OpenPLI 3.0 Beta (OpenPLi-beta-dm7000-20130127-272) – Multiple Vulnerabilities

• Exploit Database
• 116 阅读

• 作者： m-1-k-3
  日期： 2013-02-14
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/24498/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66

  # Exploit Title: Multiple Vulnerabilities in OpenPLI # Date: 13.02.2013 # Exploit Author: m-1-k-3 # Vendor Homepage: http://openpli.org/ # Software Link: http://openpli.org/ # Version: v3.0 beta (OpenPLi-beta-dm7000-20130127-272) and below   Device Name: OpenPLI - Dream Multimedia Box with OpenPLI software Vendor of device: Dream Multimedia Vendor of Software: OpenPLI Community   ============ Device Details: ============   Linux Kernel Linux version 2.6.9 (build@plibouwserver) (gcc version 3.4.4) #1 Wed Aug 17 23:54:07 CEST 2011 Firmware release 1.1.0, 27.01.2013 FP Firmware 1.06 Web Interface 6.0.4-Expert - PLi edition by [lite]   More infos: http://openpli.org/   ============ Vulnerability Overview: ============   * OS Command Execution:   parameter: maxmtu   The vulnerability is caused by missing input validation in the maxmtu parameter and can be exploited to inject and execute arbitrary shell commands. It is possible to use Netcat to fully compromise the device.   http://Target-IP/cgi-bin/setConfigSettings?maxmtu=%26COMMAND%26&hddstandby=2&hddacoustics=160&timeroffsetstart=0&timeroffsetstop=0&audiochannelspriority=&showsatpos=on&trustedhosts=&epgcachepath=%2Fhdd&epgsqlpath=%2Fvar%2Flib%2Fsqlite   It is possible to shorten the URL to the following:   http://Target-IP/cgi-bin/setConfigSettings?maxmtu=%26COMMAND%26   There is Netcat preinstalled on the device. It is a very small edition of netcat, so you have to play a bit with it but you will get it ;)   * stored XSS:   Box Control -> Configuration -> Webserver -> User, Password   parameter: AuthUser, AuthPassword   Box Control -> Configuration -> Settings   parameter: audiochannelspriority   Injecting scripts into the parameter xxx reveals that this parameter is not properly validated for malicious input.   ============ Solution ============   No known solution available.   ============ Credits ============   The vulnerability was discovered by Michael Messner Mail: devnull#at#s3cur1ty#dot#de Web: http://www.s3cur1ty.de/advisories Twitter: @s3cur1ty_de   ============ Time Line: ============   October 2012 - disocovered vulnerability xx.02.2013 - public release   ===================== Advisory end =====================