index2.php in Mambo Site Server 3.0.0 through 3.0.5 allows remote attackers to gain Mambo…
Priority MEDIUM 50Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
index2.php in Mambo Site Server 3.0.0 through 3.0.5 allows remote attackers to gain Mambo administrator privileges by setting the PHPSESSID parameter and providing the appropriate administrator information in other parameters.
Why it matters now
EPSS 0.04425 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mambo:mambo_site_server:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Mambo |
| cpe:2.3:a:mambo:mambo_site_server:3.0.1:*:*:*:*:*:*:* | 3.0.1 | Vulnerable | Mambo |
| cpe:2.3:a:mambo:mambo_site_server:3.0.2:*:*:*:*:*:*:* | 3.0.2 | Vulnerable | Mambo |
| cpe:2.3:a:mambo:mambo_site_server:3.0.3:*:*:*:*:*:*:* | 3.0.3 | Vulnerable | Mambo |
| cpe:2.3:a:mambo:mambo_site_server:3.0.4:*:*:*:*:*:*:* | 3.0.4 | Vulnerable | Mambo |
| cpe:2.3:a:mambo:mambo_site_server:3.0.5:*:*:*:*:*:*:* | 3.0.5 | Vulnerable | Mambo |
- cpe:2.3:a:mambo:mambo_site_server:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Mambo
- cpe:2.3:a:mambo:mambo_site_server:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Mambo
- cpe:2.3:a:mambo:mambo_site_server:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Mambo
- cpe:2.3:a:mambo:mambo_site_server:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Mambo
- cpe:2.3:a:mambo:mambo_site_server:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Mambo
- cpe:2.3:a:mambo:mambo_site_server:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Mambo
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2001-1011
- 2026-10-03 Alias added: GHSA-mhg7-pmrq-c6wj
References
More Mambo Site Server vulnerabilities
- TI-2002-02202 Mambo Site Server 4.0.11 installs with a default username and password of admin, which… CVSS 2.0HIGH 10.0
- TI-2002-01583 Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.11 allow… CVSS 2.0MEDIUM 6.8
- TI-2002-02159 The administrator/phpinfo.php script in Mambo Site Server 4.0.11 allows remote attackers… CVSS 2.0MEDIUM 5.0
- TI-2003-01105 Cross-site scripting (XSS) vulnerability in index.php for Mambo Site Server 4.0.10 allows… CVSS 2.0MEDIUM 4.3
- TI-2007-04593 Multiple cross-site scripting (XSS) vulnerabilities in the AkoBook 3.42 and earlier… CVSS 2.0MEDIUM 4.3
- TI-2005-03532 globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled… CVSS 2.0LOW 2.6
Sources
- CVE-2001-1011 · CVE Program
- CVE-2001-1011 · NVD
- FIRST EPSS
- GHSA-mhg7-pmrq-c6wj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences