medium6.4Public exploit code
CVE-2005-0409
CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card dat…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CitrusDB 0.3.6 - 'uploadcc.php' Arbitrary Database Injection2005-02-15 · webapps · php · Verified
- CitrusDB 0.3.6 - 'importcc.php' Arbitrary Database Injection2005-02-15 · webapps · php · Verified
Impact
CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Citrusdb | Citrusdb | through 0.3.6 |
References
- NVD record
- CVE.org record
- http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031707.html
- http://www.redteam-pentesting.de/advisories/rt-sa-2005-003.txt
- http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031707.html
- http://www.redteam-pentesting.de/advisories/rt-sa-2005-003.txt