Home page logo
/

bugtraq logo Bugtraq mailing list archives

Multiple Vulnerabilities in SeedDMS < = 4.3.3
From: craig.arendt () stratumsecurity com
Date: Fri, 14 Mar 2014 11:14:26 GMT

Product description:
============
SeedDMS is the continuation of LetoDMS because it has lost its main developer. SeedDMS is an easy to use but powerful 
Open Source Document Management System.
http://www.seeddms.org/index.php?id=2
============

SeedDMS Unprivileged User Remote Code Execution Vulnerability (CVE-2014-2278):
============
Missing Function Level Access Controls: The application will allow file uploads of any type without sufficient user 
access controls.

Any unprivileged user, including guest users can upload arbitrary file types, including script formats that will allow 
remote code execution on the server.

Details:
----------------------
The /op/op.AddFile2.php upload function is not sufficiently access controlled. The script path can be controlled using 
the “fileId” parameter, which will allow an attacker to control the location of files to be uploaded to the system.  
Using path traversal a user can traverse out of the configured upload path, and insert arbitrary files into the web 
root.

The ‘partitionIndex’ parameter is used for filename/extension specification in the path.

The CVE project assigned CVE-2014-2278 to this issue.
============


SeedDMS Path Traversal Vulnerability (CVE-2014-2279):
============
A user can use path traversal methods to return the contents of local files.

To exploit this vulnerability requires privileged access to the LogManagement application functionality.

Details:
----------------------
The /out/out.LogManagement.php script will allow local files to be retrieved from the server by path traversal using 
the ‘logname’ parameter.

The CVE project assigned CVE-2014-2279 to this issue.
============


SeedDMS Cross-site Scripting Vulnerability (CVE-2014-2280)
============
The application search feature is vulnerable to reflected cross-site scripting attacks.

Details:
----------------------
The ‘query’ parameter will accept scripting tags, which will be returned to the page without validation, or 
sanitization of HTML entities.

The CVE project assigned CVE-2014-2280 to this issue.
============


Vendor Response:
Upgrade to SeedDMS 4.3.4 or higher.
https://sourceforge.net/projects/seeddms/files/seeddms-4.3.4/

Timeline:
============
February 26, 2014, Vulnerability identified
February 26, 2014, Product vendor notification
February 26, 2014, Product vendor patch review
February 27, 2014, Product vendor fix confirmed
February 28, 2014, Patch released
March 14, 2014, 2014, Disclosure

Research:
============
Craig Arendt, Stratum Security
http://www.stratumsecurity.com

Disclaimer: 
----------------------
The information provided in this advisory is provided as is without warranty of any kind.


  By Date           By Thread  

Current thread:
  • Multiple Vulnerabilities in SeedDMS < = 4.3.3 craig . arendt (Mar 14)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault