CVE-2008-7055
ezContents 2.0.3 - Remote File Inclusion via Doubled Dot Dot Slash in Link Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-7055. PoCs published by DSecRG.
AI-analyzed exploit summary This advisory details multiple Local File Include (LFI) vulnerabilities in ezContents CMS version 2.0.3. The vulnerabilities stem from insufficient input validation in parameters like 'link', 'rootdp', and 'gsLanguage', allowing attackers to include arbitrary local files.
Description
module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" (doubled dot dot slash) sequences in the link parameter, which is not properly filtered using the str_replace function.
Exploits (1)
This advisory details multiple Local File Include (LFI) vulnerabilities in ezContents CMS version 2.0.3. The vulnerabilities stem from insufficient input validation in parameters like 'link', 'rootdp', and 'gsLanguage', allowing attackers to include arbitrary local files.