CVE-2006-6634

Vulnerability

Multiple PHP remote file inclusion vulnerabilities exist in the ExtCalThai component for Mambo, versions 0.9.1 and earlier. Attackers can exploit these by providing a crafted URL in specific parameters, such as CONFIG_EXT[LANGUAGES_DIR] in admin_events.php, mosConfig_absolute_path in extcalendar.php, or CONFIG_EXT[LIB_DIR] in lib/mail.inc.php [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable component. The attacker needs to control the value of one of the vulnerable parameters, such as CONFIG_EXT[LANGUAGES_DIR], and point it to a remote file that they control, for example, a web shell disguised as an image file [1].

Impact

Successful exploitation of these vulnerabilities allows a remote attacker to execute arbitrary PHP code on the server. This can lead to a compromise of the application and potentially the underlying system, with the attacker gaining the privileges of the web server process.

Mitigation

ExtCalThai versions 0.9.1 and prior are affected. No specific patched version or release date is available in the provided references. It is recommended to remove or disable the ExtCalThai component if it is not actively maintained or updated. Other versions may also be affected [1].