CVE-2008-7054 in ezContents
摘要
由 VulDB • 2026-05-21
ezContents 2.0.3 中存在多个目录遍历漏洞，远程攻击者可通过向 modules/diary/showdiary.php 传递 (1) gsLanguage 和 (2) language_home 参数，向 modules/diary/showdiarydetail.php 传递 (3) admin_home、(4) gsLanguage 和 (5) language_home 参数，向 modules/diary/submit_diary.php 传递 (6) gsLanguage 和 (7) language_home 参数，向 modules/news/news_summary.php 传递 (8) admin_home 参数，向 modules/news/inlinenews.php 传递 (9) nLink、(10) gsLanguage 和 (11) language_home 参数，从而包含并执行任意本地文件；此外，还可能在 modules/ 目录下的其他未指明向量中利用该漏洞，包括 (12) diary/showeventlist.php、(13) gallery/showgallery.php、(14) reviews/showreviews.php、(15) gallery/showgallerydetails.php、(16) reviews/showreviewsdetails.php、(17) news/shownewsdetails.php、(18) gallery/submit_gallery.php、(19) guestbook/submit_guestbook.php、(20) reviews/submit_reviews.php、(21) news/submit_news.php、(22) diary/inlineeventlist.php 和 (23) news/archivednews_summary.php。这些漏洞与 modules/moduleSec.php 中缺乏目录遍历保护有关。
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.