FirstBlood-#550Goto paramerter at /login.php vulnerable to reflective xss.
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-26, vishal Level 2 reported:

Discription : goto paramerter at /login.php vulnerable to reflective xss.

Step's to Reproduce:

  1. visit /login.php
  2. add ?goto=javascript:confirm\x28document.cookie\x29 at the end of url.
  3. enter valid login credential's which can be generated using registration bypass i have reported earlier.
  4. You must get a current cookie session alert box pop up as below.

Let me know, if anything missing or further information is required.

Thanks and Regards - Vishal

P3 Medium

Endpoint: /login.php

Parameter: goto

Payload: javascript:confirm\x28document.cookie\x29


FirstBlood ID: 39
Vulnerability Type: Reflective XSS

Our mistake: The parameter "goto" on login.php should of been "fixed" when redirecting to prevent XSS but due to an oversight from Sean and Karl, the new code did not make it into production. This has since updated since the event ended and you're recommended to re-try. It's related to bug ID 26 because the idea was developers fixed *this* one (when redirecting) but forgot the other reflection.