TOTOLINK A3002R Eval Injection Vulnerability Allowing Cross-Site Scripting

An eval injection vulnerability has been identified in the TOTOLINK A3002R router, specifically in version 4.0.0-B20230531.1404. This vulnerability allows for cross-site scripting (XSS) by exploiting the eval() function on multiple web interface pages. The issue was confirmed by injecting a script that accessed the session ID, demonstrating the potential for session hijacking.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser session.

Reproduction

The vulnerability can be reproduced by accessing the router's web interface and navigating to pages that utilize the eval() function. Once identified, the vulnerability can be exploited by injecting a script, such as one that triggers an alert, to confirm the execution of the injected code. Successful exploitation can be verified by checking the sessionCheck field, which will reflect the injected session ID.