CitrusDB 0.3.6

CPE Details

CitrusDB 0.3.6
citrusdb
citrusdb
0.3.6
2024-02-07
20h45 +00:00
2024-02-07
20h45 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:citrusdb:citrusdb:0.3.6:*:*:*:*:*:*:*

Informations

Vendor

citrusdb

Product

citrusdb

Version

0.3.6

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2005-0408 2005-02-16 04h00 +00:00 CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in the $hidden_hash variable.
9.8
Critical
CVE-2005-0409 2005-02-16 04h00 +00:00 CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.
6.4
CVE-2005-0410 2005-02-16 04h00 +00:00 SQL injection vulnerability in importcc.php for CitrusDB 0.3.6 and earlier allows remote attackers to inject data via the fields of a CSV file.
5
CVE-2005-0411 2005-02-16 04h00 +00:00 Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files via .. (dot dot) sequences in the load parameter.
7.5