CVE-2014-1946

Description

OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to bypass an intended access restrictions and assign administrative privileges to themselves via a crafted request to signup.php.

Primary references

• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory