# Title: D-Link DIR-615 Multiple Vulnerabilities # Date: 10-01-2017 # Hardware Version: E3 # Firmware Version: 5.10 # Tested on: Windows 8 64-bit # Exploit Author: Osanda Malith Jayathissa (@OsandaMalith) # Original write-up:https://osandamalith.com/2017/01/04/d-link-dir-615-open-redirection-and-xss/ Overview -------- The 'apply.cgi' file was vulnerable to Open Redirection and XSS. Inside the router many other cgi files too use this functionality in 'apply.cgi'. For example the 'ping_response.cgi' file. Open Redirection ----------------- # apply.cgi # ping_response.cgi POST XSS --------- # apply.cgi # ping_response.cgi Disclosure Timeline -------------------- 12/19/16: Reported to D-Link 12/21/16: Security Patch released ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-615/REVT/DIR-615_REVT_RELEASE_NOTES_20.12PTb01.pdf