Mambo Site Server 4.0.11 - 'PHPInfo.php' Information Disclosure

Author: euronymous
type: webapps
platform: php
port: nan
date_added: 2002-12-12 
date_updated: 2012-10-19 
verified: 1 
codes: CVE-2002-2247;OSVDB-7509 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/6376/info

Mambo Site Server is a freely available, open source web content management tool. It is written in PHP, and available for Unix, Linux, and Microsoft Windows operating systems.

It has been reported that Mambo enables a script by default that may reveal sensitive information. The phpinfo.php script is packaged with Mambo, and installed by default in the administrator subdirectory. A remote user may use this script to gain information about the server, including path and environment information.

http://www.example.com/mambo/administrator/phpinfo.php