A critical SQL injection vulnerability in ownDMS version 4.7 allows unauthenticated remote attackers to extract sensitive database information.

This is an SQL injection vulnerability located within the IMG parameter of the pdfstream.php, imagestream.php, and anyfilestream.php files. Unauthenticated attackers can supply crafted SQL payloads to these endpoints to interact with the backend database.

Successful exploitation allows an unauthorized attacker to perform arbitrary queries against the application database. This can lead to the exfiltration of sensitive organizational data, including administrative credentials and system configuration details. Given the CVSS score of 8.2, this vulnerability represents a high risk to data confidentiality and application integrity.

Immediate Action: As there is currently no official patch available, administrators should restrict network access to the affected PHP files or disable the affected components if they are not required for business operations.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax or unusual characters directed at the identified PHP scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, specifically targeting the IMG parameter in the URI.

Public Exploit Available: Yes, a functional exploit is available via the Exploit Database (EDB-ID: 46168).

Due to the availability of public exploit code and the ease of exploitation, this vulnerability poses a significant risk to any system running ownDMS 4.7. Organizations should prioritize isolating these systems from public-facing networks until a vendor-supplied security update is released and applied.