Executive brief
OpenDocMan is a web-based document management system used to store and organize corporate files. A security flaw in its search functionality allows unauthorized individuals to run malicious database commands without needing a password. This could lead to the theft of sensitive company data, including user credentials and private documents stored within the system.
Technical details
An SQL injection vulnerability exists in OpenDocMan version 1.3.4 and prior. The flaw is located in the 'where' parameter of the search.php script, which fails to properly sanitize user-supplied input before using it in a database query. An unauthenticated remote attacker can exploit this by sending a specially crafted GET request containing malicious SQL payloads. Successful exploitation allows the attacker to manipulate database queries, potentially leading to the extraction of sensitive information from the database. While the advisory focuses on version 1.3.4, later versions such as 1.4.4 are available which may address the issue.
Affected products
- OpenDocMan OpenDocMan 1.3.4 and earlier
Timeline
- 2019-03-05: disclosed: Initial exploit code published on Exploit-DB
- 2026-04-05: advisory: NVD/VulnCheck advisory published