CVE-2006-3995

UHP (User Home Pages) is a Joomla!/Mambo component that helps provide personal pages for users. This bug is like leaving a “remote file door” unlocked: an attacker can point the website to a malicious input (via a URL) that causes the server to run harmful PHP code. If you use this component, the attacker’s goal is often to take over the site, steal data, or disrupt service.

This matters if you run the UHP (User Home Pages) component for Mambo or Joomla! on your server. Because the vulnerability does not require authentication, any attacker who can reach the affected UHP endpoints could potentially exploit it when the component is present and reachable. Reachability depends on whether the UHP pages/parameters are exposed through your web-accessible configuration (the findings don’t confirm which default setups are reachable).

This is an AMBER issue: there are public exploits available, and the attacker does not need to log in. That combination means you should treat this as actively exploitable if your UHP component is installed and reachable. Move quickly to patch or disable the affected UHP component to reduce the risk of remote code execution.

Confirm exposure

1. Identify whether this site uses the UHP (User Home Pages) component for Mambo or Joomla!
   • Look for UHP-specific files like uhp_config.php, uhp.class.php, or installation/admin-related UHP files (the advisory lists multiple UHP files that may be involved).
2. Confirm the component is active and web-accessible
   • Check whether any UHP pages or entry points are reachable from the public internet (for example, any UHP configuration, toolbar, install/uninstall, or user-home-page features).

Determine whether you’re vulnerable

3. Check the UHP component version against the vendor remediation referenced in the findings
   • The findings do not provide an explicit “fixed version number,” so the correct approach is to follow the remediation guidance in:
     • Secunia advisory 21305
     • OSVDB 27651

Remediate

4. Patch
   • Apply the remediation described in Secunia advisory 21305 / OSVDB 27651 for UHP (User Home Pages).
5. If patching is delayed, reduce exposure immediately
   • Disable or remove the UHP component from the site until remediation is complete.
   • Ensure any UHP admin/install/uninstall endpoints are not accessible publicly.

After changes

6. Monitor for signs of compromise
   • Review web server logs for suspicious requests hitting UHP endpoints or parameters related to the inclusion behavior.
   • If you see any suspicious activity, treat it as a potential compromise and follow your incident response process.

KEV / exploitation note

• This CVE is not listed in CISA KEV in the provided findings; however, public exploits exist, so assume exploitation is possible if your environment is reachable.

CVE-2006-3995 is a set of “remote file inclusion” issues (CWE-94) affecting the UHP (User Home Pages) component for Mambo or Joomla! Multiple UHP PHP files (including uhp_config.php and possibly footer.php, functions.php, install.uhp.php, toolbar.uhp.html.php, uhp.class.php, and uninstall.uhp.php) can be abused so that an attacker supplies a malicious URL that leads the server to include/execute attacker-controlled PHP code.

Attack prerequisites and reachability:

• The findings state authentication is not required.
• Whether it is reachable in default configurations is not confirmed in the provided findings; exploitation depends on whether the relevant UHP URL/parameter is accessible from the network.

Exploitation status and maturity:

• Public exploits are available (4 known), indicating the bug is practically weaponized.
• KEV is not listed, so the findings do not confirm CISA-verified exploitation.

EPSS:

• A prediction is provided in the findings, but it should not be used to drive urgency in the presence of known public exploits.

Overall: this is a remote code execution-style outcome via unsafe handling of a URL parameter (notably mosConfig_absolute_path per the backstop), making patching or disabling the vulnerable component the appropriate risk reduction step.