| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 12 Dec 2012 10:15:00 -0700 From: "Kenneth F. Belva" <ken@...verbackventuresllc.com> To: bugtraq@...urityfocus.com Subject: OpenDocMan 1.2.6.2 - 3 Vulnerabilities #1 - Unprotected id parameter ----------------------------- In check-in.php the id variable is not filtered so that one can put in additional SQL statements. I have been able to get a UNION SELECT query to run but I do not think it's exploitable because there is a second query that runs with the id variable that will fail. None-the-less it is possible to get my string to the interpreter as valid SQL. #2 - Password reset allows anyone to reset the admin password ------------------------------------------------------------- forgot_password.php does not have any authentication or checking to make sure the user is only changing their password. So, an unauthenticated user can reset the password of any account if this functionality is enabled. It is disabled by default. #3 - ACL broken for restricted documents ---------------------------------------- Assume a user uploads a file and put restricted access control around it preventing any other users from accessing it through the software interface. If an attacker were to change the aku parameter to include the restricted file number they would be able to use the check-out.php page to retrieve the restricted file. Thanks to Stephen Laurence, the developer for this OSS project, for the quick replies. These issues were addressed by the developer (although I did not test the changes). Please download the latest version. Ken http://silverbackventuresllc.com
Powered by blists - more mailing lists