OS4ED openSIS Insecure Direct Object Reference Vulnerability Allowing Unauthorized File Access

A vulnerability allowing unauthorized access to staff-uploaded files has been identified in OS4ED openSIS versions 7.0 through 9.1. This insecure direct object reference (IDOR) issue is located in the '/assets/stafffiles' component, where files are stored using a naming convention that includes the staff member's ID. An unauthenticated attacker can enumerate the directory and retrieve any of the saved files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files uploaded by staff members.

Reproduction

To reproduce this vulnerability, access the '/assets/stafffiles' directory on an openSIS installation within the vulnerable version range. Files can be retrieved by exploiting the IDOR, as they are stored with a naming convention that includes the staff ID and filename. An unauthenticated attacker can enumerate the directory to access these files.