ownDMS 4.7 contains a SQL injection flaw that can be triggered by supplying a crafted value to the IMG parameter in the pdfstream.php, imagestream.php, and anyfilestream.php scripts. An unauthenticated attacker can send a simple HTTP GET request to these endpoints and cause the server to execute arbitrary SQL statements, allowing the attacker to read sensitive database information such as version names and other data stored in the database.

The vulnerability applies to all deployments of ownDMS version 4.7 that include the vulnerable image‑streaming PHP scripts. Regardless of user permissions, any instance of this software with the original pdfstream.php, imagestream.php, or anyfilestream.php files present is susceptible.

The CVSS score of 8.8 reflects a high severity risk. Because the flaw is reachable via unauthenticated HTTP requests, an attacker need only craft a URL with malicious IMG data; no prior authentication or privileged access is required. No EPSS score or KEV listing is available, but the nature of the vulnerability and its high CVSS indicate that exploitation is likely feasible in vulnerable, publicly accessible deployments.