CVE-2020-14965 PoC — TP-Link TL-WR740N和TL-WR740ND 注入漏洞

Description

TP-LINK Multiple HTML Injection Vulnerabilities 

介绍

# CVE-2020-14965

```

██╗  ██╗████████╗███╗   ███╗██╗         ██╗███╗   ██╗     ██╗███████╗ ██████╗████████╗██╗ ██████╗ ███╗   ██╗
██║  ██║╚══██╔══╝████╗ ████║██║         ██║████╗  ██║     ██║██╔════╝██╔════╝╚══██╔══╝██║██╔═══██╗████╗  ██║
███████║   ██║   ██╔████╔██║██║         ██║██╔██╗ ██║     ██║█████╗  ██║        ██║   ██║██║   ██║██╔██╗ ██║
██╔══██║   ██║   ██║╚██╔╝██║██║         ██║██║╚██╗██║██   ██║██╔══╝  ██║        ██║   ██║██║   ██║██║╚██╗██║
██║  ██║   ██║   ██║ ╚═╝ ██║███████╗    ██║██║ ╚████║╚█████╔╝███████╗╚██████╗   ██║   ██║╚██████╔╝██║ ╚████║
╚═╝  ╚═╝   ╚═╝   ╚═╝     ╚═╝╚══════╝    ╚═╝╚═╝  ╚═══╝ ╚════╝ ╚══════╝ ╚═════╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝
                                                                                                            
```


**TP-LINK - Multiple HTML Injection Vulnerabilities**

On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_lists_name or hosts_lists_name.

<br>**Researcher:** Guilherme Rubert
<br>**References:**

<p>https://www.tp-link.com/br/
<p>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14965
<p>https://nvd.nist.gov/vuln/detail/CVE-2020-14965

文件快照

备注