Xibo 'index.php' Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	61352
Class:	Input Validation Error
CVE:	CVE-2013-5979
Remote:	Yes
Local:	No
Published:	Apr 02 2013 12:00AM
Updated:	Mar 19 2015 09:06AM
Credit:	Mahendra
Vulnerable:
Not Vulnerable:

Xibo 'index.php' Multiple Directory Traversal Vulnerabilities

Xibo is prone to multiple directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues using directory-traversal strings to retrieve arbitrary files outside of the webserver root directory. This may aid in further attacks

Xibo 1.2.2 and 1.4.1 are vulnerable; other versions may also be affected.

Xibo 'index.php' Multiple Directory Traversal Vulnerabilities

An attacker can exploit this issue using a web browser.

The following example URI is available:

http://www.example.com/index.php?p=../../../../../../../../../../../../../../../../etc/passwd%00index&q=About&ajax=true&_=1355779988

Xibo 'index.php' Multiple Directory Traversal Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Xibo 'index.php' Multiple Directory Traversal Vulnerabilities

References:

• Directory traversal in index.php (Amril Jafni Joehari)
  
• Xibo Directory Traversal Vulnerability (BAE Systems Detica)
  
• Xibo Homepage (Spring Signage Ltd)