A critical SQL injection vulnerability in OpenDocMan 1.3.4 allows unauthenticated attackers to extract sensitive database information through malicious GET requests.

This is an SQL injection (CWE-89) vulnerability occurring in the search.php endpoint. An unauthenticated attacker can inject malicious SQL payloads into the where parameter to bypass standard query logic and retrieve data from the backend database.

The vulnerability carries a CVSS score of 8.2, which reflects the high risk of unauthorized data exposure. Successful exploitation allows an attacker to compromise the confidentiality of the entire database, potentially leading to the theft of sensitive documents, user credentials, or system configuration details. This represents a significant risk to organizational data privacy and compliance.

Immediate Action: Upgrade OpenDocMan to the latest available version that patches this SQL injection vulnerability. If an update is not immediately feasible, restrict access to the search.php file at the web server level.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests targeting search.php, specifically looking for SQL syntax patterns or unusual characters within the where parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP request parameters.

Public Exploit Available: Yes, a published proof-of-concept exploit exists on Exploit-DB (EDB-ID: 46500).

Given the availability of a public exploit and the ease of exploitation, this vulnerability poses a high risk to any organization running OpenDocMan 1.3.4. Administrators must prioritize updating the software to a patched version immediately to prevent unauthorized database access and potential data exfiltration.