Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage, and (5) language_home parameters to modules/diary/showdiarydetail.php; (6) gsLanguage and (7) language_home parameters to modules/diary/submit_diary.php; (8) admin_home parameter to modules/news/news_summary.php; (9) nLink, (10) gsLanguage, and (11) language_home parameters to modules/news/inlinenews.php; and possibly other unspecified vectors in (12) diary/showeventlist.php, (13) gallery/showgallery.php, (14) reviews/showreviews.php, (15) gallery/showgallerydetails.php, (16) reviews/showreviewsdetails.php, (17) news/shownewsdetails.php, (18) gallery/submit_gallery.php, (19) guestbook/submit_guestbook.php, (20) reviews/submit_reviews.php, (21) news/submit_news.php, (22) diary/inlineeventlist.php, and (23) news/archivednews_summary.php in modules/, related to the lack of directory traversal protection in modules/moduleSec.php.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.securityfocus.com/archive/1/495705/100/100/threaded | mailing-list x_refsource_BUGTRAQ |
| http://www.osvdb.org/47777 | vdb-entry x_refsource_OSVDB |
| http://www.osvdb.org/47773 | vdb-entry x_refsource_OSVDB |
| https://www.exploit-db.com/exploits/6301 | exploit x_refsource_EXPLOIT-DB |
| http://secunia.com/advisories/31606 | third-party-advisory x_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/44665 | vdb-entry x_refsource_XF |
| http://www.osvdb.org/47776 | vdb-entry x_refsource_OSVDB |
| http://www.osvdb.org/47775 | vdb-entry x_refsource_OSVDB |
| http://www.securityfocus.com/bid/30821 | vdb-entry x_refsource_BID |
| http://www.osvdb.org/47774 | vdb-entry x_refsource_OSVDB |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.securityfocus.com/archive/1/495705/100/100/threaded | mailing-list x_refsource_BUGTRAQ x_transferred |
| http://www.osvdb.org/47777 | vdb-entry x_refsource_OSVDB x_transferred |
| http://www.osvdb.org/47773 | vdb-entry x_refsource_OSVDB x_transferred |
| https://www.exploit-db.com/exploits/6301 | exploit x_refsource_EXPLOIT-DB x_transferred |
| http://secunia.com/advisories/31606 | third-party-advisory x_refsource_SECUNIA x_transferred |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/44665 | vdb-entry x_refsource_XF x_transferred |
| http://www.osvdb.org/47776 | vdb-entry x_refsource_OSVDB x_transferred |
| http://www.osvdb.org/47775 | vdb-entry x_refsource_OSVDB x_transferred |
| http://www.securityfocus.com/bid/30821 | vdb-entry x_refsource_BID x_transferred |
| http://www.osvdb.org/47774 | vdb-entry x_refsource_OSVDB x_transferred |