CVE-2008-7055 Path traversal in n/a

What is CVE-2008-7055?

CVE-2008-7055 is a medium-severity path traversal vulnerability in n/a, published on 24 Aug 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" (doubled dot dot slash) sequences in the link parameter, which is not properly filtered using the str_replace function.

Weakness: CWE-22

Which versions are affected by CVE-2008-7055?

It affects 1 product.

Products include Visualshapers Ezcontents.

How do I fix CVE-2008-7055?

No fix has been published for CVE-2008-7055 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2008-7055 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-7055 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2008-2135 SQL injection in n/a High 7.5
• CVE-2006-4477 Code injection in n/a High 7.5
• CVE-2006-4478 SQL injection in n/a High 7.5
• CVE-2003-1214 Auth bypass in n/a High 7.5
• CVE-2004-0070 Code injection in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x93g-j874-2hqr.