Hi,

Yes, the vulnerability is csrf. Since there is no csrf protection we can
try some bruteforcing also.

The options are for bruteforcing the web interface password using a simple
scheme, just try to see whether it is same as that of WiFi key. Thatz all,
the bruteforcing method got removed later, need to remove the options as
well.

Let me know u'r comments.

Thanks,
On Mar 6, 2014 8:47 PM, "jvennix-r7" <notifications@github.com> wrote:

> In modules/auxiliary/admin/huawei/huawei_wifi_info.rb:
>
> > @@ -0,0 +1,506 @@
> > +##
> > +# This module requires Metasploit: http//metasploit.com/download
> > +# Current source: https://github.com/rapid7/metasploit-framework
> > +##
> > +require 'base64'
> > +require 'msf/core'
> > +
> > +class Metasploit3 < Msf::Auxiliary
> > +
> > +  include Msf::Exploit::Remote::HttpClient
> > +
> > +  def initialize(info={})
> > +    super(update_info(info,
> > +      'Name'           => "Huawei Datacard, CSRF Information Disclosure Vulnerability",
>
> Is this a CSRF exploit?
>
> --
> Reply to this email directly or view it on GitHub<https://github.com/rapid7/metasploit-framework/pull/3019/files#r10345311>
> .
>