Kloxo HostInABox 575 - file manager, view and edit any file



DESCRIPTION


Local users can view and edit the contents of any file via the File Manager.



IMPACT


Local users could obtain root privileges.


1. From the shell, create a hard link to the file to view or take control of:


[user1@host ~]$ ln /etc/shadow


2. Log into Kloxo
3. Click "File Manager"
4. Click "shadow"


The file can also be edited.