CVE-2015-1028

D-Link DSL-2730B Modem - Cross-Site Scripting Injection Stored Wlsecrefresh.wl & Wlsecurity.wl

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2015-1028 has a selected CVSS score of 3.5; EIP currently links 3 catalogued exploits.

Description

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTML via the (1) domainname parameter to dnsProxy.cmd (DNS Proxy Configuration Panel); the (2) brName parameter to lancfg2get.cgi (Lan Configuration Panel); the (3) wlAuthMode, (4) wl_wsc_reg, or (5) wl_wsc_mode parameter to wlsecrefresh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer).

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
3

Proofs of concept

3

Catalogued exploits

ExploitDBD-Link DSL-2730B Modem - Cross-Site Scripting Injection Stored Wlsecrefresh.wl & Wlsecurity.wlExploitDB exploitby XLabs SecurityNot analyzed1 file
ExploitDB
PoC details
ExploitDBD-Link DSL-2730B Modem - Cross-Site Scripting Injection Stored DnsProxy.cmdExploitDB exploitby XLabs SecurityNot analyzed1 file
ExploitDB
PoC details
ExploitDBD-Link DSL-2730B Modem - 'Lancfg2get.cgi Persistent Cross-Site ScriptingExploitDB exploitby XLabs SecurityNot analyzed1 file
ExploitDB
PoC details

References

5