Published: 26/10/2009 Updated: 17/08/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 490

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Subscribe to Opendocman

Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan 1.2.5 allow remote malicious users to inject arbitrary web script or HTML via the last_message parameter to (1) add.php, (2) toBePublished.php, (3) index.php, and (4) admin.php; the PATH_INFO to the default URI to (5) category.php, (6) department.php, (7) profile.php, (8) rejects.php, (9) search.php, (10) toBePublished.php, (11) user.php, and (12) view_file.php; and (13) the caller parameter in a Modify User action to user.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
opendocman opendocman 1.2.5

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the app ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the appli ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the applicati ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, acce ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise t ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the a ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, ac ...

Security Advisory : Multiple vulnerabilities in OpenDocMan Discovered by ==> Amol Naik (amolnaik4[at]gmailcom) ## Overview ## -------------- OpenDocMan is a free document management system (DMS) designed to comply with ISO 17025 and OIE standard for document management It features web based access, fine grained control of access to files, an ...

source: wwwsecurityfocuscom/bid/36777/info OpenDocMan is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the applica ...

CWE-79 http://www.packetstormsecurity.org/0910-exploits/opendocman-sqlxss.txt http://secunia.com/advisories/30750 http://www.securityfocus.com/bid/36777 http://osvdb.org/59307 http://osvdb.org/59306 http://osvdb.org/59311 http://osvdb.org/59305 http://osvdb.org/59304 http://osvdb.org/59303 http://osvdb.org/59312 http://osvdb.org/59308 http://osvdb.org/59309 http://osvdb.org/59302 http://osvdb.org/59310 https://exchange.xforce.ibmcloud.com/vulnerabilities/53887 https://nvd.nist.gov https://www.exploit-db.com/exploits/33302/

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook