Details of VAR-E-201711-0161

ID

VAR-E-201711-0161

CVE

cve_id:

CVE-2017-16819

Trust: 1.0

sources: EXPLOIT-DB: 43158

EDB ID

43158

TITLE

Icon Time Systems RTC-1000 Firmware 2.5.7458 - Cross-Site Scripting - Hardware webapps Exploit

Trust: 0.6

sources: EXPLOIT-DB: 43158

DESCRIPTION

Icon Time Systems RTC-1000 Firmware 2.5.7458 - Cross-Site Scripting. CVE-2017-16819 . webapps exploit for Hardware platform

Trust: 0.6

sources: EXPLOIT-DB: 43158

AFFECTED PRODUCTS

vendor:

icon

model:

time systems rtc-1000

scope:

version:

2.5.7458

Trust: 1.6

sources: EXPLOIT-DB: 43158 // EDBNET: 95103

EXPLOIT

# Exploit Title: Icon Time Systems RTC-1000 (<= v2.5.7458) Universal Time Clocks Stored XSS Vulnerability
# Date: 17-11-2017
# Vendor: http://www.icontime.com/
# Version: <= v2.5.7458
# Exploit Author: Keith Thome
# Contact: https://twitter.com/keiththome
# Website: https://www.keiththome.com/rtc-1000-vuln
# CVE: CVE-2017-16819
# Type: Remote
# Platform: Hardware

==========================================================

# Introduction
The Icon Time Systems RTC-1000 (firmware v2.5.7458 and below) Universal Time Clock device is susceptible to a stored Cross Site Scripting (XSS) vulnerability that facilitates session hijacking. Injecting a session hijacking XSS payload into the ‘First Name’ field of an employee record on the employee.html webpage results in payload execution wherever this employee's first name appears in subsequent webpages. Caveat: To exploit this vulnerability, the attacker does need valid credentials to access the device and those credentials must have permissions to change employee names.

==========================================================

# Vulnerable URL (Employee Maintenance Module)
/employee.html

# Vulnerable parameter(s)
- First Name input ID: nameFirst

# Sample payload
<script>alert("xss");</script>

==========================================================

# PROOF OF CONCEPT
- With valid credentials that has permissions to modify the employee records, access the employeelist.html page via Lists->Employees
- Click on an active employee or Show Inactive to modify an employee record.
- Click on the employee id or name to access the vulnerable employee.html page.
- In the First Name field, enter a XSS payload.
- Click Submit
- Once any user accesses a page where that employee's first name is displayed, the XSS will be executed. Ie. employeelist.html that lists all employees.

==========================================================

# Timeline
- 09/08/2017 - Vulnerability discovered.
- 09/15/2017 - Vendor informed.
- 09/19/2017 - Vendor informed.
- 09/19/2017 - Vendor acknowleged and indicated patch development underway.
- 10/24/2017 - Emailed vendor for update. No response.
- 11/17/2017 - Public Disclosure

Trust: 1.0

sources: EXPLOIT-DB: 43158

EXPLOIT LANGUAGE

txt

Trust: 0.6

sources: EXPLOIT-DB: 43158

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 43158

TYPE

Cross-Site Scripting

Trust: 1.6

sources: EXPLOIT-DB: 43158 // EDBNET: 95103

CREDITS

Keith Thome

Trust: 0.6

sources: EXPLOIT-DB: 43158

EXTERNAL IDS

db:	EXPLOIT-DB	id:	43158	Trust: 1.6
db:	NVD	id:	CVE-2017-16819	Trust: 1.0
db:	EDBNET	id:	95103	Trust: 0.6

sources: EXPLOIT-DB: 43158 // EDBNET: 95103

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2017-16819	Trust: 1.0
url:	https://www.exploit-db.com/exploits/43158/	Trust: 0.6

sources: EXPLOIT-DB: 43158 // EDBNET: 95103

SOURCES

db:	EXPLOIT-DB	id:	43158
db:	EDBNET	id:	95103

LAST UPDATE DATE

2022-07-27T09:51:38.467000+00:00

SOURCES RELEASE DATE

db:	EXPLOIT-DB	id:	43158	date:	2017-11-17T00:00:00
db:	EDBNET	id:	95103	date:	2017-11-22T00:00:00