FirstBlood-#126 — Open Redirect /drpanel/logout.php
This report has been reviewed and accepted as a valid vulnerability on FirstBlood!
On 2021-05-10, iffu reported:
Hi zseano.. I've found an Open Redirect vulnerability on /drpanel/logout.php and the vulnerable paramter is 'ref'.
Steps to Reproduce
- While logging out from your admin account, you will notice the ref parameter in the URL.
- Simply inject the payload /\/www.evil.com in the value of ref parameter.
- Observe that you will be redirected to www.evil.com
Using this vulnerabiltity, an attacker can send a phishing mail to a victim user and the victim user thinks that it is a legitimate URL and can be trusted and puts his details. But, actually the application redirects him to attacker controlled domain which looks exactly like www.firstblood.com. If the user puts his details, his account may also be taken over
Thanks zseano for making this application. It makes me learn a lot how real world scenarios in bug hunting are.
This report has been publicly disclosed for everyone to view
FirstBlood ID: 1
Vulnerability Type: Open Redirect
There is an open url redirect vulnerability on /logout.php. The code expects it to start with / and does not allow to redirect to external domains but this can be bypassed.
Respect Earnt: 1000000
is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.