Vulnerability Report

CVE-2011-2917

Title: Mambo-Foundation Mambo Injection (SQLi/OSi)

SQLi

Proof Of Concept

PoC Available for CVE-2011-2917

CWE Category CWE-89
Published Date Dec 08, 2011
Modified Date Apr 29, 2026
Exploit Status Available
Score 7.5 CVSS v2.0
Exploit Probability (EPSS)
1.07%

Vulnerability Summary

CVE-2011-2917: SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter.

Impacted Vendors

M
mambo-foundation 1

Reference Links

http://www.exploit-db.com/exploits/18110 http://www.openwall.com/lists/oss-security/2011/08/12/6 http://www.osvdb.org/74502 http://www.securityfocus.com/bid/49130 http://yehg.net/lab/pr0js/advisories/%5Bmambo4.6_x%5D_sql_injection http://www.exploit-db.com/exploits/18110 http://www.openwall.com/lists/oss-security/2011/08/12/6 http://www.osvdb.org/74502 http://www.securityfocus.com/bid/49130 http://yehg.net/lab/pr0js/advisories/%5Bmambo4.6_x%5D_sql_injection
CVSS v2.0
Source Entity [email protected]
Severity HIGH
7.5
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2011-2917 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/18110
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.