Linksys WRT160N 'apply.cgi' Cross-Site Scripting Vulnerability

2008-11-27T00:00:00
ID EDB-ID:32599
Type exploitdb
Reporter David Gil
Modified 2008-11-27T00:00:00

Description

Linksys WRT160N 'apply.cgi' Cross-Site Scripting Vulnerability. CVE-2008-6280. Remote exploit for hardware platform

                                        
                                            source: http://www.securityfocus.com/bid/32496/info

Linksys WRT160N is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attackers may exploit this issue by enticing victims into opening a malicious URI.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may help the attacker steal cookie-based authentication credentials, cause denial-of-service conditions, and launch other attacks. 

http://www.example.com/apply.cgi?submit_button=DHCP_Static&action=--%3E%3CScRiPt%20%0A%0D%3Ealert(398343216433)%3B%3C%2FScRiPt%3E&wait_time=0&forward_single=15