[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] CVE-2017-5900
From: Luke Symons <rezkon93 () gmail ! com>
Date: 2017-03-27 9:09:24
Message-ID: CAEsPrH0m3y=6pZNBM1TXRL76LPrYu6qqbYcMP-d4U=wyoYkRNg () mail ! gmail ! com
[Download RAW message or body]
Hi,
Mitre has provided the following with the CVE number: CVE-2017-5900
there is a Stored XSS vulnerability in a NetComm router's model NB16WV-02
running version NB16WV_R0.09, If authorized user is able to inject the
following string
POC:
Authenticated user is required:
http://<router_IP>/hdd.htm?rc=&S801F0334=/dkmvc%3C/script
%3E%3Cscript%3Ealert%28String.fromCharCode%28101,90,101,90%29
%29%3C/script%3Ed29f
Stored XSS will be injected and execute on the page reload.
This vulnearbilty can be used to steal session, cookies and many more.
NetComm will be releasing a patch in the coming weeks to address
this issue.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic