CVE-2005-0411

CitrusDB < 0.3.6 - Directory Traversal via Load Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-0411. PoCs published by RedTeam Pentesting.

AI-analyzed exploit summary The exploit describes a local file inclusion (LFI) vulnerability in CitrusDB 0.3.6 due to improper input sanitization. It allows an attacker to include arbitrary local PHP files via the 'load' parameter, potentially leading to remote code execution if combined with file upload capabilities.

Description

Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files via .. (dot dot) sequences in the load parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by RedTeam Pentesting · textwebappsphp
https://www.exploit-db.com/exploits/25104

The exploit describes a local file inclusion (LFI) vulnerability in CitrusDB 0.3.6 due to improper input sanitization. It allows an attacker to include arbitrary local PHP files via the 'load' parameter, potentially leading to remote code execution if combined with file upload capabilities.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: CitrusDB 0.3.6
No auth needed
Prerequisites: Access to the vulnerable endpoint · Ability to upload or control a local file
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Vendor Advisory x_refsource_misc
http://www.redteam-pentesting.de/advisories/rt-sa-2005-005.txt

Scores

EPSS 0.0219
EPSS Percentile 80.1%

Details

Status published
Products (1)
citrusdb/citrusdb < 0.3.6
Published Feb 14, 2005
Tracked Since Feb 18, 2026