------------------------------------------------------------------------
---

Multiple vulnerabilities in MyDMS

------------------------------------------------------------------------
---

Author: Joxean Koret

Date: 2004

Location: Basque Country

------------------------------------------------------------------------
---

Affected software description:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

MyDMS

MyDMS is an open-source

document-management-system based on PHP

and MySQL

published under the GPL.

Web : http://dms.markuswestphal.de/about.html

------------------------------------------------------------------------
---

Vulnerabilities:

~~~~~~~~~~~~~~~~

A. SQL Injection Vulnerability

A1. An SQL Injection vulnerability found in the

file /demo/out/out.ViewFolder.php.

The parameter "FolderId" is not correctly

sanitized and an attacker can inject

any SQL valid command. You can try the error :

http://<host-with-mydmbs>/demo/out/out.ViewFolder.php?folderid=3

or 1=1as

NOTE : I put or 1=1as, well, this doesn't work,

but you can see the entire

SQL query that the server executes.

B. Unspecified File Download Vulnerability

B1. An error in the MyDMS software allows to a

registered users (and only to

registered users) to download any file, such

as /etc/passwd, by inserting in a

parameter a text such as ../../../../../etc/passwd.

Affected Versions :

~~~~~~~~~~~~~~~~~~~

The SQL Injection problem is in versions prior to

1.4.2.

The file download problem is in all versions.

The fix:

~~~~~~~~

The SQL Injection problem is corrected in the

version 1.4.2.

The file download problem is not corrected but

vendor is contacted.

------------------------------------------------------------------------
---

Contact:

~~~~~~~~

Joxean Koret at

joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es

[ reply ]