CVE-2020-25134

Vulnerability

Observium Professional, Enterprise & Community version 20.8.10631 is vulnerable to directory traversal and local file inclusion via the /settings/ endpoint. The format parameter in pages/settings.inc.php lacks validation, allowing an attacker to use ../ sequences to include any file with a .inc.php extension from outside the intended directory [1].

Exploitation

An attacker must be authenticated to access the /settings/ page. The request uses a crafted format parameter, e.g., ?format=../../../includes/polling/wmi, which causes the application to include the target .inc.php file [1]. The limited extension restriction can still be exploited by uploading or placing arbitrary content in a .inc.php file reachable via traversal.

Impact

Successful inclusion of a malicious .inc.php file leads to remote code execution (RCE) on the server, as the included PHP code is executed in the context of the web application. This compromises the confidentiality, integrity, and availability of the system [1].

Mitigation

As of the publication date (2020-09-25), no fixed version was released. Users should restrict access to the /settings/ endpoint, ensure Input validation on the format parameter, and monitor for updates from Observium [1].