Published: 03/03/2004 Updated: 11/07/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 760

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and previous versions allow remote malicious users to execute arbitrary PHP code from a remote web server, as demonstrated using (1) the GLOBALS[rootdp] parameter to db.php, or (2) the GLOBALS[language_home] parameter to archivednews.php, and a malicious version of lang_admin.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
visualshapers ezcontents 1.44
visualshapers ezcontents 1.45
visualshapers ezcontents 1.45b
visualshapers ezcontents 2.0.1
visualshapers ezcontents 1.42
visualshapers ezcontents 1.43
visualshapers ezcontents 2.0_rc2
visualshapers ezcontents 2.0_rc3
visualshapers ezcontents 1.40
visualshapers ezcontents 1.41
visualshapers ezcontents 2.0.2
visualshapers ezcontents 2.0_rc1

source: wwwsecurityfocuscom/bid/9638/info It has been reported that ezContents may be prone to a file include vulnerability in multiple modules The problem reportedly exists because remote users may influence the 'GLOBALS[rootdp]' and 'GLOBALS[language_home]' variables in the 'dbphp' and 'archivednewsphp' modules This vulnerability ...

NVD-CWE-Other http://marc.info/?l=bugtraq&m=107651585921958&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/15135 https://nvd.nist.gov https://www.exploit-db.com/exploits/23684/

CVE-2004-0132

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect