| VID |
21487 |
| Severity |
30 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
CGI |
| Detailed Description |
The CitrusDB software is vulnerable to an information disclosure vulnerability via the newfile.txt file. CitrusDB is an open-source customer database application that uses PHP and a database backend (currently MySQL). CitrusDB 0.3.5 and earlier locate a textfile to temporarily store credit card information under the web root. This allows a remote attacker to gain access to sensitive information including credit card data via a direct request to newfile.txt.
* References:
http://www.securiteam.com/unixfocus/5UP0H0UEUG.html
http://www.osvdb.org/displayvuln.php?osvdb_id=13228
http://www.securitytracker.com/alerts/2005/Jan/1013040.html
http://tsyklon.informatik.rwth-aachen.de/redteam/rt-sa-2005-001
* Platforms Affected:
SourceForge.net, CitrusDB versions 0.3.5 and earlier
Any Operating system Any version |
| Recommendation |
Upgrade to the latest version of CitrusDB (0.3.6 or later), available from the CitrusDB Download Web site at http://www.citrusdb.org/download.php , and set the $path_to_ccfile in the configuration to a path not accessible via HTTP.
-- OR --
As a workaround, either deny access to the file using access restriction features of your webserver or change CitrusDB to use a file outside document root and not accessible via HTTP. |
| Related URL |
CVE-2005-0229 (CVE) |
| Related URL |
12402 (SecurityFocus) |
| Related URL |
(ISS) |
|
