cd36764b57
28 changes to exploits/shellcodes OpenBSD - Dynamic Loader chpass Privilege Escalation (Metasploit) Reptile Rootkit - reptile_cmd Privilege Escalation (Metasploit) Microsoft UPnP - Local Privilege Elevation (Metasploit) AVS Audio Converter 9.1.2.600 - Stack Overflow (PoC) FTP Navigator 8.03 - Stack Overflow (SEH) Wing FTP Server 6.0.7 - Unquoted Service Path Domain Quester Pro 6.02 - Stack Overflow (SEH) FreeBSD-SA-19:02.fd - Privilege Escalation FreeBSD-SA-19:15.mqueuefs - Privilege Escalation HomeAutomation 3.3.2 - Persistent Cross-Site Scripting HomeAutomation 3.3.2 - Authentication Bypass HomeAutomation 3.3.2 - Cross-Site Request Forgery (Add Admin) HomeAutomation 3.3.2 - Remote Code Execution elearning-script 1.0 - Authentication Bypass XEROX WorkCentre 6655 Printer - Cross-Site Request Forgery (Add Admin) Thrive Smart Home 1.1 - Authentication Bypass XEROX WorkCentre 7855 Printer - Cross-Site Request Forgery (Add Admin) XEROX WorkCentre 7830 Printer - Cross-Site Request Forgery (Add Admin) WEMS BEMS 21.3.1 - Undocumented Backdoor Account AVE DOMINAplus 1.10.x - Credential Disclosure AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot AVE DOMINAplus 1.10.x - Cross-Site Request Forgery (enable/disable alarm) AVE DOMINAplus 1.10.x - Authentication Bypass Heatmiser Netmonitor 3.03 - Hardcoded Credentials MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure RICOH SP 4510SF Printer - HTML Injection RICOH Web Image Monitor 1.09 - HTML Injection Heatmiser Netmonitor 3.03 - HTML Injection
21 lines
No EOL
858 B
Text
21 lines
No EOL
858 B
Text
# Exploit Title: RICOH Web Image Monitor 1.09 - HTML Injection
|
|
# Date: 2019-05-06
|
|
# Exploit Author: Ismail Tasdelen
|
|
# Vendor Homepage: https://www.ricoh.com/
|
|
# Hardware Link: http://support-download.com/services/device/webhlp/nb/gen/v140cc1/en/p_top010.html
|
|
# Software: RICOH Web Image Monitor
|
|
# Product Version: v1.09
|
|
# Vulernability Type: Code Injection
|
|
# Vulenrability: HTML Injection
|
|
# CVE: N/A
|
|
|
|
# Descripton :
|
|
# It has been discovered that in the v1.09 version of Image Monitor from
|
|
# RICOH, HTML Injection can be run on the /web/entry/en/address/adrsSetUserWizard.cgi
|
|
# function. This vulnerability affected all hardware that uses the entire
|
|
# Image Monitor v1.09.
|
|
|
|
# Attack Vectors :
|
|
|
|
You can run HTML Injection on the entryNameIn and entryDisplayNameIn in the corresponding function.
|
|
HTML Injection Payload : "><h1>ismailtasdelen |