CVE-2018-25421
Path Traversal in Open STA Manager via Backup Module
Publication date: 2026-05-30
Last updated on: 2026-05-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| open_sta_manager | open_sta_manager | to 2.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for HTTP GET requests to the endpoint modules/backup/actions.php with the parameter op=getfile where the file parameter contains directory traversal sequences such as ../.
A typical suspicious request might look like: /modules/backup/actions.php?op=getfile&file=../../../../../etc/passwd or similar paths attempting to access sensitive files.
To detect exploitation attempts on your system, you can use network monitoring tools or web server logs to search for such patterns.
- Using grep on web server access logs to find suspicious requests: grep "modules/backup/actions.php?op=getfile&file=.." /var/log/apache2/access.log
- Using network monitoring tools like tcpdump or Wireshark to filter HTTP GET requests containing 'op=getfile' and '../' sequences.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint to only trusted authenticated users and implementing input validation or sanitization on the 'file' parameter to prevent directory traversal sequences.
If possible, update or patch Open STA Manager to a version that fixes this vulnerability.
As a temporary workaround, you can configure your web server or application firewall to block requests containing suspicious patterns such as '../' in the file parameter.
Monitor logs for exploitation attempts and revoke or limit user privileges to reduce the risk of authenticated attackers exploiting this flaw.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Open STA Manager 2.3 allows authenticated users to download arbitrary files, including sensitive system files, by exploiting a path traversal flaw. This unauthorized access to sensitive files could lead to exposure of personal or confidential data.
Such exposure can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to sensitive and personal data to prevent unauthorized disclosure.
However, the provided context and resources do not explicitly discuss the direct impact of this vulnerability on compliance with these standards.
Can you explain this vulnerability to me?
This vulnerability is a path traversal flaw in Open STA Manager version 2.3 that allows authenticated users to download arbitrary files from the server.
Attackers exploit this by manipulating the 'file' parameter in a GET request to the modules/backup/actions.php script with the operation 'op=getfile'.
By using directory traversal sequences like '../', an attacker can bypass directory restrictions and access sensitive system files outside the intended directory.
The vulnerability exists because the application does not properly validate or sanitize the user-supplied 'file' parameter before fetching and serving files.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive system files by authenticated users, including technicians, agents, or customers.
An attacker could download configuration files, password files, or other sensitive data stored on the server, potentially exposing critical information.
Such exposure could aid further attacks, compromise system security, or lead to data breaches.