Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Mambo ExtCalThai component lets attackers run code

CVE-2006-6634 · published 19 years ago
Summary

The ExtCalThai add‑on for Mambo (versions 0.9.1 and earlier) can be tricked into loading files from a remote website. An attacker could then cause the server to execute any PHP code they provide, potentially taking control of the site. Update the component to a patched version or remove it if it is no longer needed, and check your site for any unauthorized changes.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mambo extcalthai_module <= 0.9.1
cpe:2.3:a:mambo:extcalthai_module:*:*:*:*:*:*:*:*
Original advisory text
Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai (com_extcalendar) 0.9.1 and earlier component for Mambo allow remote attackers to execute arbitrary PHP code via a URL in (1) th...
Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai (com_extcalendar) 0.9.1 and earlier component for Mambo allow remote attackers to execute arbitrary PHP code via a URL in (1) the CONFIG_EXT[LANGUAGES_DIR] parameter to admin_events.php, (2) the mosConfig_absolute_path parameter to extcalendar.php, or (3) the CONFIG_EXT[LIB_DIR] parameter to lib/mail.inc.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Timeline
Published18 Dec 2006
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-6634 · NVD
Track software like this
Free during beta