Product description:

SeedDMS is the continuation of LetoDMS because it has lost its main developer. SeedDMS is an easy to use but powerful Open Source Document Management System.
http://www.seeddms.org/index.php?id=2

SeedDMS Unprivileged User Remote Code Execution Vulnerability (CVE-2014-2278):

Missing Function Level Access Controls: The application will allow file uploads of any type without sufficient user access controls.

Any unprivileged user, including guest users can upload arbitrary file types, including script formats that will allow remote code execution on the server.

Details:

The /op/op.AddFile2.php upload function is not sufficiently access controlled. The script path can be controlled using the “fileId” parameter, which will allow an attacker to control the location of files to be uploaded to the system. Using path traversal a user can traverse out of the configured upload path, and insert arbitrary files into the web root.

The ‘partitionIndex’ parameter is used for filename/extension specification in the path.

The CVE project assigned CVE-2014-2278 to this issue.

SeedDMS Path Traversal Vulnerability (CVE-2014-2279):

A user can use path traversal methods to return the contents of local files.

To exploit this vulnerability requires privileged access to the LogManagement application functionality.

Details:

The /out/out.LogManagement.php script will allow local files to be retrieved from the server by path traversal using the ‘logname’ parameter.

The CVE project assigned CVE-2014-2279 to this issue.

SeedDMS Cross-site Scripting Vulnerability (CVE-2014-2280)

The application search feature is vulnerable to reflected cross-site scripting attacks.

Details:

The ‘query’ parameter will accept scripting tags, which will be returned to the page without validation, or sanitization of HTML entities.

The CVE project assigned CVE-2014-2280 to this issue.

Vendor Response:
Upgrade to SeedDMS 4.3.4 or higher.
https://sourceforge.net/projects/seeddms/files/seeddms-4.3.4/

Timeline:

February 26, 2014, Vulnerability identified
February 26, 2014, Product vendor notification
February 26, 2014, Product vendor patch review
February 27, 2014, Product vendor fix confirmed
February 28, 2014, Patch released
March 14, 2014, 2014, Disclosure

Research:

Craig Arendt, Stratum Security
http://www.stratumsecurity.com

Disclaimer:

The information provided in this advisory is provided as is without warranty of any kind.