search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Hummingbird CyberDOCS vulnerable to SQL injection

Vulnerability Note VU#368300

Original Release Date: 2003-10-09 | Last Revised: 2003-10-09


Hummingbird CyberDOCS contains an SQL injection vulnerability that could allow a remote attacker to execute SQL commands.


Hummingbird CyberDOCS (Hummingbird DM) is a web-based enterprise document management solution that runs on Windows NT/2000 using SQL database technology. The login page (loginact.asp on IIS) does not properly filter user input, allowing a remote attacker to supply SQL commands that may be executed by the underlying database.


Depending on the configuration of the database system, an unauthenticated, remote attacker may be able to execute operating system commands, modify databases, or determine system configuration information.



This vulnerability does not exist in CyberDOCS 3.9 or later. Hummingbird recommends that customers upgrade to the most recent version of CyberDOCS.

Limit SQL database user privileges

To limit the effects of a successful attack, configure SQL databases to run with limited user privileges.

Vendor Information


Hummingbird Affected

Notified:  September 18, 2003 Updated: October 09, 2003



Vendor Statement

CyberDOCS - Potential to Pass Harmful SQL Statements Via a Browser Request

Problem: In CyberDOCS (versions 3.1 and 3.5.1), it is possible to pass a potentially harmful SQL statement to the system as part of the username/password string.

Resolution: This issue does not occur in CyberDOCS 3.9 and later. Customers experiencing this issue should upgrade to the latest release of this product.

Reference: SD017068

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



This vulnerability was discovered and reported by ProCheckUp.

This document was written by Art Manion.

Other Information

CVE IDs: None
Severity Metric: 3.90
Date Public: 2003-10-06
Date First Published: 2003-10-09
Date Last Updated: 2003-10-09 16:24 UTC
Document Revision: 23

Sponsored by CISA.