VulnerabilityModified
CVE-2008-7055
module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" (doubled dot dot slash) sequences in the link parameter, which is not properly…
MEDIUM 5.1EPSS 2.00%
Does this matter?
Lower severity and a low EPSS score (2.00%). Track it; it rarely justifies an emergency change on its own.
Description
module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" (doubled dot dot slash) sequences in the link parameter, which is not properly filtered using the str_replace function.
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 2.00% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- visualshapers/ezcontents
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/31606Vendor Advisory
- http://www.securityfocus.com/archive/1/495705/100/100/threaded
- http://www.securityfocus.com/bid/30821Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44663
- https://www.exploit-db.com/exploits/6301
- http://secunia.com/advisories/31606Vendor Advisory
- http://www.securityfocus.com/archive/1/495705/100/100/threaded
- http://www.securityfocus.com/bid/30821Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44663
- https://www.exploit-db.com/exploits/6301
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.