Xibo 'index.php' Multiple Directory Traversal Vulnerabilities

Summary
Xibo is prone to multiple directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input.
Impact
An attacker can exploit these issues using directory-traversal strings to retrieve arbitrary files outside of the webserver root directory. This may aid in further attacks
Solution
Upgrade to Xibo 1.4.2 or later.
Insight
Directory traversal vulnerabilities occur when user input is used in the construction of a filename or directory path which is subsequently used in some system function. If the input is not correctly validated or directory permissions not correctly set, it may be possible to cause a different file to be accessed other than that intended. This issue was exploited by adding a null byte (%00) which resulted in the application ignoring the rest of the supplied value after the null byte.
Affected
Xibo 1.2.2 and 1.4.1 are vulnerable other versions may also be affected.
Detection
Using directory-traversal strings in a HTTP GET request to determine if it is possible to access a local file.
References