MyDMS.txt

`  
  
---------------------------------------------------------------------------   
Multiple vulnerabilities in MyDMS   
---------------------------------------------------------------------------   
  
Author: Joxean Koret   
Date: 2004   
Location: Basque Country   
  
---------------------------------------------------------------------------   
  
Affected software description:   
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   
  
MyDMS   
  
MyDMS is an open-source   
document-management-system based on PHP   
and MySQL   
published under the GPL.   
  
Web : http://dms.markuswestphal.de/about.html   
  
---------------------------------------------------------------------------   
  
Vulnerabilities:   
~~~~~~~~~~~~~~~~   
  
A. SQL Injection Vulnerability   
  
A1. An SQL Injection vulnerability found in the   
file /demo/out/out.ViewFolder.php.   
The parameter "FolderId" is not correctly   
sanitized and an attacker can inject   
any SQL valid command. You can try the error :   
  
  
http://<host-with-mydmbs>/demo/out/out.ViewFolder.php?folderid=3   
or 1=1as   
  
NOTE : I put or 1=1as, well, this doesn't work,   
but you can see the entire   
SQL query that the server executes.   
  
B. Unspecified File Download Vulnerability   
  
B1. An error in the MyDMS software allows to a   
registered users (and only to   
registered users) to download any file, such   
as /etc/passwd, by inserting in a   
parameter a text such as ../../../../../etc/passwd.   
  
Affected Versions :   
~~~~~~~~~~~~~~~~~~~   
  
The SQL Injection problem is in versions prior to   
1.4.2.   
The file download problem is in all versions.   
  
The fix:   
~~~~~~~~   
  
The SQL Injection problem is corrected in the   
version 1.4.2.   
The file download problem is not corrected but   
vendor is contacted.   
  
---------------------------------------------------------------------------   
Contact:   
~~~~~~~~   
  
Joxean Koret at   
joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es   
  
  
`