0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Linksys EA7500 2.0.8.194281 - Cross-Site Scripting Vulnerability
Author
Risk
[Security Risk Medium
]0day-ID
Category
Date add
CVE
Platform
# Exploit Title: Linksys EA7500 2.0.8.194281 - Cross-Site Scripting # Exploit Author: MiningOmerta # Vendor Homepage: https://www.linksys.com/ # Version: EA7500 Firmware Version: 2.0.8.194281 # CVE: CVE-2012-6708 # Tested On: Linksys EA7500 (jQuery version 1.7.1) # Cross-Site Scripting Vulnerability on modern versions of Linksys Smart-Wifi home routers. # Caused by outdated jQuery(strInput) version : <= 1.7.1 (Fixed in version 1.9.0) # Credit also to Reddit user michael1026 ### POC ### 1. When logging into the router (http://LHOST or http://LHOST:10080), choose "Click Here" next to "Dont Have an Account? " or Choose "click here" after "To login with your Linksys Smart Wi-Fi account", you will be redirected with a login prompt with both Email Address and Password forms. 2. Make your email address "<img src=0 onerror=alert(XSS)>" without the double quotes. 3. Payload will be triggered when mouse is clicked anywhere within the Email Address form box or when form is submitted. # 0day.today [2024-11-15] #