| शीर्षक | Cross Site Scripting On Ping Functionality On Dragon Path Router(707GR1) |
|---|
| विवरण | Description:
------------------------
The ping functionality present on the Diagnostic tab is vulnerable to Cross Site Scripting(XSS).
Impact:
-------------
The attacker can use this vulnerability to inject arbitrary javascript (Such as beef hooks or custom JS) to further exploit the Browser and the application.
Since the endpoint is vulnerable to Cross Site request Forgery the attacker will not even need to creds to exploit if it chains with it.
Steps to Reproduce
-----------------------------------
1)Login to the Dragon Path Router,
2)Move to Status tab--->Diagnostics
3)put the Host address as >><img/src/onerror=alert(1)> and press on Go.
You can see the alert getting poped up
|
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1s_NzD0Z6lMvRoo9sLXqRvYRaF7XTAYBE/view?usp=sharing |
|---|
| उपयोगकर्ता | w3bspl01t3r (UID 39229) |
|---|
| सबमिशन | 22/10/2023 09:11 PM (3 साल पहले) |
|---|
| संयम | 26/10/2023 08:32 AM (3 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 243594 [Dragon Path 707GR1 तक 20231022 Ping Diagnostics Host Address क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|