OpenDocMan SQL Injection Vulnerability in Search.php

A SQL injection vulnerability has been identified in OpenDocMan version 1.3.4. This vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can exploit this issue by sending GET requests to search.php with malicious SQL payloads, potentially leading to the extraction of sensitive database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can manipulate database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a GET request to 'search.php' with the 'where' parameter containing a crafted SQL payload. The injection point is the 'where' parameter, which is vulnerable to SQL injection attacks.