Netis-WF2419 HTML Injection

`# Exploit Title: Netis-WF2419 HTML Injection  
# Date: 20/12/2017  
# Exploit Author: Sajibe Kanti  
# Vendor Homepage: http://www.netis-systems.com/  
# Version: Netis-WF2419 , V2.2.36123  
# Tested on: Windows 8.1  
  
HTML Injection in Netis-WF2419  
  
  
  
Netis-WF2419 is prone to an HTML-injection vulnerability because it fails  
to sufficiently sanitize user-supplied data.  
  
Attacker-supplied HTML or script code could run in the context of the  
affected site, potentially allowing the attacker to steal cookie-based  
authentication credentials and control how the site is rendered to the  
user; other attacks are also possible.  
  
Netis-WF2419 is vulnerable;  
  
Proof of Concept:  
  
1. Go to your wireless router ip (ex. 192.168.0.1)  
  
2. Go to Bandwidth Control - tab  
  
3. Now Click Bandwidth Control Rule Settings -tab  
  
4.Write random ip Address and in -Description- write (<h1>XSS-PWD</h1>)  
  
5.Click Add  
  
6. Now You Can See HTML Injection  
  
  
  
#Solution:  
  
Upgrade Firmware  
  
--   
Thanks  
Sajibe Kanti  
Independent Web Security Researcher <https://twitter.com/Sajibekantibd>  
`