Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2004-0132

Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote web server, as demonstrated using (1) the GLOBALS[rootdp] parameter to db.php, or (2) the GLOBALS[language_home] parameter to archivednews.php, and a malicious version of lang_admin.php.

Published

2004-03-03T05:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application visualshapers ezcontents 1.40 Yes
Application visualshapers ezcontents 1.41 Yes
Application visualshapers ezcontents 1.42 Yes
Application visualshapers ezcontents 1.43 Yes
Application visualshapers ezcontents 1.44 Yes
Application visualshapers ezcontents 1.45 Yes
Application visualshapers ezcontents 1.45b Yes
Application visualshapers ezcontents 2.0.1 Yes
Application visualshapers ezcontents 2.0.2 Yes
Application visualshapers ezcontents 2.0_rc1 Yes
Application visualshapers ezcontents 2.0_rc2 Yes
Application visualshapers ezcontents 2.0_rc3 Yes
References