CVE-2006-4859

published 2006-09-19

CVE-2006-4859: Unrestricted file upload vulnerability in contact.html.php in the Contact (com_contact) component in Limbo (aka Lite Mambo) CMS 1.0.4.2L and earlier allows…

Priority P3 45 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Unrestricted file upload vulnerability in contact.html.php in the Contact (com_contact) component in Limbo (aka Lite Mambo) CMS 1.0.4.2L and earlier allows remote attackers to upload PHP code to the images/contact folder via a filename with a double extension in the contact_attach parameter in a contact option in index.php, which bypasses an insufficiently restrictive regular expression.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
limbo_cms	limbo_cms	—	—
limbo_cms	limbo_cms	—	—
limbo_cms	limbo_cms	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.