CVE:CVE-2006-4286
CNNVD:CNNVD-200608-358
**有争议**Mambo软件的contentpublisher组件(com_contentpublisher) 中contentpublisher.php脚本存在PHP远程文件包含漏洞，远程攻击者可借助mosConfig_absolute_path参数中的URL执行任意PHP代码。注：第三方对此问题存在争议，称大多数近期版本中的contentpublisher.php脚本不支持直接请求。最初的研究人员提供的信息常常有误。
solution:Upgrade mambo mambo to a higher version than 4.0.14,4.5.0.2,4.5.1.3,4.5.1_1.0.9,4.5.1a,4.5.1a:a,4.5.1a:beta,4.5.1a:beta_2,4.5.2,4.5.2.1,4.5.2.2,4.5.2.3,4.5.3h,4.5.3h:h,4.5_1.0.0,4.5_1.0.1,4.5_1.0.2,4.5_1.0.3_beta,4.5_1.0.3_beta:beta,4.5_1.0.9,4.6:rc1,and avoid the version 4.0.14,4.5.0.2,4.5.1.3,4.5.1_1.0.9,4.5.1a,4.5.1a:a,4.5.1a:beta,4.5.1a:beta_2,4.5.2,4.5.2.1,4.5.2.2,4.5.2.3,4.5.3h,4.5.3h:h,4.5_1.0.0,4.5_1.0.1,4.5_1.0.2,4.5_1.0.3_beta,4.5_1.0.3_beta:beta,4.5_1.0.9,4.6:rc1