Marek Figielski

ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029

ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This issue has been fixed in version 2.4.18.029

**Name of the Vulnerable Software and Affected Versions** R-SOFT DMS versions prior to v3.19-2832 R-SOFT DMS versions prior to v3.17-2580 **Description** The file upload functionality allows an authenticated attacker to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. By injecting arbitrary HTML and JavaScript into the name of an uploaded file, the script will execute when other users view the file list or the upload status. **Recommendations** Update to version v3.19-2832 or later. Update to version v3.17-2580 or later.

**Name of the Vulnerable Software and Affected Versions** R-SOFT DMS versions prior to v3.19-2862 R-SOFT DMS versions prior to v3.17-2580 **Description** The software is susceptible to an Insecure Direct Object Reference (IDOR) attack across multiple file download endpoints. The application retrieves files from the database using an ID and provides them to any requester based solely on session authentication, allowing any authenticated user to access any file. **Recommendations** Update to version v3.19-2862. Update to version v3.17-2580.

**Name of the Vulnerable Software and Affected Versions** R-SOFT DMS versions prior to v3.19-2862 R-SOFT DMS versions prior to v3.17-2580 **Description** The Optical Character Recognition (OCR) module contains an OS Command Injection flaw. Multiple command execution functions process user-controllable file paths without adequate sanitization before they are passed to the system shell via SSH. While URL encoding prevents this during standard web uploads, an authenticated attacker can execute operating system commands with root privileges by triggering the OCR functionality for an uploaded file. **Recommendations** Update to version v3.19-2862 or later. Update to version v3.17-2580 or later. Restrict access to the OCR module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** R-SOFT DMS versions prior to v3.17-2000 **Description** The software stores superadmin credentials using a non-salted nested MD5 hash in its configuration. This improper credential storage uses broken cryptography, making the password hash a recoverable secret through offline cracking and rainbow-table attacks. An attacker who obtains the stored hash—via local access, backup leaks, or file disclosure—can recover the superadmin password. This is particularly critical as the password cannot be changed through the user interface and requires modifying the configuration file. Successful exploitation leads to full administrative control over the instance, allowing for data access, tampering, and service takeover. **Recommendations** Upgrade to version v3.17-2000.

**Name of the Vulnerable Software and Affected Versions** R-SOFT DMS versions prior to v3.19-2752 R-SOFT DMS versions prior to v3.17-2580 **Description** An OS Command Injection exists in the `konwertujAction()` function. The document converter executes shell commands using unsanitized file paths and format parameters, allowing an authenticated attacker to execute arbitrary system commands with the privileges of the web server user. **Recommendations** Update to version v3.19-2752. Update to version v3.17-2580. As a temporary workaround, restrict access to the `konwertujAction()` function.

**Name of the Vulnerable Software and Affected Versions** LEX Baza Dokumentów versions prior to 1.3.4 **Description** DOM-based Cross-Site Scripting (XSS) occurs when the application unsafely processes the `em` cookie parameter on the client side. This allows an attacker to execute arbitrary JavaScript within the victim's browser context. An attacker capable of setting a cookie could potentially increase the severity of the attack. **Recommendations** Update to version 1.3.4.