vulnwire
6.4med

CVE-2005-04092 exploits

CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to up…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
6.4
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.7%
percentile 93%
Public exploits
2
Exploit-DB

CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.

Exploit prediction (EPSS)

5.66% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

Exploits and detections

  • EDB-25100 CitrusDB 0.3.6 - 'uploadcc.php' Arbitrary Database Injection · webapps · 2005-02-15
  • EDB-25099 CitrusDB 0.3.6 - 'importcc.php' Arbitrary Database Injection · webapps · 2005-02-15

CVSS scores

Assigned byVersionScoreVector
NVD2.06.4AV:N/AC:L/Au:N/C:P/I:P/A:N

References

  • lists.grok.org.uk /pipermail/full-disclosure/2005-February/031707.html · mailing-list, x_refsource_FULLDISC, x_transferred
  • redteam-pentesting.de /advisories/rt-sa-2005-003.txt · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.