Omnidocs Privilege Escalation / Direct Object Access

`Exploit Title: Multiple Vulnerability in "Omnidocs"  
Author: Sohil Garg  
CVE : CVE-2011-3645  
  
Product Description:  
OmniDocs is an Enterprise Document Management (EDM) platform for creating, capturing, managing, delivering and archiving large volumes of documents and   
contents. Also integrates seamlessly with other enterprise applications.  
  
Vulnerability Details:  
  
1.Vulnerbility Type  
Privilege escalation  
  
Affected URL:   
http://serverIP/omnidocs/doccab/doclist.jsp?DocListFolderId=927964&FolderType=G&FolderRights=010000000&FolderName=1234&FolderOwner=test&FolderLocation=G&Fold  
erAccessType=I&ParentFolderIndex=100&FolderPathFlag=Y&Fetch=5&VolIndex=1&VolIndex=1  
  
Vulnerable Parameter:   
FolderRights  
  
Exploit  
Omnidocs application does not validate 'FolderRights' parameter. This parameter could be modified to '111111111' to get full access including rights to add   
documents, add folders, delete folders and place orders.  
  
  
2.Vulnerability Type  
Direct Object Access  
  
Sample URL:  
http://serverIP/omnidocs/doccab/userprofile/editprofile.jsp  
  
Vulnerable Parameter:  
UserIndex  
  
Exploit:  
Omnidocs application does not validate 'UserIndex' parameter. 'UserIndex' parameter is used to access the personal setting page. This parameter can be   
changed to other valid numbers thereby gaining access to view or change other user's personal settings.  
  
Timeline:  
Notified Vendor: 01-Sep-2011  
No response received from vendor for 3 weeks  
Public Disclosure: 23-Sep-2011  
  
  
Greetz to:  
1] Nikhil Mittal  
`