EZTechhelp Company EZCMS Security Bypass Vulnerability

Bugtraq ID:	29738
Class:	Access Validation Error
CVE:	CVE-2008-2920
Remote:	Yes
Local:	No
Published:	Jun 14 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	t0pP8uZz
Vulnerable:	EZTechhelp Company EZCMS 1.2
Not Vulnerable:	EZTechhelp Company EZCMS 1.2.1

EZTechhelp Company EZCMS Security Bypass Vulnerability

EZCMS is prone to a vulnerability that may allow users to bypass authentication and gain administrative access to certain scripts.

Successful attacks may allow remote attackers to modify, delete, and upload arbitrary files. This may lead to remote unauthorized access.

EZCMS 1.2 and prior versions are affected.

EZTechhelp Company EZCMS Security Bypass Vulnerability

Attackers can exploit this issue via a browser in the following manner:

http://www.example.com/ezcms/admin/filemanager/

EZTechhelp Company EZCMS Security Bypass Vulnerability

Solution:
The vendor released EZCMS 1.2.1 to address this issue. Please see the references for more information.


EZTechhelp Company EZCMS 1.2

• EZTechhelp Company ezcms1_2_1_patch.zip
  http://ezcms.eztechhelp.com/release/ezcms1_2_1_patch.zip

EZTechhelp Company EZCMS Security Bypass Vulnerability

References:

• EZCMS 1.2.1 Security Patch (EZTechhelp Company)
  
• EZCMS Product Page (EZTechhelp Company)