EUVD-2005-0410

Malware in sbrugna...

EUVD-2005-0412

Malware in sbrugna...

EUVD-2005-0230

Malware in sbrugna...

CVE-2005-0408

CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the idhash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in th...

CVE-2005-0409

CitrusDB 0.3.6 and earlier does not verify authorization for the 1 importcc.php and 2 uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of...

CVE-2005-0411

Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files via .. dot dot sequences in the load parameter...

CitrusDB 0.3.6 - 'importcc.php' Arbitrary Database Injection

source: https://www.securityfocus.com/bid/12557/info CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user...

CitrusDB 0.3.6 - 'uploadcc.php' Arbitrary Database Injection

source: https://www.securityfocus.com/bid/12557/info CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user...

CitrusDB 0.3.6 - 'importcc.php' CSV File SQL Injection

source: https://www.securityfocus.com/bid/12557/info CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user...

[Full-Disclosure] Advisory: Directory traversal in CitrusDB

Advisory: Directory traversal in CitrusDB RedTeam found a directory traversal vulnerability in CitrusDB which results in inclusion of any accessible local .php file. Details ======= Product: CitrusDB Affected Version: 0.3.6, probably = 0.3.5, too Immune Version: none 2005-02-03 OS affected: all...

[Full-Disclosure] Advisory: Upload Authorization bypass in CitrusDB

Advisory: Upload Authorization bypass in CitrusDB A group of students at our lab called RedTeam found an authorization bypass vulnerability in CitrusDB which results in upload of fake credit card data, SQL-Injection and disclosure of credit card data. Details ======= Product: CitrusDB Affected...

[Full-Disclosure] Advisory: Authentication bypass in CitrusDB

Advisory: Authentication bypass in CitrusDB A group of Students in our lab called RedTeam found an authentication bypass vulnerability in CitrusDB which can result in complete corruption of the installed CitrusDB application. Details ======= Product: CitrusDB Affected Version: 0.3.6 verified,...

CitrusDB 0.3.6 - importcc.php Arbitrary Database Injection

CitrusDB 0.3.6 - importcc.php Arbitrary Database Injection source: https://www.securityfocus.com/bid/12557/info CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The...

CVE-2005-0410

SQL injection vulnerability in importcc.php for CitrusDB 0.3.6 and earlier allows remote attackers to inject data via the fields of a CSV file...

CVE-2005-0411

Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files via .. dot dot sequences in the load parameter...

CVE-2005-0408

CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the idhash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in th...

[Full-Disclosure] Credit Card data disclosure in CitrusDB

Credit Card data disclosure in CitrusDB A group of students at our lab called RedTeam found an information disclosure vulnerability in CitrusDB which can result in disclosure of credit card information. Details ======= Product: CitrusDB Affected Version: = 0.3.5 Immune Version: =0.3.6 OS affected...