| 标题 | D-Link DIR-852 1.00CN B09 Exposure of Sensitive Information Through Data Queries |
|---|
| 描述 | An authentication bypass vulnerability was discovered in the `getcfg.php` endpoint of some D-Link router firmwares. The vulnerability stems from a logical flaw in the order of operations within the `phpcgi_main` function of the underlying `cgibin` binary when handling user POST parameters and server-side session state. The application first parses user-controllable POST data before appending the server-generated session validation result (e.g., `AUTHORIZED_GROUP=-1`).
Due to a "first-occurrence-priority" principle in the back-end parsing engine, an attacker can inject a forged `AUTHORIZED_GROUP=1` parameter in the POST request to preemptively define the authorization state, causing the legitimate result to be ignored. An unauthenticated remote attacker can exploit this vulnerability to bypass access controls, call `getcfg.php`, and retrieve sensitive device configuration information, such as administrator account credentials. |
|---|
| 来源 | ⚠️ https://github.com/i-Corner/cve/issues/21 |
|---|
| 用户 | iC0rner (UID 82839) |
|---|
| 提交 | 2025-08-31 14時26分 (1 年前) |
|---|
| 管理 | 2025-09-08 07時04分 (8 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 323049 [D-Link DIR-852 直到 1.00CN B09 Device Configuration /getcfg.php phpcgi_main 信息公开] |
|---|
| 积分 | 20 |
|---|