Executive Summary

This vulnerability is a local file inclusion issue in the VertiGIS FM application, specifically in its upload and download process. Authenticated attackers can manipulate the file path during upload to read arbitrary files from the server when those files are later downloaded.

Because the application is built on ASP.NET, obtaining sensitive files like "web.config" could potentially allow attackers to execute remote code on the server.

Additionally, the application resolves UNC paths, which may enable NTLM-relaying attacks, further increasing the risk.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized access to sensitive files on the server.

If attackers obtain critical configuration files like "web.config", they might execute remote code, potentially taking control of the server.

The ability to perform NTLM-relaying attacks could allow attackers to impersonate users and escalate privileges within the network.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated attackers to read arbitrary files from the server by manipulating file paths during upload and download processes. This can lead to unauthorized access to sensitive data stored on the server.

Such unauthorized access to sensitive information could result in violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls over access to personal and protected health information.

Additionally, the potential for remote code execution and NTLM-relaying attacks increases the risk of further compromise, which could exacerbate non-compliance issues related to system integrity and data confidentiality.

Useful 0 Not Useful 0