External risk intelligence

Online Banking System Local File Inclusion Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-26646

The product is an Online Banking System. Banking applications are web-based software designed to be accessible via the internet for customers to manage accounts, making it highly probable that this service is deployed as an internet-facing web application.

Oretnom23 Banking System

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in an online banking system that could allow unauthorized access to sensitive information. This issue stems from a flaw in how the system handles requests, potentially exposing system files.

Local file access flaw in banking software.
Exposes system files, affecting data integrity.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by submitting a crafted request to the online banking system, likely through its web interface, targeting the `pages` parameter. This could allow them to include arbitrary local files from the server's file system, potentially leading to the disclosure of sensitive information, modification of data, or even execution of code.

No authentication or special access needed.
Requests to the `pages` parameter.
Leads to information disclosure or code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to access sensitive system files when the banking system is running. The local file inclusion flaw in the "pages" parameter means an attacker could potentially read configuration files or other data stored on the server.

System files could be accessed.
An attacker could exploit the "pages" parameter.
Unauthorized access to system information may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in an online banking system likely falls under the responsibility of the application owner and the platform or infrastructure team responsible for its deployment. The first practical step is to identify all instances of the affected banking system, determine its reachability and business criticality, locate the accountable owner, and then prioritize remediation based on the assessed risk.

Application owners should manage remediation.
Verify system reachability and business impact.
Plan maintenance for risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the oretnom23 banking_system software?

The oretnom23 banking_system is a web-based application designed for managing financial accounts. It serves as a digital platform where users interact with banking services. Because it handles sensitive financial data, the software is built to be hosted on servers, providing an interface for customers to perform online banking tasks.

What is a local file inclusion vulnerability in CVE-2022-26646?

This is a security weakness where an application fails to properly sanitize user-supplied input. In this case, the software uses the 'pages' parameter to fetch content. Because it does not restrict access, an attacker can manipulate this parameter to point the application toward restricted files on the server instead of intended web pages, allowing them to read sensitive data or potentially execute unauthorized code.

How is the pages parameter used to trigger this vulnerability?

An attacker triggers this flaw by sending a specifically crafted request to the web application's 'pages' parameter. The system interprets this input as a command to retrieve a file from the local server storage. Note that the vulnerability is not triggered by standard, legitimate navigation of the banking site, but rather by providing malicious input designed to traverse the server's directory structure.

Is my instance of this software at risk?

According to Halo Surface Signal, this software is commonly deployed as an internet-facing web application to support remote banking access. If your installation is accessible via the internet, it is considered more reachable by external actors. You should assess whether your specific deployment is public-facing or restricted to an internal network to determine the immediate relevance of this threat.

What should I do if I am running this banking system?

Begin by identifying all servers currently running this version of the banking system. Determine which ones are reachable from the network and evaluate their role in your environment. Once identified, notify the system owners and coordinate with your infrastructure team to prioritize the assessment of these assets and prepare for necessary updates or configuration changes to secure the affected parameter.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.