Wednesday, January 22, 2020

[A1] - Modem WLAN Box ADB VV2220v2 Authenticated XSS

A1 WLAN Modems are find commonly in Austria. The WLAN Box ADB VV2220v2 Modem is vulnerable to an Authenticated Cross-site Scripting.





First of all, you need to find this kind of Modem on shodan, there is 49 results until today. Then you need to authenticate with Administrator credentials.



Then you need to create a new user in the Storage Service.

When you're creating or modifying a User, in the username field add the XSS payload (“><script>alert(123);</script>), and save it.



After saving, the payload will be executed as planned, woala!



This only works authenticated.

mpx

Autor

0 comentarios:

Post a Comment

 
biz.