FirstBlood-#550 — Goto paramerter at /login.php vulnerable to reflective xss.
This issue was discovered on FirstBlood v2

On 2021-10-26, vishal Level 2 reported:

Discription : goto paramerter at /login.php vulnerable to reflective xss.

Step's to Reproduce:

  1. visit /login.php
  2. add ?goto=javascript:confirm\x28document.cookie\x29 at the end of url.
  3. enter valid login credential's which can be generated using registration bypass i have reported earlier.
  4. You must get a current cookie session alert box pop up as below.

Let me know, if anything missing or further information is required.

Thanks and Regards - Vishal

P3 Medium

Endpoint: /login.php

Parameter: goto

Payload: javascript:confirm\x28document.cookie\x29

FirstBlood ID: 39
Vulnerability Type: Reflective XSS

Our mistake: The parameter "goto" on login.php should of been "fixed" when redirecting to prevent XSS but due to an oversight from Sean and Karl, the new code did not make it into production. This has since updated since the event ended and you're recommended to re-try. It's related to bug ID 26 because the idea was developers fixed *this* one (when redirecting) but forgot the other reflection.