PT-2009-2524 · Ez · Ezcontents

Zero_X · Publicado 2009-08-24 · Atualizado 2018-10-11 · CVE-2008-7055

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ezContents version 2.0.3

Description The issue allows remote attackers to bypass directory traversal protection and include and execute arbitrary local files. This is achieved by using "....//" (doubled dot dot slash) sequences in the link parameter, which is not properly filtered using the str replace function.

Recommendations For ezContents version 2.0.3, consider temporarily restricting access to the module.php file until a proper fix is applied, and ensure that the link parameter is properly sanitized to prevent directory traversal attacks.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-7055

Produtos afetados

Ezcontents

Referências · 6

• 🔥 https://exploit-db.com/exploits/6301 · Exploit
• 🔥 http://securityfocus.com/bid/30821 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7055 · Nota de Segurança
• http://secunia.com/advisories/31606 · Aviso do Fabricante
• http://securityfocus.com/archive/1/495705/100/100/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44663 · Nota