QwikSec

Security Database

CVE

CWE

Training

CVE-2005-0409

Published: Feb 16, 2005

Modified: Aug 7, 2024

PUBLISHED

Description

CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20050214 Advisory: Upload Authorization bypass in CitrusDB

mailing-list

x_refsource_FULLDISC

http://www.redteam-pentesting.de/advisories/rt-sa-2005-003.txt

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.