Reflective XSS via ref parameter on register.php

FirstBlood-#314 — Reflective XSS via ref parameter on register.php
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-25, panya Level 7 reported:


The ref parameter is still vulnerable to XSS on register.php page.
Steps to reproduce:

Open this URL: https://579a3c7897af-panya.a.firstbloodhackers.com/register.php?ref=ja%0avascri%0apt:alert(origin)
Click on the "Return to previous page" link.

Actual result:
There will be an alert with the text: "https://579a3c7897af-panya.a.firstbloodhackers.com"
Expected result:
The ref parameter value should be properly escaped or sanitized. The alert should not be shown.
Impact:
XSS on behalf on a user of this site.

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: /register.php

Parameter: ref

Payload: ja%0avascri%0apt:alert(origin)

FirstBlood ID: 32
Vulnerability Type: Reflective XSS

The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as %09 will also bypass the filter.

BugBountyHunter