CVE-2005-0409 - CVE House
Back to Database
Status published Medium CVE-2005-0409

CitrusDB 0.3.6 and earlier does not verify authorization for the...

Vulnerability Description

CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2005-0409

Credits & Attribution

No credits recorded in the NVD database.

References

More from citrusdb

View All →
CVE-2005-0411
Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier...
High 7.5
CVE-2005-0410
SQL injection vulnerability in importcc.php for CitrusDB 0.3.6 and earlier...
Medium 5
CVE-2005-0408
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of...
Critical 9.8
CVE-2005-0229
CitrusDB 0.3.5 and earlier stores the newfile.txt temporary data file...
Medium 5

Affected Vendor

Affected Software

citrusdb
Vulnerable Versions:
0

Timeline

Official Publish: February 16th, 2005
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.