CVE-2019-25582
Received Received - Intake
Arbitrary File Download in i-doit CMDB 1.12 Allows Data Exposure

Publication date: 2026-03-21

Last updated on: 2026-03-24

Assigner: VulnCheck

Description
i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file parameter in index.php. Attackers can send GET requests to index.php with file_manager=image and supply arbitrary file paths like src/config.inc.php to retrieve configuration files and sensitive system data.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-21
Last Modified
2026-03-24
Generated
2026-06-16
AI Q&A
2026-03-21
EPSS Evaluated
2026-06-15
NVD
CVE-2019-25582
EUVD
EUVD-2019-19906
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
i-doit i-doit 1.12
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2019-25582 is an arbitrary file download vulnerability found in i-doit CMDB version 1.12 and earlier. It allows authenticated attackers to download sensitive files from the server by manipulating the "file" parameter in the index.php script.'}, {'type': 'paragraph', 'content': 'Attackers exploit this flaw by sending specially crafted GET requests to index.php with the parameter file_manager=image and specifying arbitrary file paths, such as src/config.inc.php, to retrieve configuration files and other sensitive system data.'}, {'type': 'paragraph', 'content': 'This vulnerability arises due to insufficient validation or sanitization of the "file" parameter in the file manager functionality, enabling unauthorized access to files that should be protected.'}] [1, 2]

Impact Analysis

This vulnerability can have a significant security impact by allowing attackers to download sensitive configuration files and system data from the affected server.

Since the attacker only needs low privileges and no user interaction, they can easily exploit this flaw remotely over the network.

The exposure of sensitive files may lead to further attacks, such as credential theft, system compromise, or unauthorized access to critical information.

Compliance Impact

I don't know

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending crafted HTTP GET requests to the vulnerable i-doit CMDB server targeting the index.php script with the file_manager=image parameter and specifying arbitrary file paths to check if sensitive files can be downloaded.'}, {'type': 'list_item', 'content': 'Use a command like: curl -i "http://[TARGET]/[PATH]/index.php?file_manager=image&file=src/config.inc.php" to see if the server returns the contents of the configuration file.'}, {'type': 'list_item', 'content': 'Look for HTTP response headers such as Content-Disposition: inline; filename="src/config.inc.php" and Content-Type: application/octet-stream indicating successful file retrieval.'}] [1, 2]

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2019-25582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart