Snom IP Phone Web Interface Multiple Vulnerabilities
The vulnerabilities allows an unprivileged attacker to read the sip details including password & write javascript code. The vulnerablities are in: XSS - Address Book: http://127.0.0.1/adr.htm & DATA DISCLOSURE - Password disclosure: http://127.0.0.1/line_login.htm?l=1. XSS Vulnerability: The xss vulnerability found in the section 'Addres Book' of 'Snom IP Phone' software. The vulnerability allows the attacker to inject javascript code to the field 'number'. To exploit the vulnerability we need to access to the 'Snom IP Phone' by this url 'http://address/adr.htm'. Then we can write any javascript code that we want and send the form. by the next refreshing of the page the javascript code will run. If we already inject the javascript code so we can also be exploited by the next page 'http://address/tbook.csv'. DATA DISCLOSURE: The data disclosure vulnerability found in the section of 'Line 1' of 'Snom IP Phone' software. The vulnerability allow the attacker to read the sip details including password. To exploit the vulnerability we need to access to the 'Snom IP Phone' by this url 'http://address/line_login.htm?l=1'. Then we can see the sip details including password.
