CVE-2021-45834
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
A vulnerability in OpenDocMan 1.4.4 allows an attacker to bypass MIME type checks when uploading files via add.php. This can lead to automatic processing of malicious files within the product's environment or remote code execution.
Risk Assessment
The risk includes potential server compromise through arbitrary code execution, which may result in loss of confidentiality, integrity, and availability of organizational data.
Recommendation
Immediately update OpenDocMan to the latest version and implement server-side file type validation independent of the MIME header.
Other vulnerabilities in OpenDocMan
See all- CVE-2014-1945High
CVE-2014-1945 is a SQL injection vulnerability in ajax_udf.php in OpenDocMan before version 1.2.7.2 that allows remote attackers to execute arbitrary SQL commands via the add_value parameter.
- CVE-2019-25684High
OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.
Original NVD description (English source)
An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be automatically processed within the product's environment or lead to arbitrary code execution.