Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86381219

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Netis-WF2419 HTML Injection
# Date: 20/01/2018
# Exploit Author: Sajibe Kanti
# Author Contact :https://twitter.com/@sajibekantibd
# Vendor Homepage: http://www.netis-systems.com/
# Version: Netis-WF2419 , V3.2.41381
# Tested on: Windows 10

# CEV : CVE-2018-6190


 HTML Injection in Netis-WF2419



Netis-WF2419 is prone to an HTML-injection vulnerability because it fails
to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or script code could run in the context of the
affected site, potentially allowing the attacker to steal cookie-based
authentication credentials and control how the site is rendered to the
user; other attacks are also possible.

Netis-WF2419 is vulnerable;

Proof of Concept:

1. Go to your wireless router ip (ex. 192.168.0.1)

2. Go to Wireless Settings - tab

3. Now Click MAC Filtering -tab

4.Write  MAC Address and in -Description- write (<h1>XSS-PWD</h1>)

5.Click Add

6. Now You Can See HTML Injection



#Solution:

 Upgrade Firmware