CVE-2008-2905: PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mamb...

Security readout for executives and security teams

This flaw affects old Mambo installations using the Cache_Lite package. If PHP register_globals is enabled, an attacker may be able to make the server load remote PHP code and run it. That can lead to full site compromise, but the provided sources do not show current active exploitation. Exposure is most likely on legacy internet-facing Mambo 4.6.4 or earlier sites with PHP register_globals enabled and the vulnerable Cache_Lite file present. Treat exposed legacy Mambo sites as urgent remediation candidates. The business risk is site takeover, but urgency depends on whether the vulnerable version and PHP setting are actually present. Mitigation focus: Identify and retire unsupported Mambo 4.6.4 or earlier deployments.; Disable PHP register_globals where any legacy PHP remains.; Check vendor or archival project guidance for fixed releases or safe migration paths..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.