FirstBlood-#565Reflected XSS inside ref parameter on /register.php
This issue was discovered on FirstBlood v2

On 2021-10-26, neolex Level 2 reported:


The ref parameter is vulnerable to reflected XSS The value is reflected inside a <a> tag inside the webpage. It can be use to open redirect but also can be upgraded to reflected xss with javascript uri

The javascript keyword is replaced by nope but the replace is case sensitive, and because javascript uri are case insentive we can bypass the filter by using an uppercase inside the javascript word.

Step to reproduce


The impact is XSS, an attacker can execute javascript inside user's browser and they can steal cookies.

P3 Medium

Endpoint: /register.php

Parameter: ref

Payload: jaVasCript:alert(document.cookie)

FirstBlood ID: 32
Vulnerability Type: Reflective XSS

The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as %09 will also bypass the filter.