PT-2026-26930 · Unknown · I-Doit Cmdb

Ihsan Sencan · Publicado 2026-03-21 · Atualizado 2026-03-21 · CVE-2019-25582

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions i-doit CMDB version 1.12

Description The software contains a flaw that allows authenticated attackers to download sensitive files. This is possible by manipulating the file parameter in the 'index.php' file. Attackers can send GET requests to ''index.php'' with file manager=image and provide arbitrary file paths, such as src/config.inc.php, to retrieve configuration files and sensitive system data.

Recommendations Apply updates to address the issue in i-doit CMDB version 1.12.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-25582

Produtos afetados

I-Doit Cmdb

Referências · 5

• 🔥 https://exploit-db.com/exploits/46133 · Exploit
• https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zip · Nota
• https://i-doit.org · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25582 · Nota de Segurança
• https://vulncheck.com/advisories/i-doit-cmdb-arbitrary-file-download-via-file-manager-parameter · Nota