CVE-2004-0132

CVE-2004-0132 describes multiple remote file inclusion vulnerabilities in ezContents versions 2.0.2 and earlier, allowing attackers to execute arbitrary PHP code. Specifically, this can occur via the GLOBALS[rootdp] parameter in db.php or the GLOBALS[language_home] parameter in archivednews.php, leveraging a malicious lang_admin.php. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network without authentication, potentially leading to partial compromise of confidentiality, integrity, and availability. While not on the KEV catalog, exploit code is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.