FirstBlood-#490 — Parameter "ref" at endpoint /register.php is vulnerable to reflected XSS.
This issue was discovered on FirstBlood v2

On 2021-10-25, vishal Level 2 reported:

Discription : parameter "ref" at endpoint /register.php is vulnerable to reflected XSS.

Steps to Reproduce the issue :

  1. Visit /register.php.
  2. Add ?ref=JavaScript:alert(document.cookie) at the end of url and press enter.

  3. Now click on "Return to previous Page". . All done You should mostlikely see a alert box of own cookie.

    How i Find it: Most probably i wouldn't have found it . if i haven't read previously disclosed report of Firstblood. Anyway I'm Extremly happy to report it as it's my first bug submition on Firstblood & I know i should have make it work without user interaction but i failed to do so that's it for now.

Let me know, if anything missing or further information is required.

Thanks and Regards - Vishal

P3 Medium

Endpoint: /register.php

Parameter: ref

Payload: JavaScript:alert(document.cookie)

FirstBlood ID: 32
Vulnerability Type: Reflective XSS

The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as %09 will also bypass the filter.