VisualShapers EZContents 1.4.5 - File Disclosure

EDB-ID:

30851

CVE:

N/A


Author:

p4imi0

Type:

webapps


Platform:

PHP

Date:

2007-12-05


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

source: https://www.securityfocus.com/bid/26737/info

VisualShapers ezContents is prone to a vulnerability that allows remote attackers to display the contents of arbitrary local files in the context of the webserver process.

An attacker can exploit this issue to retrieve potentially sensitive information that may aid in further attacks.

This issue affects ezContents 1.4.5; other versions may also be vulnerable. 

http://www.example.com/ezcontents1_4x/index.php?link=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd