CVE-2006-3302: PHP remote file inclusion vulnerability in mod_cbsms.php in CBSMS Mambo Module 1.0 and earlier, when regist...

Security readout for executives and security teams

This is a legacy PHP remote file inclusion issue in CBSMS Mambo Module 1.0 and earlier. If an old Mambo site still runs this module with PHP register_globals enabled, an attacker could make the server run attacker-supplied PHP code. Public evidence is sparse and the CVE notes uncertain provenance. Exposure is most likely limited to legacy Mambo deployments using CBSMS Mambo Module 1.0 or earlier with register_globals enabled. Modern stacks are unlikely to be affected unless they preserve old PHP behavior or archived application code. Prioritize if the organization still hosts old Mambo/PHP applications. The business risk is potentially high because the described outcome is arbitrary PHP execution, but urgency depends on whether the obsolete module and register_globals are actually present. Mitigation focus: Check vendor or project archives for any CBSMS module guidance or replacement.; Disable PHP register_globals wherever legacy PHP is still running.; Remove or disable the CBSMS Mambo module if it is no longer required..

Prepared

Jun 29, 2026, 11:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.