Cross site request forgery (csrf)

2018-04-0118:29:00

PRIOn knowledge base

www.prio-n.com

8.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.6%

JSON

DISPUTED An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn’t verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "

CPENameOperatorVersion
m1033-w_firmwareeq5.40.5.1

CPE	Name	Operator	Version
	m1033-w_firmware	eq	5.40.5.1

References

www.slideshare.net/secret/pRWQOOe6rN8Iyb