Mambo Security Problems

Hackers (read as cracker) attacking on unpatched versions of the Mambo content management system that can be used to build botnets for use in phishing scams and distributed denial of service (DDoS) attacks.

They are using PHP-based CMS mass-exploitation and other vulnerabilities in open source CMS applications. If you are in server, collocation businesses then watch out all these attacks.

Update Mambo as soon as possible. More information available at following sites:

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 2 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersdf ncdu pydf
File Managementcat cp mkdir tree
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
2 comments… add one
  • Harka May 30, 2008 @ 7:19

    The issue for webhosters is a bit more complex. Generally the customers install these CMS themselves and if they don’t keep it up-to-date then nobody will. Couple that with the general “My uploaded pictures aren’t showing up…chmod 777 the whole directory tree for me!” attitude and next thing you know, you have phishing sites and DoS perl scripts running.

    The issue is multifold:

    1. As webhoster how do you even find out what CMS are installed and what version do they run at? Here scripts are badly needed to collect that information.

    2. If you do find an insecure installation, you may not even know whom the domain in question belongs to and/or how to contact the owner…a common issue on a server with resellers who create domains on their own. Also, what procedure do you follow, if you do manage to contact the customer, but they don’t respond or don’t know how to do an update?

    3. The issue of securely installing and updating CMS systems is inadequately addressed by many a documentation. Most do not take such issues into account, that on servers you generally have one username for FTP but another for the Apache process, which the CMS will then also use for its created files/directories. This results in a ownership/permission conflict, which end-users as well as datacenter admins usually “fix” with liberal 777’s. This point alone is a *major* factor and addressing it properly (without interfering with things like Cpanel, Plesk etc) could drastically reduce insecure installations of CMS systems.

    Would love to know how other admins deal with these issues (the above was just off-the-top of my head)!

  • Elpie Sep 23, 2009 @ 5:58

    Please update the link for Mambo. Mambo moved from to its official home on in 2006. Updating your link will ensure people don’t go from this article to a dead site that is not related to the Mambo open source CMS project.

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum