Vox TG790 ADSL Router – Cross-Site Request Forgery (Add Admin) - 体验盒子

作者： cakes

日期： 2018-08-24

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/45252/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

# Title: Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)

# Author: Cakes

# Exploit Date: 2018-08-01

# Vendor: Vox Telecom

# Link: https://www.vox.co.za/

# Firmware Version: 6.2.W.1

# CVE: N/A

# Description

# Due to improper session management low privilege users are able to create

# administrator accounts through a crafted POST request.

# PoC

<html>

<br />

<br />

</form>

</html>