VULHUB ™

VisualShapers ezContents is a website content management system based on PHP and MySQL. The software contains multiple vulnerabilities. The first vulnerability occurs because ezContents does not check if an image file was actually uploaded or if the file information was performed through a POST. This could allow a malicious user to fool the server into treating any file that is readable by the webserver as an uploaded file. The second vulnerability is a directory traversal issue. The Maintain Images function allows a user to escape the webroot by entering "../" sequences. The user can either list directories and contents or create subdirectories. The third vulnerability allows a user to POST data to several scripts without being logged in. The fourth issue involves HTML injection. ezContents allows a user to enter scripts that will execute when another user views the entry. This occurs because ezContents fails to sanitize user input. The fifth issue is an SQL injection vulnerability.

VisualShapers ezContents is a website content management system based on PHP and MySQL. The software contains multiple vulnerabilities. The first vulnerability occurs because ezContents does not check if an image file was actually uploaded or if the file information was performed through a POST. This could allow a malicious user to fool the server into treating any file that is readable by the webserver as an uploaded file. The second vulnerability is a directory traversal issue. The Maintain Images function allows a user to escape the webroot by entering "../" sequences. The user can either list directories and contents or create subdirectories. The third vulnerability allows a user to POST data to several scripts without being logged in. The fourth issue involves HTML injection. ezContents allows a user to enter scripts that will execute when another user views the entry. This occurs because ezContents fails to sanitize user input. The fifth issue is an SQL injection vulnerability.