0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
OpenDocMan 1.2.6.2 SQL Injection / Access Bypass vulnerabilities
[#1 - Unprotected id parameter ----------------------------- In check-in.php the id variable is not filtered so that one can put in additional SQL statements. I have been able to get a UNION SELECT query to run but I do not think it's exploitable because there is a second query that runs with the id variable that will fail. None-the-less it is possible to get my string to the interpreter as valid SQL. #2 - Password reset allows anyone to reset the admin password ------------------------------------------------------------- forgot_password.php does not have any authentication or checking to make sure the user is only changing their password. So, an unauthenticated user can reset the password of any account if this functionality is enabled. It is disabled by default. #3 - ACL broken for restricted documents ---------------------------------------- Assume a user uploads a file and put restricted access control around it preventing any other users from accessing it through the software interface. If an attacker were to change the aku parameter to include the restricted file number they would be able to use the check-out.php page to retrieve the restricted file. Thanks to Stephen Laurence, the developer for this OSS project, for the quick replies. These issues were addressed by the developer (although I did not test the changes). Please download the latest version. Ken http://silverbackventuresllc.com # 0day.today [2024-11-15] #