Xibo is prone to multiple directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues using directory-traversal strings to retrieve arbitrary files outside of the webserver root directory. This may aid in further attacks

Upgrade to Xibo 1.4.2 or later.

Directory traversal vulnerabilities occur when user input is used in the construction of a filename or directory path which is subsequently used in some system function. If the input is not correctly validated or directory permissions not correctly set, it may be possible to cause a different file to be accessed other than that intended. This issue was exploited by adding a null byte (%00) which resulted in the application ignoring the rest of the supplied value after the null byte.

Xibo 1.2.2 and 1.4.1 are vulnerable other versions may also be affected.

Using directory-traversal strings in a HTTP GET request to determine if it is possible to access a local file.

• http://www.securityfocus.com/bid/61352

---

Updated on 2015-03-25