Asseco SEE Live Local File Inclusion Vulnerability in Contact and Communication Components

A local file inclusion vulnerability has been identified in Asseco SEE Live version 2.0, specifically within the Contact Plan, E-Mail, SMS, and Fax components. This vulnerability allows remote authenticated users to access files on the host system by exploiting the 'path' parameter in the 'downloadAttachment' and 'downloadAttachmentFromPath' API calls.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the host system.

Reproduction

To reproduce this vulnerability, send a POST request to '/live20/index.php' with the 'requestType' and 'method' parameters set to 'HTTP' and 'Email.downloadAttachment' or 'Email.downloadAttachmentFromPath', respectively. Include the 'path' parameter with the desired file path, such as '/etc/passwd', and the 'downloadToken' parameter with a valid token. The 'model' parameter can also be included when using the 'downloadAttachmentFromPath' method.