-- logout status you have just logged out

user name	<[MALICIOUS INJECTED CODE PAYLOAD EXECUTION!]>
IP address	<[MALICIOUS INJECTED CODE PAYLOAD EXECUTION!]>
MAC address	<[MALICIOUS INJECTED CODE PAYLOAD EXECUTION!]>
session time	4m12s
time left	23h55m48s
bytes up/down:	49.1 KiB / 169.2 KiB

--- PoC Session Logs (POST) --- POST /v2/status.php HTTP/1.1 Host: hotspot.cwifi.de Content-Length: 1129 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="93", " Not;A Brand";v="99" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: http://spot.cwifi.de Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: http://spot.cwifi.de/ Accept-Encoding: gzip, deflate Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7 Connection: close - hostname=spot.cwifi.de&identity=Client2822&login-by=http-pap&plain-passwd=yes&server-address=<[MALICIOUS INJECTED CODE!]>%3A80&ssl-login=no &server-name=Client2822_HotSpot&link-login=http%3A%2F%2Fspot.cwifi.de%2Flogin&link-login-only=http%3A%2F%2Fspot.cwifi.de%2Flogin &link-logout=http%3A%2F%2Fspot.cwifi.de%2Flogout&link-status=http%3A%2F%2Fspot.cwifi.de%2Fstatus&link-orig= &domain=&interface-name=2_HotSpotA&ip=<[MALICIOUS INJECTED CODE!]>&logged-in=yes&mac=<[MALICIOUS INJECTED CODE!]>&trial=no&username=90%3ACC%3ADF%3A96%3AF6%3A59 &host-ip=<[MALICIOUS INJECTED CODE!]>&idle-timeout=5h&idle-timeout-secs=18000&limit-bytes-in=&limit-bytes-out=&refresh-timeout=1m&refresh-timeout-secs=60 &session-timeout=23h52m4s&session-timeout-secs=85924&session-time-left=23h52m4s&session-time-left-secs=85924&uptime=7m56s&uptime-secs=476 &bytes-in=7591511&bytes-in-nice=7.2+MiB&bytes-out=232391459&bytes-out-nice=221.6+MiB&packets-in=154484&packets-out=172963&remain-bytes-in= &remain-bytes-out=&session-id=&var=&error=&error-orig=&chap-id=%24%28chap-id%29&chap-challenge=%24%28chap-challenge%29&popup=%24%28popup%29 &advert-pending=no&http-status=%24%28http-status%29&http-header=%24%28http-header%29 - HTTP/1.1 200 OK Server: Apache/2.4.18 (Ubuntu) Set-Cookie: PHPSESSID=06u1m6qlhcp4tbuuapnq8du5c7; path=/ Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Length: 2137 Connection: close Content-Type: text/html; charset=UTF-8 -- via Login https://hotspot.cwifi.de/v2/login.php Host: hotspot.cwifi.de Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 1078 Origin: http://spot.cwifi.de Connection: keep-alive Referer: http://spot.cwifi.de/ Cookie: PHPSESSID=tvpvp06jktbs8hvgm8efh1eh33 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site phone=&hostname=spot.cwifi.de&identity=Client2822&login-by=&plain-passwd=yes&server-address=<[MALICIOUS INJECTED CODE!]>:80&ssl-login=no&server-name=Client2822_HotSpot &link-login=http://spot.cwifi.de/login&link-login-only=http://spot.cwifi.de/login&link-logout=http://spot.cwifi.de/logout&link-status=http://spot.cwifi.de/status &link-orig=&domain=&interface-name=2_HotSpotA&ip=<[MALICIOUS INJECTED CODE!]>&logged-in=no&mac=<[MALICIOUS INJECTED CODE!]>&trial=no&username= &host-ip=<[MALICIOUS INJECTED CODE!]>&idle-timeout=&idle-timeout-secs=0 &limit-bytes-in=&limit-bytes-out=&refresh-timeout=&refresh-timeout-secs=0&session-timeout=&session-timeout-secs=0&session-time-left=&session-time-left-secs=0 &uptime=0s&uptime-secs=0&bytes-in=0&bytes-in-nice=0 B&bytes-out=0&bytes-out-nice=0 B&packets-in=0&packets-out=0&remain-bytes-in=&remain-bytes-out=&session-id= &var=&error=&error-orig=&chap-id=244&chap-challenge=2765623021030016220234114113331227527435520051 &popup=true&advert-pending=no&http-status=$(http-status)&http-header=$(http-header) - POST: HTTP/1.1 200 OK Server: Apache/2.4.18 (Ubuntu) Cache-Control: no-store, no-cache, must-revalidate Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 334 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Risk: ===== The security risk of the code execution web vulnerability that allows to attack by multiple vectors to compromise the wifi is estimated as high. Credits: ======== Vulnerability-Lab [RESEARCH TEAM] - https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. Domains: https://www.vulnerability-lab.com ; https://www.vuln-lab.com ; https://www.vulnerability-db.com Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@) to get a ask permission. Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™