Full Disclosure mailing list archives
Grandstream GXP1405 Executive IP Phone Persistent XSS
From: Are You Likeme Now <areulikemenow () gmail com>
Date: Tue, 23 Oct 2012 08:37:25 +0200
--------------------------------------------------------------------------------
title: Grandstream GXP1405 Executive IP Phone Persistent XSS product: Grandstream Networks vulnerable version: 1.0.1.110 impact: Low homepage: www.grandstream.com found: 23.10.2012 by: aulmn
--------------------------------------------------------------------------------
Vendor description: Grandstream Networks is a leading manufacturer of innovative IP voice/video telephony and video surveillance solutions
--------------------------------------------------------------------------------
Vulnerability overview/description: This is cross-site scripting for logged in users.
--------------------------------------------------------------------------------
Proof of concept: Go to Your http://ip.of.tel/cgi-bin/login and log in. Next check card called 'Accounts' and then vulnerable parameter is P134. Click 'update' and ance again 'continue'. And here Your xss in triggered. Parameter P2318 is vulnerable too, so I suppose there is more vulnerable places. 'Conference URL' parameter is also vulnerable to persistent xss. So if attacker will get your (default? ;)) credentials, then he can set persistent xss to attack you.
--------------------------------------------------------------------------------
Vulnerable / tested versions: Software Version 1.0.1.110
--------------------------------------------------------------------------------
The vulnerability is verified to exist in ..........., which is the most recent version at the time of discovery. Older versions are probably affected as well.
--------------------------------------------------------------------------------
Vendor contact timeline: Nope. Solution:
--------------------------------------------------------------------------------
Please validate content delivered by your users.
--------------------------------------------------------------------------------
Advisory URL: Maybe later. _________________________________________________________________________________ Contact: areulikemenow () gmail com
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Grandstream GXP1405 Executive IP Phone Persistent XSS Are You Likeme Now (Oct 24)