CVE ID:	CVE-2005-3738
Description:	globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfig_absolute_path parameter to content.html.php for remote PHP file inclusion.
Test IDs:	1.3.6.1.4.1.25623.1.0.55940
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2005-3738 BugTraq ID: 15461 http://www.securityfocus.com/bid/15461 Bugtraq: 20051118 Mambo 0day Exploit out in the wild - mambo/skype hacked (Google Search) http://www.securityfocus.com/archive/1/417215 Bugtraq: 20060307 PHP-based CMS mass-exploitation (Google Search) http://www.securityfocus.com/archive/1/426942/100/0/threaded Bugtraq: 20060308 RE: [Full-disclosure] PHP-based CMS mass-exploitation (Google Search) http://www.securityfocus.com/archive/1/427196/100/0/threaded http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0520.html http://securitytracker.com/id?1015258 http://secunia.com/advisories/17622 http://www.vupen.com/english/advisories/2005/2473