CVE-2014-1945
HighSummary
CVE-2014-1945 is a SQL injection vulnerability in ajax_udf.php in OpenDocMan before version 1.2.7.2 that allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
Risk Assessment
Attackers can exploit this vulnerability to gain access to the database, potentially leading to data theft or system compromise.
Recommendation
It is recommended to upgrade OpenDocMan to version 1.2.7.2 or later to mitigate this vulnerability.
Other vulnerabilities in OpenDocMan
See all- CVE-2026-108750Medium
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
- CVE-2021-45834Critical
A vulnerability in OpenDocMan 1.4.4 allows an attacker to bypass MIME type checks when uploading files via add.php. This can lead to automatic processing of malicious files within the product's environment or remote code execution.
- CVE-2019-25684High
OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.
Original NVD description (English source)
SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS