CVE-2014-1945

OpenDocMan <1.2.7.2 - SQL Injection

Title source: llm

Description

SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the add_value parameter.

Exploits (1)

exploitdb WRITEUP

webappsphp

https://www.exploit-db.com/exploits/32075

View Code ZIP pw:eip

References (5)

[Vendor Advisory] http://secunia.com/advisories/56189

[Patch, Vendor Advisory] http://www.opendocman.com/opendocman-v1-2-7-1-release

[Patch, Vendor Advisory] http://www.opendocman.com/opendocman-v1-2-7-2-released

[Exploit] https://www.htbridge.com/advisory/HTB23202

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/65775

Scores

EPSS 0.0058

EPSS Percentile 68.9%

Details

CWE

CWE-89

Status published

Products (8)

opendocman/opendocman 1.2.6.2 (3 CPE variants)

opendocman/opendocman 1.2.6.3 (2 CPE variants)

opendocman/opendocman 1.2.6.5

opendocman/opendocman 1.2.6.6

opendocman/opendocman 1.2.6.7 (2 CPE variants)

opendocman/opendocman 1.2.6.8

opendocman/opendocman 1.2.7

opendocman/opendocman < 1.2.7.1

Published Mar 09, 2014

Tracked Since Feb 18, 2026