lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 12 Dec 2012 10:15:00 -0700
From: "Kenneth F. Belva" <ken@...verbackventuresllc.com>
To: bugtraq@...urityfocus.com
Subject: OpenDocMan 1.2.6.2 - 3 Vulnerabilities

#1 - Unprotected id parameter
-----------------------------
In check-in.php the id variable is not filtered so that one can put in
additional SQL statements. I have been able to get a UNION SELECT query
to run but I do not think it's exploitable because there is a second
query that runs with the id variable that will fail. None-the-less it is
possible to get my string to the interpreter as valid SQL.

#2 - Password reset allows anyone to reset the admin password
-------------------------------------------------------------
forgot_password.php does not have any authentication or checking to make
sure the user is only changing their password. So, an unauthenticated
user can reset the password of any account if this functionality is
enabled. It is disabled by default.

#3 - ACL broken for restricted documents
----------------------------------------
Assume a user uploads a file and put restricted access control around it
preventing any other users from accessing it through the software
interface. If an attacker were to change the aku parameter to include
the restricted file number they would be able to use the check-out.php
page to retrieve the restricted file.


Thanks to Stephen Laurence, the developer for this OSS project, for the
quick replies. These issues were addressed by the developer (although I
did not test the changes). Please download the latest version.

Ken
http://silverbackventuresllc.com

Powered by blists - more mailing lists