CVE:CVE-2006-3340
CNNVD:CNNVD-200607-004
Mambo是免费的功能强大的开放源码内容管理系统，Pearl For Mambo是可以无缝的集成于Mambo的一个组件。
Pearl For Mambo允许远程攻击者使用phpbb_root_path或GlobalSettings[templatesDirectory]参数向多个脚本发送特制的URL请求，导致指定远程系统的恶意文件，在有漏洞的系统上执行任意代码。
以下脚本受这个漏洞影响：
includes/functions_cms.php
includes/adminSensored.php
includes/adminBoards.php
includes/adminAttachments.php
includes/adminAvatars.php
includes/adminBackupdatabase.php
includes/adminBanned.php
includes/adminForums.php
includes/adminPolls.php
includes/adminSmileys.php
includes/poll.php
includes/move.php
solution:Upgrade pearlinger pearl_for_mambo to a higher version than 1.5,1.6,and avoid the version 1.5,1.6