openSIS "modname" Local File Inclusion Vulnerability
Description
A vulnerability has been discovered in openSIS, which can be exploited by malicious users to disclose certain sensitive information.
Input passed via the "modname" parameter to ajax.php (while "bypass" is set to "Transcripts.php") is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal sequences.
The vulnerability is confirmed in Community Edition, version 5.1. Other versions may also be affected.
