发布 2018-06-25 漏洞条目

Intex Router N-150 – Cross-Site Request Forgery (Add Admin)

Exploit Source

# Exploit Title: Intex Router N-150 - Cross-Site Request Forgery (Add Admin)

# Date: 2018-06-23

# Exploit Author: Navina Asrani

# Version: N-150

# CVE : N/A

# Category: Router Firmware

# 1. Description

# The firmware allows malicious request to be executed without verifying

# source of request. This leads to arbitrary execution with malicious request

# which will lead to the creation of a privileged user..

# 2. Proof of Concept

# Visit the application

# Go to any router setting modification page and change the values,

# create a request and observe the lack of CSRF tokens.

# Craft an html page with all the details for the built-in admin

# user creation and host it on a server

# Upon the link being clicked by a logged in admin user,

# immediately, the action will get executed

# Exploitation Technique: A attacker can create a rogue admin user to gain

# access to the application.

# Exploit code:

<html>

<body>

</form>

</body>

</html>

相关漏洞条目