Some vulnerabilities have been reported in Mambo LaiThai, some with an unknown impact and others, which can be exploited by malicious people to conduct SQL injection attacks or to compromise a vulnerable system.

1) A vulnerability is caused due to the use of a vulnerable copy of PHPMailer.

For more information:
SA25626

2) Input passed to unspecified parameters is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

3) Vulnerabilities are caused due to unknown errors in mod_login and mod_template_chooser. No further information is currently available.

The vulnerabilities are reported in version 4.5.5. Prior versions may also be affected.

Solution
Update to version 4.5.6.

Provided and/or discovered by
1) Originally reported in PHPMailer by Thor Larholm.
2, 3) Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://sourceforge.net/project/shownotes.php?release_id=571300

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area