Multiple Vulnerabilities in SeedDMS < = 4.3.3

[craig.arendt@xxxxxxxxxxxxxxxxxxx]

Product description:
============
SeedDMS is the continuation of LetoDMS because it has lost its main developer. 
SeedDMS is an easy to use but powerful Open Source Document Management System.
http://www.seeddms.org/index.php?id=2
============

SeedDMS Unprivileged User Remote Code Execution Vulnerability (CVE-2014-2278):
============
Missing Function Level Access Controls: The application will allow file uploads 
of any type without sufficient user access controls.

Any unprivileged user, including guest users can upload arbitrary file types, 
including script formats that will allow remote code execution on the server.

Details:
----------------------
The /op/op.AddFile2.php upload function is not sufficiently access controlled. 
The script path can be controlled using the ?fileId? parameter, which will 
allow an attacker to control the location of files to be uploaded to the 
system.  Using path traversal a user can traverse out of the configured upload 
path, and insert arbitrary files into the web root.

The ?partitionIndex? parameter is used for filename/extension specification in 
the path.

The CVE project assigned CVE-2014-2278 to this issue.
============


SeedDMS Path Traversal Vulnerability (CVE-2014-2279):
============
A user can use path traversal methods to return the contents of local files.

To exploit this vulnerability requires privileged access to the LogManagement 
application functionality.

Details:
----------------------
The /out/out.LogManagement.php script will allow local files to be retrieved 
from the server by path traversal using the ?logname? parameter.

The CVE project assigned CVE-2014-2279 to this issue.
============


SeedDMS Cross-site Scripting Vulnerability (CVE-2014-2280)
============
The application search feature is vulnerable to reflected cross-site scripting 
attacks.

Details:
----------------------
The ?query? parameter will accept scripting tags, which will be returned to the 
page without validation, or sanitization of HTML entities.

The CVE project assigned CVE-2014-2280 to this issue.
============


Vendor Response:
Upgrade to SeedDMS 4.3.4 or higher.
https://sourceforge.net/projects/seeddms/files/seeddms-4.3.4/

Timeline:
============
February 26, 2014, Vulnerability identified
February 26, 2014, Product vendor notification
February 26, 2014, Product vendor patch review
February 27, 2014, Product vendor fix confirmed
February 28, 2014, Patch released
March 14, 2014, 2014, Disclosure

Research:
============
Craig Arendt, Stratum Security
http://www.stratumsecurity.com

Disclaimer: 
----------------------
The information provided in this advisory is provided as is without warranty of 
any kind.