D-Link DAP-1360 'index.cgi' Multiple Cross Site Request Forgery and HTML Injection Vulnerabilities

Bugtraq ID:	71362
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 27 2014 12:00AM
Updated:	Nov 27 2014 12:00AM
Credit:	MustLive
Vulnerable:	D-Link DAP-1360 1.0.0
Not Vulnerable:

D-Link DAP-1360 'index.cgi' Multiple Cross Site Request Forgery and HTML Injection Vulnerabilities

D-Link DAP-1360 is prone to multiple cross-site request-forgery and HTML-injection vulnerabilities.

An attacker can exploit theses issues to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible

D-Link DAP-1360 firmware version 1.0.0 is vulnerable; other versions may also be affected.

D-Link DAP-1360 'index.cgi' Multiple Cross Site Request Forgery and HTML Injection Vulnerabilities

Attackers can exploit these issues using browser. To exploit the cross-site request-forgery vulnerability, the attacker must entice an unsuspecting victim to visit a specially-crafted webpage.

The following example URI is available:

http://www.example.com/index.cgi?v2=y&rq=y&res_json=y&res_data_type=json&res_config_action=3&res_config_id=41&res_struct_size=0&res_buf=[%22%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%22]

D-Link DAP-1360 'index.cgi' Multiple Cross Site Request Forgery and HTML Injection Vulnerabilities

References:

• D-Link Homepage (D-Link)
  
• CSRF and XSS vulnerabilities in D-Link DAP-1360 (MustLive)