Omnidocs – Multiple Vulnerabilities
-------------------------------------------------------------------- # Exploit Title: Multiple Vulnerability in "Omnidocs" # Date: 24 Sep 2011 # Author: Sohil Garg # Software Link: http://www.newgensoft.com/omnidocs.asp # Version: All # Tested on: Apache-Coyote/1.1 # CVE : CVE-2011-3645 � --------------------------------------------------- "Omnidocs" Multiple vulnerability. --------------------------------------------------- By � � � :Sohil Garg Email � �:sohil_garg@yahoo.co.in --------------------------------------------------- � Product Description: OmniDocs is an Enterprise Document Management (EDM) platform for creating, capturing, managing, delivering and archiving large volumes of documents and� contents. Also integrates seamlessly with other enterprise applications. � ------------------ Vulnerability ------------------ � 1.Vulnerbility Type Privilege escalation Affected URL:� http://serverIP/omnidocs/doccab/doclist.jsp?DocListFolderId=927964&FolderType=G&FolderRights=010000000&FolderName=1234&FolderOwner=test&FolderLocation=G&Fold erAccessType=I&ParentFolderIndex=100&FolderPathFlag=Y&Fetch=5&VolIndex=1&VolIndex=1 � Vulnerable Parameter:� FolderRights Exploit Omnidocs application does not validate 'FolderRights' parameter. This parameter could be modified to '111111111' to get full access including rights to add� documents, add folders, delete folders and place orders. 2.Vulnerability Type Direct Object Access Sample URL: http://serverIP/omnidocs/doccab/userprofile/editprofile.jsp Vulnerable Parameter: UserIndex Exploit: Omnidocs application does not validate 'UserIndex' parameter. 'UserIndex' parameter is used to access the personal setting page. This parameter can be� changed to other valid numbers thereby gaining access to view or change other user's personal settings. Timeline: Notified Vendor: 01-Sep-2011 No response received from vendor for 3 weeks Public Disclosure: 23-Sep-2011 ----------------------------------------------------- Greetz to: 1] Nikhil Mittal |