Omnidocs – Multiple Vulnerabilities

• Exploit Database
• 33 阅读

• 作者： Sohil Garg
  日期： 2011-09-27
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/17897/

• --------------------------------------------------------------------
  # Exploit Title: Multiple Vulnerability in "Omnidocs"
  # Date: 24 Sep 2011
  # Author: Sohil Garg
  # Software Link: http://www.newgensoft.com/omnidocs.asp
  # Version: All
  # Tested on: Apache-Coyote/1.1
  # CVE : CVE-2011-3645
  �
  ---------------------------------------------------
  "Omnidocs" Multiple vulnerability.
  ---------------------------------------------------
  By � � � :Sohil Garg
  Email � �:sohil_garg@yahoo.co.in
  ---------------------------------------------------
  �
  Product Description:
  OmniDocs is an Enterprise Document Management (EDM) platform for creating, capturing, managing, delivering and archiving large volumes of documents and�
  
  contents. Also integrates seamlessly with other enterprise applications.
  �
  ------------------
  Vulnerability
  ------------------
  �
  1.Vulnerbility Type
  Privilege escalation
  
  Affected URL:�
  http://serverIP/omnidocs/doccab/doclist.jsp?DocListFolderId=927964&FolderType=G&FolderRights=010000000&FolderName=1234&FolderOwner=test&FolderLocation=G&Fold
  erAccessType=I&ParentFolderIndex=100&FolderPathFlag=Y&Fetch=5&VolIndex=1&VolIndex=1
  �
  Vulnerable Parameter:�
  FolderRights
  
  Exploit
  Omnidocs application does not validate 'FolderRights' parameter. This parameter could be modified to '111111111' to get full access including rights to add�
  documents, add folders, delete folders and place orders.
  
  
  
  2.Vulnerability Type
  Direct Object Access
  
  Sample URL:
  http://serverIP/omnidocs/doccab/userprofile/editprofile.jsp
  
  Vulnerable Parameter:
  UserIndex
  
  Exploit:
  Omnidocs application does not validate 'UserIndex' parameter. 'UserIndex' parameter is used to access the personal setting page. This parameter can be�
  changed to other valid numbers thereby gaining access to view or change other user's personal settings.
  
  
  Timeline:
  Notified Vendor: 01-Sep-2011
  No response received from vendor for 3 weeks
  Public Disclosure: 23-Sep-2011
  
  
  -----------------------------------------------------
  Greetz to:
  1] Nikhil Mittal