Mambo 4.5.2.3 Security Fix
--------------------------

These files contain code to block exploits that attempt to set a value
for the global used to indicate where code is to be loaded.  By doing
this, the exploits allow arbitrary code to be loaded from a web site
under the hacker's control.

Please install these files into the corresponding Mambo directories, i.e.
index.php and index2.php in the Mambo root, and index.php, index2.php and
index3.php into /administrator.

If you suffer an attack, please take care to be sure you have cleaned up
your site.  Because these attacks can run arbitrary PHP, it is possible
to install back door code.  It is also possible to steal information
about the configuration of the site.  If in doubt, it is best to reinstall
the site from a completely fresh state to ensure there is no code that
should not be there.  The database should be backed up before starting
on a rebuild.  Also take care to back up any non-static files, such as
a file repository.

The fixes will be incorporated into Mambo 4.5.3, which is expected to be
released by the end of November 2005.

21 November 2005.
