PT-2025-14541 · Os4Ed · Os4Ed Opensis

Published 2025-04-02 · Updated 2025-07-17 · CVE-2025-22923

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OS4ED openSIS versions 8.0 through 9.1

Description An issue in OS4ED openSIS allows attackers to execute a directory traversal and delete files by sending a crafted POST request. The attack targets the /Modules.php?modname=users/Staff.php&removefile endpoint. A crafted POST request can be used to perform directory traversal, potentially leading to unauthorized file deletion.

Recommendations OS4ED openSIS version 8.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. OS4ED openSIS version 8.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. OS4ED openSIS version 8.2 through 9.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. OS4ED openSIS version 9.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-22923

Affected Products

Os4Ed Opensis

References · 10

• 🔥 https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22923 · Exploit
• https://osv.dev/vulnerability/CVE-2025-22923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22923 · Security Note
• https://github.com/OS4ED/openSIS-Classic · Note
• https://twitter.com/cybercronai/status/1908452184473161762 · Twitter Post
• https://twitter.com/SecAideInfo/status/1908462774050599328 · Twitter Post
• https://t.me/cvetracker/20617 · Telegram Post
• https://t.me/cvenotify/129328 · Telegram Post
• https://t.me/cvedetector/21925 · Telegram Post
• https://twitter.com/CVEnew/status/1907551268580765766 · Twitter Post