This vulnerability allows an attacker to read arbitrary files on the server hosting the application.
This type of vulnerability can lead to several impacts:
- Reading confidential data on the system (source code, identification information, personal information)
- Modification of file integrity (example: modify the application code to change its behavior)
Linux :
https://insecure-website.com/loadImage?filename=../../../etc/passwd
Windows :
https://insecure-website.com/loadImage?filename=..\..\..\windows\win.ini