$ cve CVE-2006-3340 JSON

CVE-2006-3340 EXPLOIT

5.1

MEDIUM · CVSS 2.0 · EPSS 15.6% (pctl 97)

Patch early

A public exploit exists.

Description

Multiple PHP remote file inclusion vulnerabilities in Pearl For Mambo module 1.6 for Mambo, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the (1) phpbb_root_path parameter in (a) includes/functions_cms.php and the (2) GlobalSettings[templatesDirectory] parameter in multiple files in the "includes" directory including (b) adminSensored.php, (c) adminBoards.php, (d) adminAttachments.php, (e) adminAvatars.php, (f) adminBackupdatabase.php, (g) adminBanned.php, (h) adminForums.php, (i) adminPolls.php, (j) adminSmileys.php, (k) poll.php, and (l) move.php.

Scoring

CVSS	5.1 (MEDIUM, v2.0)
Vector	AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS	15.6% — more likely to be exploited than 97% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-07-03
Last modified	2026-06-16

Affected (1)

Vendor	Product
pearlinger	pearl for mambo

Public exploits

Source	Title	Date
exploit-db	Mambo Component Pearl 1.6 - Multiple Remote File Inclusions	2006-06-27

References

→ the Explorer · watch your stack · NVD