CVE-2004-0132
ezContents <= 2.0.2 - Remote File Inclusion via GLOBALS Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-0132. PoCs published by Cedric Cochin.
AI-analyzed exploit summary The exploit describes a file inclusion vulnerability in ezContents due to improper handling of the 'GLOBALS[rootdp]' and 'GLOBALS[language_home]' variables in 'db.php' and 'archivednews.php'. It allows remote attackers to include arbitrary files by manipulating these variables.
Description
Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote web server, as demonstrated using (1) the GLOBALS[rootdp] parameter to db.php, or (2) the GLOBALS[language_home] parameter to archivednews.php, and a malicious version of lang_admin.php.
Exploits (2)
The exploit describes a file inclusion vulnerability in ezContents due to improper handling of the 'GLOBALS[rootdp]' and 'GLOBALS[language_home]' variables in 'db.php' and 'archivednews.php'. It allows remote attackers to include arbitrary files by manipulating these variables.
The exploit describes a file inclusion vulnerability in ezContents due to improper handling of the 'GLOBALS[rootdp]' and 'GLOBALS[language_home]' variables in 'db.php' and 'archivednews.php'. An attacker can manipulate these variables to include remote files, potentially leading to arbitrary code execution.