SecurityvulnsSECURITYVULNS:DOC:28877OpenDocMan 1.2.6.2 - 3 Vulnerabilities
#1 - Unprotected id parameter
In check-in.php the id variable is not filtered so that one can put in
additional SQL statements. I have been able to get a UNION SELECT query
to run but I do not think it's exploitable because there is a second
query that runs with the id variable that will fail. None-the-less it is
possible to get my string to the interpreter as valid SQL.
#2 - Password reset allows anyone to reset the admin password
forgot_password.php does not have any authentication or checking to make
sure the user is only changing their password. So, an unauthenticated
user can reset the password of any account if this functionality is
enabled. It is disabled by default.
#3 - ACL broken for restricted documents
Assume a user uploads a file and put restricted access control around it
preventing any other users from accessing it through the software
interface. If an attacker were to change the aku parameter to include
the restricted file number they would be able to use the check-out.php
page to retrieve the restricted file.
Thanks to Stephen Laurence, the developer for this OSS project, for the
quick replies. These issues were addressed by the developer (although I
did not test the changes). Please download the latest version.