CVE-2019-25684
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.
Risk Assessment
The risk involves potential unauthorized access to sensitive data stored in the database, which could lead to information disclosure and compromise system confidentiality.
Recommendation
It is recommended to immediately update OpenDocMan to the latest version that fixes this vulnerability and implement input validation for the 'where' parameter.
Other vulnerabilities in OpenDocMan
See all- CVE-2026-108750Medium
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
- CVE-2014-1945High
CVE-2014-1945 is a SQL injection vulnerability in ajax_udf.php in OpenDocMan before version 1.2.7.2 that allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
- CVE-2021-45834Critical
A vulnerability in OpenDocMan 1.4.4 allows an attacker to bypass MIME type checks when uploading files via add.php. This can lead to automatic processing of malicious files within the product's environment or remote code execution.
Original NVD description (English source)
OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS