CVE-2005-0409

CitrusDB 0.3.6 and earlier does not verify authorization for the 1 importcc.php and 2 uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of...

CVE-2005-0408

CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the idhash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in th...

CVE-2005-0411

Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files via .. dot dot sequences in the load parameter...

CVE-2005-0229

CVE-2005-0229 affects CitrusDB up to version 0.3.5, where a temporary file newfile.txt is stored under the web root and can be accessed via HTTP (e.g., /io/newfile.txt), enabling remote attackers to exfiltrate credit card data. The vulnerability arises from storing sensitive data in a web-accessi...

CVE-2005-0410

SQL injection vulnerability in importcc.php for CitrusDB 0.3.6 and earlier allows remote attackers to inject data via the fields of a CSV file...

PT-2005-1470 · Citrusdb · Citrusdb

Name of the Vulnerable Software and Affected Versions: CitrusDB versions 0.3.6 and earlier Description: The issue allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in t...

[Full-Disclosure] Credit Card data disclosure in CitrusDB

Credit Card data disclosure in CitrusDB A group of students at our lab called RedTeam found an information disclosure vulnerability in CitrusDB which can result in disclosure of credit card information. Details ======= Product: CitrusDB Affected Version: = 0.3.5 Immune Version: =0.3.6 OS affected...

CitrusDB 0.10.20.3 Credit Card Data - Remote Information Disclosure

CitrusDB 0.10.20.3 Credit Card Data - Remote Information Disclosure source: https://www.securityfocus.com/bid/12402/info A remote information disclosure issue affects CitrusDB. This issue is due to a design problem that grants unauthorized users the ability to export sensitive data. An attacker m...

CitrusDB 0.1/0.2/0.3 Credit Card Data - Remote Information Disclosure

source: https://www.securityfocus.com/bid/12402/info A remote information disclosure issue affects CitrusDB. This issue is due to a design problem that grants unauthorized users the ability to export sensitive data. An attacker may leverage this issue to gain access to sensitive information...

CitrusDB 0.3.6 - Remote Authentication Bypass

source: https://www.securityfocus.com/bid/12560/info CitrusDB is reportedly affected by an authentication bypass vulnerability. This issue is due to the application using a static value during the creation of user cookie information. An attacker could exploit this vulnerability to log in as any...

CitrusDB 0.3.6 - Remote Authentication Bypass

CitrusDB 0.3.6 - Remote Authentication Bypass source: https://www.securityfocus.com/bid/12560/info CitrusDB is reportedly affected by an authentication bypass vulnerability. This issue is due to the application using a static value during the creation of user cookie information. An attacker could...