FirstBlood-#453 — [unpatched]Reflective XSS on /login.php?action=login&ref={payload}
This issue was discovered on FirstBlood v2

On 2021-10-25, d20s84 Level 3 reported:

Hi Sean!! Found another reflected XSS bug that is unpatched.

Summary:

I was able to inject javascript code into the url leading to Reflected Cross Site Scripting. The only catch is that the user has to press the back button for the payload to trigger {Unpatched Bug}

Steps:

1.Go to endpoint. : https://036e66d328b6-d20s84.a.firstbloodhackers.com/register.php?action=login&ref=ja%09vascri%09pt:confirm`1`

  1. Inject the payload and submit the URL. 3.Now return to the previous page. Boom!! the payload triggers.

Below is the image with the payload

P3 Medium

Endpoint: /register.php?action=login&ref=ja%09vascri%09pt:confirm`1`

Parameter: ref=

Payload: ja%09vascript:confirm`1`

FirstBlood ID: 32
Vulnerability Type: Reflective XSS

The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as %09 will also bypass the filter.