Summary
This host is running OpenDocMan and is prone to multiple Cross-Site Scripting and SQL Injection vulnerabilities.
Impact
Successful exploitation will allow attacker to cause Cross-Site Scripting or SQL Injection attacks by executing arbitrary codes with in the context of the affected application.
Impact Level: Application.
Solution
Upgrade to OpenDocMan version 1.2.5.2 or later.
http://www.opendocman.com/
Insight
- Input passed to the 'frmuser' and 'frmpass' parameters in 'index.php' is not properly sanitised before being used in SQL queries.
- Input passed to the 'last_message' parameter in add.php, toBePublished.php, index.php, and admin.php, and input passed via the URL to category.php, department.php, profile.php, rejects.php, search.php, toBePublished.php, view_file.php, and user.php is not properly sanitised before being returned to the user.
Affected
OpenDocMan version prior to 1.2.5.2
References
Severity
Classification
-
CVE CVE-2009-3788, CVE-2009-3789, CVE-2009-3801 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities