full-disclosure - Grandstream GXP1405 Executive IP Phone Persistent XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 23 Oct 2012 08:37:25 +0200
From: Are You Likeme Now <areulikemenow@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Grandstream GXP1405 Executive IP Phone Persistent
	XSS

>--------------------------------------------------------------------------------
              title: Grandstream GXP1405 Executive IP Phone Persistent XSS
            product: Grandstream Networks
 vulnerable version: 1.0.1.110
             impact: Low
           homepage: www.grandstream.com
              found: 23.10.2012
                 by: aulmn
>--------------------------------------------------------------------------------
Vendor description:

Grandstream Networks is a leading manufacturer of innovative IP voice/video
telephony and video surveillance solutions

>--------------------------------------------------------------------------------
Vulnerability overview/description:

This is cross-site scripting for logged in users.

>--------------------------------------------------------------------------------
Proof of concept:

Go to Your http://ip.of.tel/cgi-bin/login and log in.
Next check card called 'Accounts' and then vulnerable parameter is P134.
Click 'update' and ance again 'continue'. And here Your xss in triggered.
Parameter P2318 is vulnerable too, so I suppose there is more vulnerable
places.

'Conference URL' parameter is also vulnerable to persistent xss.
So if attacker will get your (default? ;)) credentials, then he can set
persistent xss to attack you.

>--------------------------------------------------------------------------------
Vulnerable / tested versions:

Software Version 1.0.1.110

>--------------------------------------------------------------------------------
The vulnerability is verified to exist in ...........,
which is the most recent version at the time of discovery.

Older versions are probably affected as well.

>--------------------------------------------------------------------------------
Vendor contact timeline:
Nope.

Solution:
>--------------------------------------------------------------------------------
Please validate content delivered by your users.

>--------------------------------------------------------------------------------
Advisory URL:
Maybe later.

_________________________________________________________________________________
Contact:
areulikemenow@...il.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/