CVE-2008-5853

Chilek Content Management System <2.0.4 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-5853. PoCs published by BugReport.IR.

AI-analyzed exploit summary This is a vulnerability writeup detailing multiple issues in ChiCoMaS CMS, including database information disclosure, unauthorized access to backups, and reflected XSS. No exploit code is provided, only PoC URLs.

Description

Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) obtain database credentials via a direct request for config.inc or (2) read database backups via a request for a backup/ URI.

Exploits (1)

exploitdb WRITEUP VERIFIED
by BugReport.IR · textwebappsphp
https://www.exploit-db.com/exploits/7532

This is a vulnerability writeup detailing multiple issues in ChiCoMaS CMS, including database information disclosure, unauthorized access to backups, and reflected XSS. No exploit code is provided, only PoC URLs.

Classification
Writeup 100%
Attack Type
Info Leak | Auth Bypass | Xss
Complexity
Trivial
Reliability
Reliable
Target: ChiCoMaS CMS <= 2.0.4
No auth needed
Prerequisites: Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/499458/100/0/threaded
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/7532
Exploit x_refsource_misc
http://www.bugreport.ir/index_59.htm
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4872
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30080

Scores

EPSS 0.0254
EPSS Percentile 82.9%

Details

CWE
CWE-264
Status published
Products (2)
chicomas/chicomas 2.0.3
chicomas/chicomas < 2.0.4
Published Jan 06, 2009
Tracked Since Feb 18, 2026