CVE-2021-40651
MEDIUM NUCLEIOS4Ed OpenSIS Community 8.0 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-40651. PoCs published by Eric Salario. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in OpenSIS 8.0 via the 'modname' parameter in 'Modules.php', allowing unauthorized access to arbitrary files on the server. The PoC requires authentication as a 'Parent' user and uses path traversal sequences to read sensitive files like '/etc/passwd'.
Description
OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.
Exploits (1)
This exploit demonstrates a directory traversal vulnerability in OpenSIS 8.0 via the 'modname' parameter in 'Modules.php', allowing unauthorized access to arbitrary files on the server. The PoC requires authentication as a 'Parent' user and uses path traversal sequences to read sensitive files like '/etc/passwd'.
Nuclei Templates (1)
title:"openSIS" || http.title:"opensis"
title="opensis"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N