D-Link DIR-300 Cross Site Scripting and Security Bypass Vulnerabilities
BID:33556
Info
D-Link DIR-300 Cross Site Scripting and Security Bypass Vulnerabilities
| Bugtraq ID: | 33556 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 02 2009 12:00AM |
| Updated: | Feb 03 2009 04:09PM |
| Credit: | Muhaimin Dzulfakar |
| Vulnerable: |
D-Link DIR-300 0 |
| Not Vulnerable: | |
Discussion
D-Link DIR-300 Cross Site Scripting and Security Bypass Vulnerabilities
D-Link DIR-300 is prone to a cross-site scripting vulnerability and a security-bypass vulnerability.
An attacker may exploit these issues to bypass authentication or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The issues affect D-Link DIR-300 with firmware 1.04-tomi-1.1.2.
D-Link DIR-300 is prone to a cross-site scripting vulnerability and a security-bypass vulnerability.
An attacker may exploit these issues to bypass authentication or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The issues affect D-Link DIR-300 with firmware 1.04-tomi-1.1.2.
Exploit / POC
D-Link DIR-300 Cross Site Scripting and Security Bypass Vulnerabilities
An attacker can exploit these issues by using standard tools. To exploit the cross-site scripting issue, the attacker must entice an unsuspecting user to follow a malicious URI.
An attacker can exploit these issues by using standard tools. To exploit the cross-site scripting issue, the attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
D-Link DIR-300 Cross Site Scripting and Security Bypass Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]
References
D-Link DIR-300 Cross Site Scripting and Security Bypass Vulnerabilities
References:
References:
- Vendor Homepage (D-Link)