0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Friendly-Tech FriendlyTR69 CPE Remote Management v2.8.9 SQL Injection
[=================================================================================== Friendly-Tech FriendlyTR69 CPE Remote Management v2.8.9 SQL Injection Vulnerability =================================================================================== ===================== I. BACKGROUND ===================== Based on the company’s technical expertise and a decade of hands-on experience in the telecom industry, Friendly’s solution is a ROBUST, SCALABLE, SECURED, TELCO GRADE and COST-EFFECTIVE TR-069 solution. The TR-069 protocol was accepted as the standard for CPE management by the DSL, WiMAX, NGN / Optical network providers (some Cable operators are deploying TR-069 as well). Device Management & Auto Provisioning Friendly’s TR-069 solution delivers comprehensive remote management and auto-provisioning of CPEs that support the TR-069 standard - including modem/routers, IPTV/ STBs, ATA/VoIP, storage devices, media centers, etc. http://www.friendly-tech.com/remotemamagment.asp ===================== II. DESCRIPTION ===================== The Friendly-Tech FriendlyTR69 CPE Remote Management is prone to SQL injection attacks. ===================== III. ANALYSIS ===================== The vulnerability occurs due to insufficient sanitization of user-supplied data when logging onto the FriendlyTR69 CPE Remote Management. Successful exploitation may result in an attacker obtaining admin access to the FriendlyTR69 CPE Remote Management. ===================== IV. EXPLOIT ===================== Username: ' or 1=1-- Password: ' or 1=1-- ===================== V. DISCLOSURE TIMELINE ===================== Jan 2009 Vulnerability Found Jan 2009 Vendor Notification March 2010 Public Disclosure # 0day.today [2024-11-15] #