Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:11620
HistoryFeb 28, 2006 - 12:00 a.m.

Thomson SpeedTouch 500 modems vulnerable to XSS

2006-02-2800:00:00
vulners.com
16

TITLE:
Thomson SpeedTouch 500 series vulnerable to XSS

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

SOFTWARE:
SpeedTouch 5.3.2.6.0

DESCRIPTION:
There consists a vulnerability in the SpeedTouch modems, which
can be exploited by malicious people to conduct cross-site scripting
attacks, and make a counseled user

Input passed to the LocalNetwork page isn't properly sanitized before being
returned to the user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected site.

Such code can also be added through a proxy, because user validation
is only done by JavaScript. If a user is made with injected scripting code
this user will become un-delete able if the code is crafted correctly.

PoC #1 - XSS

http://[host]/cgi/b/intfs/intf/ov/?ce=1&be=0&l0=3&l1=1&name=[code here]

PoC #2 - Stealthy user (through proxy)

0=10&1=usrAccApply&34=NewUser&36=1&33=test&31=[code here]

SOLUTION:
Check vendor's site for firmware upgrade.
As of this writing, none is available

PROVIDED AND DISCOVERED BY:
Preben NylΓΈkken