CVE-2019-25684
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.
Risk Assessment
The risk involves potential unauthorized access to sensitive data stored in the database, which could lead to information disclosure and compromise system confidentiality.
Recommendation
It is recommended to immediately update OpenDocMan to the latest version that fixes this vulnerability and implement input validation for the 'where' parameter.
Other vulnerabilities in OpenDocMan
See all- CVE-2014-1945High
CVE-2014-1945 is a SQL injection vulnerability in ajax_udf.php in OpenDocMan before version 1.2.7.2 that allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
- CVE-2021-45834Critical
A vulnerability in OpenDocMan 1.4.4 allows an attacker to bypass MIME type checks when uploading files via add.php. This can lead to automatic processing of malicious files within the product's environment or remote code execution.
Original NVD description (English source)
OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.