Exploitation Summary
EIP tracks 1 public exploit for CVE-2008-7054. PoCs published by DSecRG.
AI-analyzed exploit summary This advisory details multiple Local File Include (LFI) vulnerabilities in ezContents CMS version 2.0.3. The vulnerabilities stem from insufficient input validation in parameters like 'link', 'rootdp', and 'gsLanguage', allowing attackers to include arbitrary local files.
Description
Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage, and (5) language_home parameters to modules/diary/showdiarydetail.php; (6) gsLanguage and (7) language_home parameters to modules/diary/submit_diary.php; (8) admin_home parameter to modules/news/news_summary.php; (9) nLink, (10) gsLanguage, and (11) language_home parameters to modules/news/inlinenews.php; and possibly other unspecified vectors in (12) diary/showeventlist.php, (13) gallery/showgallery.php, (14) reviews/showreviews.php, (15) gallery/showgallerydetails.php, (16) reviews/showreviewsdetails.php, (17) news/shownewsdetails.php, (18) gallery/submit_gallery.php, (19) guestbook/submit_guestbook.php, (20) reviews/submit_reviews.php, (21) news/submit_news.php, (22) diary/inlineeventlist.php, and (23) news/archivednews_summary.php in modules/, related to the lack of directory traversal protection in modules/moduleSec.php.
Exploits (1)
This advisory details multiple Local File Include (LFI) vulnerabilities in ezContents CMS version 2.0.3. The vulnerabilities stem from insufficient input validation in parameters like 'link', 'rootdp', and 'gsLanguage', allowing attackers to include arbitrary local files.