| タイトル | Tilgin IP Residential Gateways 322_AS0500-03_05_13_05 Cross Site Scripting |
|---|
| 説明 | A cross-site scripting (XSS) vulnerability has been discovered in the product_info page of Tilgin IP Residential Gateways which can be accessed without login. The vulnerability is in the href attribute An attacker can use this vulnerability to inject malicious Javascript code in the context of a victim's browser, which can be triggered by clicking on the link.
#Steps to Reproduce
1). Navigate to - http://ip/vood/cgi-bin/vood_view.cgi?act=index&lang=EN#
2). Insert a generic payload after errmsg
POC : http://IP/vood/cgi-bin/vood_view.cgi?lang=EN&act=index&errmsg=<img%20src=x%20onerror=alert('XSS');> |
|---|
| ユーザー | The_Druk (UID 70236) |
|---|
| 送信 | 2024年06月18日 23:40 (2 年 ago) |
|---|
| モデレーション | 2024年06月26日 18:23 (8 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 268854 [Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05 Login vood_view.cgi?act=index&lang=EN# errmsg クロスサイトスクリプティング] |
|---|
| ポイント | 0 |
|---|