Description
openSIS Classic Community Edition v9.0 存在路径遍历漏洞。攻击者可以通过操控 DownloadWindow.php 文件中的 filename 参数，读取服务器上的任意文件。此漏洞允许未经身份验证的远程攻击者访问敏感文件，可能导致信息泄露。
openSIS v9.0 /DownloadWindow.php 目录遍历漏洞（CVE-2023-38879）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-38879
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38879.yaml
https://pentest-tools.com/vulnerabilities-exploits/opensis-v90-path-traversal_27152
https://s4e.io/tools/opensis-path-traversal-cve-2023-38879
https://www.cve.org/CVERecord?id=CVE-2023-38879
https://www.incibe.es/index.php/incibe-cert/alerta-temprana/vulnerabilidades/cve-2023-38879
https://www.threatquarters.com/cves/CVE-2023-38879
https://vulmon.com/searchpage?q=os4ed+opensis+9.0