OpenDocMan 1.2.6.2 SQL Injection / Access Bypass

`#1 - Unprotected id parameter  
-----------------------------  
In check-in.php the id variable is not filtered so that one can put in  
additional SQL statements. I have been able to get a UNION SELECT query  
to run but I do not think it's exploitable because there is a second  
query that runs with the id variable that will fail. None-the-less it is  
possible to get my string to the interpreter as valid SQL.  
  
#2 - Password reset allows anyone to reset the admin password  
-------------------------------------------------------------  
forgot_password.php does not have any authentication or checking to make  
sure the user is only changing their password. So, an unauthenticated  
user can reset the password of any account if this functionality is  
enabled. It is disabled by default.  
  
#3 - ACL broken for restricted documents  
----------------------------------------  
Assume a user uploads a file and put restricted access control around it  
preventing any other users from accessing it through the software  
interface. If an attacker were to change the aku parameter to include  
the restricted file number they would be able to use the check-out.php  
page to retrieve the restricted file.  
  
  
Thanks to Stephen Laurence, the developer for this OSS project, for the  
quick replies. These issues were addressed by the developer (although I  
did not test the changes). Please download the latest version.  
  
Ken  
http://silverbackventuresllc.com  
`