CVE-2005-0409

Published Feb 14, 2005

Last updated 16 years ago

Overview

Description: CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.4
Impact score: 4.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:citrusdb:citrusdb:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AA1F1B4D-3FA6-4A54-A671-9B403DE5EC33",
            "versionEndIncluding": "0.3.6"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References