CVE-2021-40651

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 18%

exploitation probability

18%top 3% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/50259unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md https://www.exploit-db.com/exploits/50259 https://youtu.be/wFwlbXANRCo