Logitech Media Server 7.9.0 – ‘Radio URL’ Cross-Site Scripting

• Exploit Database
• 130 阅读

• 作者： Dewank Pant
  日期： 2017-11-03
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/43123/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

  # Exploit Title: Logitech Media Server : HTML code injection and execution. # Shodan Dork: Search Logitech Media Server # Date: 11/03/2017 # Exploit Author: Dewank Pant # Vendor Homepage: www.logitech.com # Version: 7.9.0 # Tested on: Windows 10, Linux # CVE : Applied For. POC: 1. Access and go to the Radio URL tab and add a new URL. 2. Add script as the value of the field. 3. Payload : <script> alert(1)</script> 4. Script saved and gives an image msg with a javascript execution on image click. 5. Therefore, Persistent XSS.