Linksys WAP54Gv3 Wireless Router – ‘debug.cgi’ Cross-Site Scripting

Exploit Database
110 阅读

作者： Cristofaro Mune

日期： 2010-06-23
类别：
- remote
平台：
- hardware
来源：https://www.exploit-db.com/exploits/34182/

source: https://www.securityfocus.com/bid/41061/info

Linksys WAP54Gv3 Wireless Router is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attackers may exploit this issue by enticing victims into visiting a malicious site.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following firmware versions are vulnerable:

3.05.03 (Europe)

3.04.03 (US)

The following example input to the vulnerable parameter is available:

echo "</textarea><script>alert('XSS');</script>"

last Exploits
Linksys WAP54Gv3 Wireless Router – ‘debug.cgi’ Cross-Site Scripting的更多信息

DoubleTake/HP StorageWorks Storage Mirroring Service – Authentication Overflow (Metasploit)：
Flashcard Quiz App v1.0 – ‘card’ SQL Injection：
Opera Browser 10/11/12 – ‘SVG Layout’ Memory Corruption (Metasploit)：
FileCOPA FTP Server (Pre 18 Jul Version) – ‘LIST’ Remote Buffer Overflow (Metasploit)：
activePDF WebGrabber – ActiveX Control Buffer Overflow (Metasploit)：
CUPS < 2.0.3 - Remote Command Execution：
Veritas Backup Exec Name Service – Remote Overflow (Metasploit)：
SolarWinds Log and Event Manager/Trigeo SIM 6.1.0 – Remote Command Execution：