Netis WF2419 Router – Cross-Site Scripting

• Exploit Database
• 23 阅读

• 作者： Sajibe Kanti
  日期： 2018-02-05
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/43981/

• # Exploit Title: Netis-WF2419 HTML Injection
  # Date: 20/01/2018
  # Exploit Author: Sajibe Kanti
  # Author Contact :https://twitter.com/@sajibekantibd
  # Vendor Homepage: http://www.netis-systems.com/
  # Version: Netis-WF2419 , V3.2.41381
  # Tested on: Windows 10
  
  # CEV : CVE-2018-6190
  
  
   HTML Injection in Netis-WF2419
  
  
  
  Netis-WF2419 is prone to an HTML-injection vulnerability because it fails
  to sufficiently sanitize user-supplied data.
  
  Attacker-supplied HTML or script code could run in the context of the
  affected site, potentially allowing the attacker to steal cookie-based
  authentication credentials and control how the site is rendered to the
  user; other attacks are also possible.
  
  Netis-WF2419 is vulnerable;
  
  Proof of Concept:
  
  1. Go to your wireless router ip (ex. 192.168.0.1)
  
  2. Go to Wireless Settings - tab
  
  3. Now Click MAC Filtering -tab
  
  4.WriteMAC Address and in -Description- write (<h1>XSS-PWD</h1>)
  
  5.Click Add
  
  6. Now You Can See HTML Injection
  
  
  
  #Solution:
  
   Upgrade Firmware