Vulners
Lucene search
D-Link DI-524 V2.06RU - Multiple Cross-Site Scripting Vulnerability
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | The vulnerability of D-Link DI-524 router’s microprogramming software lies in the lack of protective measures for the website structure, allowing attackers to inject arbitrary JavaScript code into the device’s web interface pages. | 4 Jul 201900:00 | – | bdu_fstec |
 | D-Link DI-524 Cross-Site Scripting Vulnerability | 12 Apr 201900:00 | – | cnvd |
 | D-Link DI-524 Cross-Site Scripting (CVE-2019-11017) | 16 Apr 201900:00 | – | checkpoint_advisories |
 | CVE-2019-11017 | 18 Apr 201917:54 | – | cve |
 | CVE-2019-11017 | 18 Apr 201917:54 | – | cvelist |
 | D-Link DI-524 V2.06RU - Multiple Cross-Site Scripting | 10 Apr 201900:00 | – | exploitdb |
 | EUVD-2019-2727 | 7 Oct 202500:30 | – | euvd |
 | D-Link DI-524 V2.06RU - Multiple Cross-Site Scripting | 10 Apr 201900:00 | – | exploitpack |
 | CVE-2019-11017 | 18 Apr 201918:29 | – | nvd |
 | CVE-2019-11017 | 18 Apr 201918:29 | – | osv |
10
# Exploit Title: Multiple Stored and Reflected XSS vulnerabilities in D-Link DI-524
# Exploit Author: Semen Alexandrovich Lyhin (https://www.linkedin.com/in/semenlyhin/)
# Vendor Homepage: https://www.dlink.com
# Version: D-Link DI-524 - V2.06RU
# CVE : CVE-2019-11017
To re-create Reflected XSS vulnerability, log in to the Web Configuration (default credentials are: "admin":"" without double quotes), and send GET request to the router with malformed vulnerable parameter:
http://$IP/cgi-bin/[email protected]%22-$PAYLOAD-%22&rd=x&SEO=o&AC=O&SnO=1&SHO=2&StO=1&SpO=1&SPO=1
Where $IP may be equal to "192.168.0.1", $PAYLOAD may be equal to "alert(document.location)".
Stored XSS's were found in web forms on pages /spap.htm, /smap.htm. To inject malicious JavaScript to victim's webpage, an attacker should authorize on the router, then put a payload to any of the vulnerable forms, and wait, until victim opens router's web interface and goes to vulnerable page.
I haven't tested all the admin panel of the router, so I can guess that there are other XSS vulnerabilities in this router.
# 0day.today [2019-04-12] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
10 Apr 2019 00:00Current
EPSS0.01121