CVE-2019-25582

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25582
i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file parameter in index.php. Attackers can send GET requests to index.php with file_manager=image and supply arbitrary file paths like src/config.inc.php to retrieve configuration files and sensitive system data.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zip Product
https://www.exploit-db.com/exploits/46133 Exploit Third Party Advisory VDB Entry
https://www.i-doit.org/ Product
https://www.vulncheck.com/advisories/i-doit-cmdb-arbitrary-file-download-via-file-manager-parameter Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:i-doit:i-doit:1.12:*:*:*:*:*:*:*
History

24 Mar 2026, 20:36

Type Values Removed Values Added
References () https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zip - () https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zip - Product
References () https://www.exploit-db.com/exploits/46133 - () https://www.exploit-db.com/exploits/46133 - Exploit, Third Party Advisory, VDB Entry
References () https://www.i-doit.org/ - () https://www.i-doit.org/ - Product
References () https://www.vulncheck.com/advisories/i-doit-cmdb-arbitrary-file-download-via-file-manager-parameter - () https://www.vulncheck.com/advisories/i-doit-cmdb-arbitrary-file-download-via-file-manager-parameter - Third Party Advisory
First Time I-doit
I-doit i-doit
CPE cpe:2.3:a:i-doit:i-doit:1.12:*:*:*:*:*:*:*
Summary
  • (es) i-doit CMDB 1.12 contiene una vulnerabilidad de descarga arbitraria de archivos que permite a atacantes autenticados descargar archivos sensibles manipulando el parámetro file en index.PHP. Los atacantes pueden enviar solicitudes GET a index.PHP con file_manager=image y proporcionar rutas de archivo arbitrarias como src/config.inc.php para recuperar archivos de configuración y datos sensibles del sistema.

21 Mar 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-21 16:16

Updated : 2026-03-24 20:36

NVD link : CVE-2019-25582

Mitre link : CVE-2019-25582

CVE.ORG link : CVE-2019-25582

JSON object : View

Products Affected

i-doit

  • i-doit
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type