ProcessMaker Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in ProcessMaker version 3.5.4. This vulnerability allows unauthenticated attackers to read arbitrary files by exploiting improper validation of file paths. Attackers can send requests that include directory traversal sequences to access sensitive system files, such as /etc/passwd, without needing authentication.

Impact

Exploitation of this vulnerability allows for local file inclusion, where an attacker can read arbitrary files on the server. This could lead to the disclosure of sensitive information, such as password files or application configuration files.

Reproduction

The vulnerability can be reproduced by sending a request to the ProcessMaker application with directory traversal sequences in the URL. This can be done using a tool like curl or the Jaeles scanner. The request should include the traversal sequences needed to access the desired file, such as /etc/passwd.