FirstBlood-#349 — Register.php is still vulenerable to Reflective XSS
This issue was discovered on FirstBlood v2.0.0 (issues patched)
On 2021-10-25, kinako reported:
Dear FirstBlood security team, I found a vulnerability on your service. I hope this report will help you.
Because of not enough sanitization, the attackers still can perform reflective XSS on
First of all, I enumerated a hidden param on
/register.phpand I found that this endpoint reflects the hidden parameter
refvalue in href attribute of
Return to previous page.
Next, firstblood server-side seems to sanitize user's input by replacing some malicious words into
However, we can bypass it by using
Then, finally our malicious input is reflected and leads to Reflective XSS.
- Firstblood session cookie does not have
HttpOnlyattribute so the attackers can steal victim's session cookie easily
FirstBlood ID: 32
Vulnerability Type: Reflective XSS
The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as
%09 will also bypass the filter.