0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
SeedDMS XSS / Traversal / Shell Upload Vulnerabilities
Author
Risk
[Security Risk High
]0day-ID
Category
Date add
CVE
Platform
Product description: ============ SeedDMS is the continuation of LetoDMS because it has lost its main developer. SeedDMS is an easy to use but powerful Open Source Document Management System. http://www.seeddms.org/index.php?id=2 ============ SeedDMS Unprivileged User Remote Code Execution Vulnerability (CVE-2014-2278): ============ Missing Function Level Access Controls: The application will allow file uploads of any type without sufficient user access controls. Any unprivileged user, including guest users can upload arbitrary file types, including script formats that will allow remote code execution on the server. Details: ---------------------- The /op/op.AddFile2.php upload function is not sufficiently access controlled. The script path can be controlled using the “fileId” parameter, which will allow an attacker to control the location of files to be uploaded to the system. Using path traversal a user can traverse out of the configured upload path, and insert arbitrary files into the web root. The ‘partitionIndex’ parameter is used for filename/extension specification in the path. The CVE project assigned CVE-2014-2278 to this issue. ============ SeedDMS Path Traversal Vulnerability (CVE-2014-2279): ============ A user can use path traversal methods to return the contents of local files. To exploit this vulnerability requires privileged access to the LogManagement application functionality. Details: ---------------------- The /out/out.LogManagement.php script will allow local files to be retrieved from the server by path traversal using the ‘logname’ parameter. The CVE project assigned CVE-2014-2279 to this issue. ============ SeedDMS Cross-site Scripting Vulnerability (CVE-2014-2280) ============ The application search feature is vulnerable to reflected cross-site scripting attacks. Details: ---------------------- The ‘query’ parameter will accept scripting tags, which will be returned to the page without validation, or sanitization of HTML entities. The CVE project assigned CVE-2014-2280 to this issue. ============ Vendor Response: Upgrade to SeedDMS 4.3.4 or higher. https://sourceforge.net/projects/seeddms/files/seeddms-4.3.4/ Timeline: ============ February 26, 2014, Vulnerability identified February 26, 2014, Product vendor notification February 26, 2014, Product vendor patch review February 27, 2014, Product vendor fix confirmed February 28, 2014, Patch released March 14, 2014, 2014, Disclosure # 0day.today [2024-12-25] #