Vulnerability · Published Sep 29, 2021 · Assigned by mitre

CVE-2021-40651

Medium 6.5

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 17.9% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)17.9%top 2.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://youtu.be/wFwlbXANRCo x_refsource_MISC
https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md x_refsource_MISC
https://www.exploit-db.com/exploits/50259 x_refsource_MISC