CVE-2005-3738: Mambo Site Server

Low severity, CVSS 2.6. EPSS: 4.9% chance of exploitation in the next 30 days.

globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfig_absolute_path parameter to content.html.php for remote PHP file inclusion.

Affected products

• Mambo Mambo Site Server: version 4.0 only; version 4.0.10 only; version 4.0.11 only; version 4.0.12 only; version 4.0.12_beta only; version 4.0.12_beta_2 only; …

Published 2005-11-22. Last modified 2026-06-16.