CVE-2008-7054

Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage, and (5) language_home parameters to modules/diary/showdiarydetail.php; (6) gsLanguage and (7) language_home parameters to modules/diary/submit_diary.php; (8) admin_home parameter to modules/news/news_summary.php; (9) nLink, (10) gsLanguage, and (11) language_home parameters to modules/news/inlinenews.php; and possibly other unspecified vectors in (12) diary/showeventlist.php, (13) gallery/showgallery.php, (14) reviews/showreviews.php, (15) gallery/showgallerydetails.php, (16) reviews/showreviewsdetails.php, (17) news/shownewsdetails.php, (18) gallery/submit_gallery.php, (19) guestbook/submit_guestbook.php, (20) reviews/submit_reviews.php, (21) news/submit_news.php, (22) diary/inlineeventlist.php, and (23) news/archivednews_summary.php in modules/, related to the lack of directory traversal protection in modules/moduleSec.php.

• CWE-22

• http://secunia.com/advisories/31606Vendor Advisory
• http://www.osvdb.org/47773Exploit
• http://www.osvdb.org/47774Exploit
• http://www.osvdb.org/47775Exploit
• http://www.osvdb.org/47776Exploit
• http://www.osvdb.org/47777Exploit
• http://www.securityfocus.com/archive/1/495705/100/100/threaded
• http://www.securityfocus.com/bid/30821Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44665
• https://www.exploit-db.com/exploits/6301
• http://secunia.com/advisories/31606Vendor Advisory
• http://www.osvdb.org/47773Exploit
• http://www.osvdb.org/47774Exploit
• http://www.osvdb.org/47775Exploit
• http://www.osvdb.org/47776Exploit
• http://www.osvdb.org/47777Exploit
• http://www.securityfocus.com/archive/1/495705/100/100/threaded
• http://www.securityfocus.com/bid/30821Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44665
• https://www.exploit-db.com/exploits/6301

Published

Aug 24, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-7048Multiple cross-site scripting (XSS) vulnerabilities in Natte…
• CVE-2008-7049Multiple SQL injection vulnerabilities in login.asp in Natte…
• CVE-2008-7050The password_check function in auth/auth_phpbb3.php in WoW R…
• CVE-2008-7051AJ Square AJ Article allows remote attackers to bypass authe…
• CVE-2008-7052Unrestricted file upload vulnerability in profile.php in Pre…
• CVE-2008-7053LogMeIn Remote Access Utility ActiveX control (RACtrl.dll) a…
• CVE-2008-7055module.php in ezContents 2.0.3 allows remote attackers to by…
• CVE-2008-7056BandSite CMS 1.1.4 does not perform access control for admin…
• CVE-2008-7057Cross-site scripting (XSS) vulnerability in merchandise.php …
• CVE-2008-7058Cross-site request forgery (CSRF) vulnerability in BandSite …
• CVE-2008-7059SQL injection vulnerability in index.php in One-News Beta 2 …
• CVE-2008-7060Multiple cross-site scripting (XSS) vulnerabilities in One-N…