Secunia

dB has reported a security issue in netOffice Dwins, which can be exploited by malicious people to bypass certain security restrictions.

The problem is that it is possible to access certain restricted pages of the application by e.g. setting the "demoSession" variable to 1. This can be exploited to e.g. upload a HTML file containing malicious script code via projects_site/uploadfile.php.

The security issue is reported in version 1.3 p2. Other versions may also be affected.

Solution
Update to version 1.3.1.

Provided and/or discovered by
dB

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area