PT-2026-26930 · Unknown · I-Doit Cmdb

Ihsan Sencan · Published 2026-03-21 · Updated 2026-03-21 · CVE-2019-25582

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions i-doit CMDB version 1.12

Description The software contains a flaw that allows authenticated attackers to download sensitive files. This is possible by manipulating the file parameter in the 'index.php' file. Attackers can send GET requests to ''index.php'' with file manager=image and provide arbitrary file paths, such as src/config.inc.php, to retrieve configuration files and sensitive system data.

Recommendations Apply updates to address the issue in i-doit CMDB version 1.12.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-25582

Affected Products

I-Doit Cmdb

References · 5

• 🔥 https://exploit-db.com/exploits/46133 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25582 · Security Note
• https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zip · Note
• https://i-doit.org · Note
• https://vulncheck.com/advisories/i-doit-cmdb-arbitrary-file-download-via-file-manager-parameter · Note