← Vulnerability feed

Vulnerability record · CVE-2008-7054 · published 24 August 2009

CVE-2008-7054: Visualshapers ezcontents path traversal vulnerability

Visualshapers · Ezcontents

Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage, and (5) language_home parameters to modules/diary/showdiarydetail.php; (6) gsLanguage and (7) language_home parameters to modules/diary/submit_diary.php; (8) admin_home parameter to modules/news/news_summary.php; (9) nLink, (10) gsLanguage, and (11) language_home parameters to modules/news/inlinenews.php; and possibly other unspecified vectors in (12) diary/showeventlist.php, (13) gallery/showgallery.php, (14) reviews/showreviews.php, (15) gallery/showgallerydetails.php, (16) reviews/showreviewsdetails.php, (17) news/shownewsdetails.php, (18) gallery/submit_gallery.php, (19) guestbook/submit_guestbook.php, (20) reviews/submit_reviews.php, (21) news/submit_news.php, (22) diary/inlineeventlist.php, and (23) news/archivednews_summary.php in modules/, related to the lack of directory traversal protection in modules/moduleSec.php.

5.1 CVSS 2.0 Medium EPSS 7.0% · top 6.0% CWE-22 · Path traversal
5.1CVSS 2.0 base score
7.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
20References, 12 tagged exploit
16 Jun 2026Last modified by NVD

Description

Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage, and (5) language_home parameters to modules/diary/showdiarydetail.php; (6) gsLanguage and (7) language_home parameters to modules/diary/submit_diary.php; (8) admin_home parameter to modules/news/news_summary.php; (9) nLink, (10) gsLanguage, and (11) language_home parameters to modules/news/inlinenews.php; and possibly other unspecified vectors in (12) diary/showeventlist.php, (13) gallery/showgallery.php, (14) reviews/showreviews.php, (15) gallery/showgallerydetails.php, (16) reviews/showreviewsdetails.php, (17) news/shownewsdetails.php, (18) gallery/submit_gallery.php, (19) guestbook/submit_guestbook.php, (20) reviews/submit_reviews.php, (21) news/submit_news.php, (22) diary/inlineeventlist.php, and (23) news/archivednews_summary.php in modules/, related to the lack of directory traversal protection in modules/moduleSec.php.

AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/31606 Vendor Advisory
http://www.osvdb.org/47773 Exploit
http://www.osvdb.org/47774 Exploit
http://www.osvdb.org/47775 Exploit
http://www.osvdb.org/47776 Exploit
http://www.osvdb.org/47777 Exploit
http://www.securityfocus.com/archive/1/495705/100/100/threaded
http://www.securityfocus.com/bid/30821 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/44665
https://www.exploit-db.com/exploits/6301
http://secunia.com/advisories/31606 Vendor Advisory
http://www.osvdb.org/47773 Exploit
http://www.osvdb.org/47774 Exploit
http://www.osvdb.org/47775 Exploit
http://www.osvdb.org/47776 Exploit
http://www.osvdb.org/47777 Exploit
http://www.securityfocus.com/archive/1/495705/100/100/threaded
http://www.securityfocus.com/bid/30821 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/44665
https://www.exploit-db.com/exploits/6301

Track CVE-2008-7054 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2008-2135Visualshapers ezcontents sql injection vulnerabilityMultiple SQL injection vulnerabilities in VisualShapers ezContents 2.0.0 allow remote attackers to execute arbitrary SQL commands via the (1) content…EPSS 1.00%7.5CVE-2006-4477Visualshapers ezcontents vulnerabilityMultiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code via an emp…EPSS 8.0%7.5CVE-2006-4478Visualshapers ezcontents vulnerabilitySQL injection vulnerability in headeruserdata.php in Visual Shapers ezContents 2.0.3 allows remote attackers to execute arbitrary SQL commands via th…EPSS 1.8%7.5CVE-2004-0132Visualshapers ezcontents vulnerabilityMultiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote…EPSS 2.4%7.5CVE-2004-0070Visualshapers ezcontents vulnerabilityPHP remote file inclusion vulnerability in module.php for ezContents allows remote attackers to execute arbitrary PHP code by modifying the link para…EPSS 3.0%7.5CVE-2003-1214Visualshapers ezcontents vulnerabilityUnknown vulnerability in the server login for VisualShapers ezContents 2.02 and earlier allows remote attackers to bypass access restrictions and gai…EPSS 1.8%7.5CVE-2002-1085Visualshapers ezcontents vulnerabilityMultiple cross-site scripting vulnerabilities in ezContents 1.41 and earlier allow remote attackers to execute script and steal cookies via the diary…EPSS 2.5%7.5CVE-2002-1086Visualshapers ezcontents vulnerabilityMultiple SQL injection vulnerabilities in ezContents 1.41 and earlier allow remote attackers to conduct unauthorized activities.EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2008-7054), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.