ASUS RT-AC68U 'apply.cgi' Cross Site Scripting Vulnerability
BID:66669
Info
ASUS RT-AC68U 'apply.cgi' Cross Site Scripting Vulnerability
| Bugtraq ID: | 66669 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-2925 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 04 2014 12:00AM |
| Updated: | Apr 23 2014 07:01PM |
| Credit: | Joaquim Brasil de Oliveira |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
ASUS RT-AC68U 'apply.cgi' Cross Site Scripting Vulnerability
ASUS RT-AC68U router is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
ASUS RT-AC68U router is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Exploit / POC
ASUS RT-AC68U 'apply.cgi' Cross Site Scripting Vulnerability
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
The following example URI is available:
https://www.example.com/apply.cgi?next_page=Advanced_Wireless_Content.asp&current_page=[XSS]&action_mode=change_wl_unit
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
The following example URI is available:
https://www.example.com/apply.cgi?next_page=Advanced_Wireless_Content.asp&current_page=[XSS]&action_mode=change_wl_unit
References
ASUS RT-AC68U 'apply.cgi' Cross Site Scripting Vulnerability
References:
References: