Netis-WF2419 3.2.41381 Cross Site Scripting

`# Exploit Title: Netis-WF2419 HTML Injection  
# Date: 20/01/2018  
# Exploit Author: Sajibe Kanti  
# Author Contact :https://twitter.com/@sajibekantibd  
# Vendor Homepage: http://www.netis-systems.com/  
# Version: Netis-WF2419 , V3.2.41381  
# Tested on: Windows 10  
  
HTML Injection in Netis-WF2419  
  
  
  
Netis-WF2419 is prone to an HTML-injection vulnerability because it fails  
to sufficiently sanitize user-supplied data.  
  
Attacker-supplied HTML or script code could run in the context of the  
affected site, potentially allowing the attacker to steal cookie-based  
authentication credentials and control how the site is rendered to the  
user; other attacks are also possible.  
  
Netis-WF2419 is vulnerable;  
  
Proof of Concept:  
  
1. Go to your wireless router ip (ex. 192.168.0.1)  
  
2. Go to Wireless Settings - tab  
  
3. Now Click MAC Filtering -tab  
  
4.Write MAC Address and in -Description- write (<h1>XSS-PWD</h1>)  
  
5.Click Add  
  
6. Now You Can See HTML Injection  
  
  
  
#Solution:  
  
Upgrade Firmware  
  
#Thanks to :  
MD Omar Faruque Raju  
  
  
--   
Thanks  
Sajibe Kanti  
Independent Web Security Researcher <https://twitter.com/Sajibekantibd>  
`