OpenKM Zero-Day: RCE, Unrestricted SQLi, and LFI Details

Vulnerability Overview Vulnerability Name: Critical OpenKM Zero-Day Vulnerabilities Vulnerability Type: - Remote Code Execution (RCE) - Unrestricted SQL Command Execution - Local File Inclusion (LFI) Vulnerability Description: - OpenKM is a widely used open-source document management system with over 6 million downloads. - Researchers have discovered multiple critical zero-day vulnerabilities that allow a single authenticated administrator to gain full control over the OpenKM server, backend database, and sensitive stored files. - These vulnerabilities include remote code execution via administrative scripts, unrestricted SQL command execution, and local file inclusion. Impact Scope Affected Versions: - OpenKM Community Edition 6.3.12 - OpenKM Pro Edition 7.1.47 Impact: - Remote code execution can lead to arbitrary operating system command execution, reverse shell generation, reading and modifying server files, installing persistent malware, and lateral movement. - Unrestricted SQL command execution can extract user credentials and password hashes, modify roles and permissions, add or delete documents and metadata, tamper with audit logs, and cause service denial. - Local file inclusion can read files accessible to the OpenKM process, including configuration files and credentials, leading to sensitive data leakage and further exploitation. Remediation Current Status: As of the time of writing, no official vendor patches are available, increasing the immediate risk for organizations relying on affected OpenKM deployments. Recommended Measures: - Organizations should independently verify their deployments and apply appropriate hardening measures. - Similar administrative functionalities have existed since earlier OpenKM versions, which may increase the exposure surface. - Terra System Labs is conducting ongoing efforts to identify and responsibly disclose high-risk vulnerabilities across a wide range of operating systems and application systems. POC Code 1. Remote Code Execution (V-01) 2. Unrestricted SQL Command Execution (V-02) 3. Local File Inclusion (V-03) Chained Attack Scenario Attack Steps: 1. Admin credential acquisition 2. SQL execution to extract sensitive data 3. LFI to reveal system secrets 4. RCE to gain full server control Complete Python Exploit Package Summary Vulnerability Severity: Critical Remediation Recommendation: Immediately apply official patches or implement temporary mitigation measures, such as restricting administrative access, enhancing input validation, and monitoring for anomalous activities. Research Team: Terra System Labs Research Team --- The above is a summary of key information regarding the OpenKM zero-day vulnerabilities from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

OpenKM Zero-Day: RCE, Unrestricted SQLi, and LFI Details