ID de Prueba:	1.3.6.1.4.1.25623.1.0.900885
Categoría:	Web application abuses
Título:	OpenDocMan Multiple XSS and SQL Injection Vulnerabilities
Resumen:	OpenDocMan is prone to multiple Cross-Site Scripting and SQL Injection vulnerabilities.
Descripción:	Summary: OpenDocMan is prone to multiple Cross-Site Scripting and SQL Injection vulnerabilities. Vulnerability Insight: - Input passed to the 'frmuser' and 'frmpass' parameters in 'index.php' is not properly sanitised before being used in SQL queries. - Input passed to the 'last_message' parameter in add.php, toBePublished.php, index.php, and admin.php, and input passed via the URL to category.php, department.php, profile.php, rejects.php, search.php, toBePublished.php, view_file.php, and user.php is not properly sanitised before being returned to the user. Vulnerability Impact: Successful exploitation will allow attacker to cause Cross-Site Scripting or SQL Injection attacks by executing arbitrary codes with in the context of the affected application. Affected Software/OS: OpenDocMan version prior to 1.2.5.2 Solution: Upgrade to OpenDocMan version 1.2.5.2 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3788 BugTraq ID: 36777 http://www.securityfocus.com/bid/36777 http://www.packetstormsecurity.org/0910-exploits/opendocman-sqlxss.txt http://osvdb.org/59301 http://secunia.com/advisories/30750 XForce ISS Database: opendocman-user-sql-injection(53886) https://exchange.xforce.ibmcloud.com/vulnerabilities/53886 Common Vulnerability Exposure (CVE) ID: CVE-2009-3789 http://osvdb.org/59302 http://osvdb.org/59303 http://osvdb.org/59304 http://osvdb.org/59305 http://osvdb.org/59306 http://osvdb.org/59307 http://osvdb.org/59308 http://osvdb.org/59309 http://osvdb.org/59310 http://osvdb.org/59311 http://osvdb.org/59312 XForce ISS Database: opendocman-multiple-xss(53887) https://exchange.xforce.ibmcloud.com/vulnerabilities/53887 Common Vulnerability Exposure (CVE) ID: CVE-2009-3801
Copyright	Copyright (C) 2009 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.