FirstBlood-#550 — Goto paramerter at /login.php vulnerable to reflective xss.
This issue was discovered on FirstBlood v2.0.0 (issues patched)
On 2021-10-26, vishal Level 2 reported:
Discription : goto paramerter at /login.php vulnerable to reflective xss.
Step's to Reproduce:
- visit /login.php
- enter valid login credential's which can be generated using registration bypass i have reported earlier.
- You must get a current cookie session alert box pop up as below.
Let me know, if anything missing or further information is required.
Thanks and Regards - Vishal
FirstBlood ID: 39
Vulnerability Type: Reflective XSS
Our mistake: The parameter "goto" on login.php should of been "fixed" when redirecting to prevent XSS but due to an oversight from Sean and Karl, the new code did not make it into production. This has since updated since the event ended and you're recommended to re-try. It's related to bug
ID 26 because the idea was developers fixed *this* one (when redirecting) but forgot the other reflection.