CVE-2008-7054
Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage,…
Does this matter?
Lower severity and a low EPSS score (7.04%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage, and (5) language_home parameters to modules/diary/showdiarydetail.php; (6) gsLanguage and (7) language_home parameters to modules/diary/submit_diary.php; (8) admin_home parameter to modules/news/news_summary.php; (9) nLink, (10) gsLanguage, and (11) language_home parameters to modules/news/inlinenews.php; and possibly other unspecified vectors in (12) diary/showeventlist.php, (13) gallery/showgallery.php, (14) reviews/showreviews.php, (15) gallery/showgallerydetails.php, (16) reviews/showreviewsdetails.php, (17) news/shownewsdetails.php, (18) gallery/submit_gallery.php, (19) guestbook/submit_guestbook.php, (20) reviews/submit_reviews.php, (21) news/submit_news.php, (22) diary/inlineeventlist.php, and (23) news/archivednews_summary.php in modules/, related to the lack of directory traversal protection in modules/moduleSec.php.
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 7.04% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- visualshapers/ezcontents
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/31606Vendor Advisory
- http://www.osvdb.org/47773Exploit
- http://www.osvdb.org/47774Exploit
- http://www.osvdb.org/47775Exploit
- http://www.osvdb.org/47776Exploit
- http://www.osvdb.org/47777Exploit
- http://www.securityfocus.com/archive/1/495705/100/100/threaded
- http://www.securityfocus.com/bid/30821Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44665
- https://www.exploit-db.com/exploits/6301
- http://secunia.com/advisories/31606Vendor Advisory
- http://www.osvdb.org/47773Exploit
- http://www.osvdb.org/47774Exploit
- http://www.osvdb.org/47775Exploit
- http://www.osvdb.org/47776Exploit
- http://www.osvdb.org/47777Exploit
- http://www.securityfocus.com/archive/1/495705/100/100/threaded
- http://www.securityfocus.com/bid/30821Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44665
- https://www.exploit-db.com/exploits/6301
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.