FirstBlood-#446 — Reflected XSS on the /register.php endpoint with the ref vulnerable parameter
This issue was discovered on FirstBlood v2

On 2021-10-25, johandu97 Level 4 reported:

Summary

Improper input validation leads to attackers injecting malicious characters causing XSS vulnerabilities

POC

  1. Hi @zseano, I found reflected xss on /register.php endpoint with ref vulnerable parameter
  2. Use payload to bypass filter: JavascRipt:alert(1)
  3. Send url to victim: https://c6329b4c0ecc-johandu97.a.firstbloodhackers.com/register.php?ref=JavascRipt:alert(1), when victim click into Return to previous page, xss is executed

Recommendations

Validate/santize malicious inputs that cause xss like < > ' " ...

P3 Medium

Endpoint: /register.php

Parameter: ref

Payload: JavascRipt:alert(1)

FirstBlood ID: 32
Vulnerability Type: Reflective XSS

The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as %09 will also bypass the filter.