ID
VAR-E-201904-0091
CVE
| cve_id: | CVE-2019-11017 | Trust: 1.5 |
EDB ID
46687
TITLE
D-Link DI-524 V2.06RU - Multiple Cross-Site Scripting - Hardware webapps Exploit
Trust: 0.6
DESCRIPTION
D-Link DI-524 V2.06RU - Multiple Cross-Site Scripting. CVE-2019-11017 . webapps exploit for Hardware platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | d link | model: | di-524 v2.06ru | scope: | - | version: | - | Trust: 1.6 |
| vendor: | d link | model: | di-524 2.06ru | scope: | - | version: | - | Trust: 0.5 |
EXPLOIT
# Exploit Title: Multiple Stored and Reflected XSS vulnerabilities in D-Link DI-524
# Date: April 6, 2019
# Exploit Author: Semen Alexandrovich Lyhin (https://www.linkedin.com/in/semenlyhin/)
# Vendor Homepage: https://www.dlink.com
# Version: D-Link DI-524 - V2.06RU
# CVE : CVE-2019-11017
To re-create Reflected XSS vulnerability, log in to the Web Configuration (default credentials are: "admin":"" without double quotes), and send GET request to the router with malformed vulnerable parameter:
http://$IP/cgi-bin/smap?RC=@smap%22-$PAYLOAD-%22&rd=x&SEO=o&AC=O&SnO=1&SHO=2&StO=1&SpO=1&SPO=1
Where $IP may be equal to "192.168.0.1", $PAYLOAD may be equal to "alert(document.location)".
Stored XSS's were found in web forms on pages /spap.htm, /smap.htm. To inject malicious JavaScript to victim's webpage, an attacker should authorize on the router, then put a payload to any of the vulnerable forms, and wait, until victim opens router's web interface and goes to vulnerable page.
I haven't tested all the admin panel of the router, so I can guess that there are other XSS vulnerabilities in this router.
Trust: 1.0
EXPLOIT LANGUAGE
txt
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
Multiple Cross-Site Scripting
Trust: 1.6
TAGS
| tag: | Cross-Site Scripting (XSS) | Trust: 1.0 |
| tag: | exploit | Trust: 0.5 |
| tag: | xss | Trust: 0.5 |
CREDITS
Semen Alexandrovich Lyhin
Trust: 0.6
EXTERNAL IDS
| db: | EXPLOIT-DB | id: | 46687 | Trust: 1.6 |
| db: | NVD | id: | CVE-2019-11017 | Trust: 1.5 |
| db: | EDBNET | id: | 101309 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 152465 | Trust: 0.5 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2019-11017 | Trust: 1.5 |
| url: | https://www.exploit-db.com/exploits/46687/ | Trust: 0.6 |
SOURCES
| db: | PACKETSTORM | id: | 152465 |
| db: | EXPLOIT-DB | id: | 46687 |
| db: | EDBNET | id: | 101309 |
LAST UPDATE DATE
2022-07-27T09:26:51.861000+00:00
SOURCES RELEASE DATE
| db: | PACKETSTORM | id: | 152465 | date: | 2019-04-10T15:08:09 |
| db: | EXPLOIT-DB | id: | 46687 | date: | 2019-04-10T00:00:00 |
| db: | EDBNET | id: | 101309 | date: | 2019-04-10T00:00:00 |