Netis WF2419 Router – Cross-Site Scripting

• Exploit Database
• 116 阅读

• 作者： Sajibe Kanti
  日期： 2018-02-05
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/43981/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

  # Exploit Title: Netis-WF2419 HTML Injection # Date: 20/01/2018 # Exploit Author: Sajibe Kanti # Author Contact :https://twitter.com/@sajibekantibd # Vendor Homepage: http://www.netis-systems.com/ # Version: Netis-WF2419 , V3.2.41381 # Tested on: Windows 10   # CEV : CVE-2018-6190     HTML Injection in Netis-WF2419       Netis-WF2419 is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.   Attacker-supplied HTML or script code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.   Netis-WF2419 is vulnerable;   Proof of Concept:   1. Go to your wireless router ip (ex. 192.168.0.1)   2. Go to Wireless Settings - tab   3. Now Click MAC Filtering -tab   4.WriteMAC Address and in -Description- write (<h1>XSS-PWD</h1>)   5.Click Add   6. Now You Can See HTML Injection       #Solution:   Upgrade Firmware