CVE-2014-1946: OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to bypass an intended access restrictions and…

PriorityP260high8.8CVSS 3.0

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

2.58%

83.3th percentile

OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to bypass an intended access restrictions and assign administrative privileges to themselves via a crafted request to signup.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
opendocman	opendocman	<= 1.2.7	—

Detection & IOCsextracted from sources · hover to see the quote

path/ajax_udf.php↗

urlhttp://[host]/ajax_udf.php?q=1&add_value=odm_user%20UNION%20SELECT%201,version%28%29,3,4,5,6,7,8,9↗

→Monitor for authenticated POST/GET requests to /signup.php that include parameters attempting to set administrative privileges for the current user account (privilege escalation via crafted request). ↗
→Detect SQL injection attempts against /ajax_udf.php via the 'add_value' GET parameter, particularly payloads containing UNION SELECT sequences. ↗
→Flag HTTP requests to /ajax_udf.php containing URL-encoded SQL keywords such as UNION, SELECT, or version() in the add_value parameter. ↗

·CVE-2014-1946 (Improper Access Control) affects OpenDocMan 1.2.7 and earlier; CVE-2014-1945 (SQL Injection) is a separate but co-disclosed vulnerability in the same product/version. Ensure detections distinguish between the two CVEs targeting different scripts. ↗
·The access control bypass in signup.php requires the attacker to be authenticated; detections should correlate with valid session context rather than treating it as an unauthenticated threat. ↗
·The SQL injection in ajax_udf.php (CVE-2014-1945) is exploitable by unauthenticated users, making it a higher-priority detection target for perimeter controls. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.