D-Link DAP-1320 'apply.cgi' Directory Traversal and Cross Site Scripting Vulnerabilities
BID:66973
Info
D-Link DAP-1320 'apply.cgi' Directory Traversal and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 66973 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 17 2014 12:00AM |
| Updated: | Jul 21 2014 12:30AM |
| Credit: | Kyle Lovett |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
D-Link DAP-1320 'apply.cgi' Directory Traversal and Cross Site Scripting Vulnerabilities
D-Link DAP-1320 is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials. Other harvested information may aid in launching further attacks.
D-Link DAP-1320 1.20B07 is vulnerable; other versions may also be affected.
D-Link DAP-1320 is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials. Other harvested information may aid in launching further attacks.
D-Link DAP-1320 1.20B07 is vulnerable; other versions may also be affected.
Exploit / POC
D-Link DAP-1320 'apply.cgi' Directory Traversal and Cross Site Scripting Vulnerabilities
An attacker can exploit these issues through a browser. Attackers can exploit the cross-site scripting issue by enticing an unsuspecting user to follow a malicious URI.
An attacker can exploit these issues through a browser. Attackers can exploit the cross-site scripting issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
D-Link DAP-1320 'apply.cgi' Directory Traversal and Cross Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
D-Link DAP-1320 'apply.cgi' Directory Traversal and Cross Site Scripting Vulnerabilities
References:
References:
- D-Link Homepage (D-Link)