MiniDVBLinux Arbitrary File Read Vulnerability

An arbitrary file disclosure vulnerability exists in MiniDVBLinux version 5.4. This vulnerability allows attackers to read sensitive system files by exploiting the 'file' GET parameter on the about page. The issue arises from improper validation of file paths, enabling the disclosure of arbitrary file contents on the affected device.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive system information and files on the affected device.

Reproduction

To reproduce this vulnerability, send a GET request to the about page with the 'file' parameter set to the path of the file to be disclosed. The response will include the contents of the specified file, revealing sensitive information from the system.