In 2011 and beginning of 2012 I wrote about multiple vulnerabilities (http://securityvulns.ru/docs2
I present new vulnerabilities in this device. There are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in D-Link DAP 1150 (Wi-Fi Access Point and Router).
SecurityVulns ID: 12076.
-------------------------
Affected products:
-------------------------
Vulnerable is the next model: D-Link DAP 1150, Firmware version 1.2.94. This model with other firmware versions also must be vulnerable. D-Link ignored all vulnerabilities in this device (as in other devices, which I informed them about) and still didn't fix them.
----------
Details:
----------
I remind you, that in the first report about vulnerabilities in D-Link DAP 1150 (http://securityvulns.ru/docs2
CSRF (WASC-09):
In section Advanced / Device via CSRF it's possible to change device mode. If access point mode is on, then for attack on vulnerabilities in router mode it's needed to turn on this mode.
Turn on access point mode:
http://192.168.0.50/index.cgi?
Turn on router mode:
http://192.168.0.50/index.cgi?
CSRF (WASC-09):
In section Advanced / Remote access via CSRF it's possible to add, edit and delete settings of remote access to web interface. The next request will allow remote access to admin panel from IP 50.50.50.50.
Add:
http://192.168.0.50/index.cgi?
Edit:
http://192.168.0.50/index.cgi?
Delete:
http://192.168.0.50/index.cgi?
XSS (WASC-08):
These are persistent XSS. The code will execute in section Advanced / Remote access.
Attack via add function in parameter res_buf (in fields: IP address, Mask):
http://192.168.0.50/index.cgi?
Attack via edit function in parameter res_buf (in fields: IP address, Mask):
http://192.168.0.50/index.cgi?
I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/713
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
I present new vulnerabilities in this device. There are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in D-Link DAP 1150 (Wi-Fi Access Point and Router).
SecurityVulns ID: 12076.
-------------------------
Affected products:
-------------------------
Vulnerable is the next model: D-Link DAP 1150, Firmware version 1.2.94. This model with other firmware versions also must be vulnerable. D-Link ignored all vulnerabilities in this device (as in other devices, which I informed them about) and still didn't fix them.
----------
Details:
----------
I remind you, that in the first report about vulnerabilities in D-Link DAP 1150 (http://securityvulns.ru/docs2
CSRF (WASC-09):
In section Advanced / Device via CSRF it's possible to change device mode. If access point mode is on, then for attack on vulnerabilities in router mode it's needed to turn on this mode.
Turn on access point mode:
http://192.168.0.50/index.cgi?
Turn on router mode:
http://192.168.0.50/index.cgi?
CSRF (WASC-09):
In section Advanced / Remote access via CSRF it's possible to add, edit and delete settings of remote access to web interface. The next request will allow remote access to admin panel from IP 50.50.50.50.
Add:
http://192.168.0.50/index.cgi?
Edit:
http://192.168.0.50/index.cgi?
Delete:
http://192.168.0.50/index.cgi?
XSS (WASC-08):
These are persistent XSS. The code will execute in section Advanced / Remote access.
Attack via add function in parameter res_buf (in fields: IP address, Mask):
http://192.168.0.50/index.cgi?
Attack via edit function in parameter res_buf (in fields: IP address, Mask):
http://192.168.0.50/index.cgi?
I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/713
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua