PT-2009-2524 · Ez · Ezcontents

Zero_X · Published 2009-08-24 · Updated 2018-10-11 · CVE-2008-7055

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ezContents version 2.0.3

Description The issue allows remote attackers to bypass directory traversal protection and include and execute arbitrary local files. This is achieved by using "....//" (doubled dot dot slash) sequences in the link parameter, which is not properly filtered using the str replace function.

Recommendations For ezContents version 2.0.3, consider temporarily restricting access to the module.php file until a proper fix is applied, and ensure that the link parameter is properly sanitized to prevent directory traversal attacks.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-7055

Affected Products

Ezcontents

References · 6

• 🔥 https://exploit-db.com/exploits/6301 · Exploit
• 🔥 http://securityfocus.com/bid/30821 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7055 · Security Note
• http://secunia.com/advisories/31606 · Vendor Advisory
• http://securityfocus.com/archive/1/495705/100/100/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44663 · Note