4e246a01fb
18 changes to exploits/shellcodes/ghdb
DLINK DPH-400SE - Exposure of Sensitive Information
FileMage Gateway 1.10.9 - Local File Inclusion
Academy LMS 6.1 - Arbitrary File Upload
AdminLTE PiHole 5.18 - Broken Access Control
Blood Donor Management System v1.0 - Stored XSS
Bus Reservation System 1.1 - Multiple-SQLi
Credit Lite 1.5.4 - SQL Injection
CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Hyip Rio 2.1 - Arbitrary File Upload
Member Login Script 3.3 - Client-side desync
SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
Webedition CMS v2.9.8.8 - Stored XSS
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Freefloat FTP Server 1.0 - 'PWD' Remote Buffer Overflow
Kingo ROOT 1.5.8 - Unquoted Service Path
NVClient v5.0 - Stack Buffer Overflow (DoS)
Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
18 lines
No EOL
900 B
Text
18 lines
No EOL
900 B
Text
# Exploit Title : DLINK DPH-400SE - Exposure of Sensitive Information
|
|
# Date : 25-08-2023
|
|
# Exploit Author : tahaafarooq
|
|
# Vendor Homepage : https://dlink.com/
|
|
# Version : FRU2.2.15.8
|
|
# Tested on: DLINK DPH-400SE (VoIP Phone)
|
|
|
|
Description:
|
|
|
|
With default credential for the guest user "guest:guest" to login on the web portal, the guest user can head to maintenance tab under access and modify the users which allows guest user to modify all users as well as view passwords for all users. For a thorough POC writeup visit: https://hackmd.io/@tahaafarooq/dlink-dph-400se-cwe-200
|
|
|
|
POC :
|
|
|
|
1. Login with the default guest credentials "guest:guest"
|
|
2. Access the Maintenance tab.
|
|
3. Under the maintenance tab, access the "Access" feature
|
|
4. On "Account Option" choose a user to modify, thus "Admin" and click modify.
|
|
5. Right click on the password, and click reveal, the password is then seen in plaintext. |