CVE-2008-6221

This component works like an unlocked back door built into an old email add-on for Joomla! websites. Anyone on the internet can walk through that door and plant their own instructions on your server — no password needed. Once inside, they can control the whole website, not just the mail feature.

This matters to you if your website runs Joomla! with the Dada Mail Manager (com_dadamail) component, version 2.6 specifically. It affects the site by default if the component is installed — there's no login or special configuration required for an attacker to exploit it.

Working exploit code for this flaw is publicly available, which means attackers don't need special skill to use it — but there is no confirmed evidence of active, ongoing attacks against current targets right now. Given the public exploit code and the no-login, full-takeover nature of the flaw, you should treat this as a priority to check and fix soon rather than an emergency requiring immediate downtime.

Confirm exposure by identifying whether the Joomla! installation has the com_dadamail component (version 2.6) present, typically under /components/com_dadamail/. There is no vendor-supplied patched version documented for this component; the Secunia advisory (32551) notes remediation guidance but the practical fix is to remove or disable the vulnerable component entirely, since Dada Mail Manager for Joomla! is a long-abandoned third-party extension. As a temporary workaround if immediate removal isn't possible, block external access to config.dadamail.php via web server rules (e.g., deny access to that file path) and restrict the GLOBALS[mosConfig_absolute_path] parameter at the WAF level. Monitor web server logs for requests manipulating path or URL parameters targeting this file, and audit for any unexpected PHP files dropped on the server that would indicate prior successful exploitation. Given the age of this vulnerability (2008) and the component's abandonment, migrating to a currently maintained mail extension is the recommended long-term path.

CVSS 7.5 (High), vector AV:N/AC:L/Au:N/C:P/I:P/A:P, reflecting network-exploitable, low-complexity, no-authentication compromise of confidentiality, integrity, and availability. Weakness class is CWE-94 (Code Injection), specifically a PHP Remote File Inclusion (RFI) via the unsanitized GLOBALS[mosConfig_absolute_path] parameter in config.dadamail.php. Not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no confirmed in-the-wild exploitation has been reported. Exploit maturity is notable: two public exploits exist, increasing ease of weaponization. EPSS scoring places this in a high percentile among all scored vulnerabilities with a falling trend, consistent with an old, well-known flaw that saw attention but is not currently a leading active-exploitation target.