TP-Link TL-MR3220 - Cross-Site Scripting

EDB-ID: 43023
Author: Thiago Sena
Published: 2017-10-12
CVE: CVE-2017-15291
Type: Webapps
Platform: Hardware
Vulnerable App: N/A

 # Date: 12/10/2017 
# Exploit Author: Thiago "THX" Sena
# Vendor Homepage: http://www.tp-link.com.br
# Version: TL-MR3220
# Tested on: Windows 10
# CVE : CVE-2017-15291

Vulnerabilty: Cross-site scripting (XSS) in TP-LINK TL-MR3220
cve: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15291
---------------------------------------------------------------

PoC:

0x01 - First you go to ( http://IP:PORT/ )

0x02 - In the 'Wireless MAC Filtering' tab.

0x03 - Will add a new MAC Address.

0x04 - In 'Description' it will put the script ( <script>alert('XSS')</script> ) and complete the registration.

0x05 - Xss Vulnerability

--------------------------------------------------------------

Related Posts

Comments