Teradek VidiU Pro 3.0.3 – Cross-Site Request Forgery - 体验盒子

作者： LiquidWorm

日期： 2018-05-21

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/44671/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

<!--

Teradek VidiU Pro 3.0.3 CSRF Change Password Exploit

Vendor: Teradek, LLC

Product web page: https://www.teradek.com

Affected version: VidiU, VidiU Mini, VidiU Pro

3.0.3 (build 32136)

3.0.2 (build 31225)

2.4.10

Summary: The Teradek VidiU gives you the freedom to broadcast live

high definition video directly to the Web without a PC. Whether you're

streaming out of a video switcher or wirelessly from your camera,

VidiU allows you to go live when you want, where you want. VidiU

offers API level integration with the Ustream, YouTube Live and

Livestream platforms, which makes streaming to your channel as

easy as logging into your account.

Desc: The application interface allows users to perform certain

actions via HTTP requests without performing any validity checks

to verify the requests. This can be exploited to perform certain

actions with administrative privileges if a logged-in user visits

a malicious web site.

Tested on: lighttpd/1.4.48

lighttpd/1.4.31

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

@zeroscience

Advisory ID: ZSL-2018-5460

Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php

02.03.2018

-->

<html>

<body>

</form>

</body>

</html>