hyperlink:http://www.osvdb.org/28700

External Source: OSVDB

Name: 28699

Hyperlink:http://www.osvdb.org/28699

External Source: OSVDB

Name: 28698

Hyperlink:http://www.osvdb.org/28698

External Source: OSVDB

Name: 28697

Hyperlink:http://www.osvdb.org/28697

External Source: OSVDB

Name: 28696

Hyperlink:http://www.osvdb.org/28696

External Source: OSVDB

Name: 28695

Hyperlink:http://www.osvdb.org/28695

External Source: OSVDB

Name: 28694

Hyperlink:http://www.osvdb.org/28694

External Source: OSVDB

Name: 28693

Hyperlink:http://www.osvdb.org/28693

External Source: OSVDB

Name: 28692

Hyperlink:http://www.osvdb.org/28692

External Source: OSVDB

Name: 28691

Hyperlink:http://www.osvdb.org/28691

External Source: OSVDB

Name: 28690

Hyperlink:http://www.osvdb.org/28690

External Source: OSVDB

Name: 28689

Hyperlink:http://www.osvdb.org/28689

External Source: OSVDB

Name: 28688

Hyperlink:http://www.osvdb.org/28688

External Source: OSVDB

Name: 28687

Hyperlink:http://www.osvdb.org/28687

External Source: OSVDB

Name: 28686

Hyperlink:http://www.osvdb.org/28686

External Source: OSVDB

Name: 28685

Hyperlink:http://www.osvdb.org/28685

External Source: OSVDB

Name: 28684

Hyperlink:http://www.osvdb.org/28684

External Source: OSVDB

Name: 28683

Hyperlink:http://www.osvdb.org/28683

External Source: OSVDB

Name: 28682

Hyperlink:http://www.osvdb.org/28682

External Source: OSVDB

Name: 28681

Hyperlink:http://www.osvdb.org/28681

External Source: OSVDB

Name: 28680

Hyperlink:http://www.osvdb.org/28680

External Source: OSVDB

Name: 28679

Hyperlink:http://www.osvdb.org/28679

External Source: SREASON

Name: 1324

Hyperlink:http://securityreason.com/securityalert/1324