Newgen Software Newgen OmniDocs Insecure Direct Object Reference Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Newgen OmniDocs versions through 12.0.00. The issue resides in the file '/omnidocs/WebApiRequestRedirection', where the 'DocumentId' parameter is not properly validated before being used to access documents. This lack of authorization checks allows remote attackers to manipulate the parameter and retrieve documents that should not be accessible, including sensitive client records and company registration files.

Impact

Exploitation of this vulnerability leads to unauthorized access to documents, potentially including sensitive information such as client-related records and company registration documents.