FirstBlood-#792Reflective XSS at /login.php due to goto
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-28, 0xirfan Level 5 reported:

Summary

The goto paramater in the /login.php is Vulnerable to XSS. The input Provided in the goto parameter is reflected at the input tag

Finding the Payload

1) Understand the Scope where the Payload is Reflected .Since it is reflected inside an input tag we have 2 options 
a)Close the Input tag and create a new tag of your liking to trigger XSS 
b) use any Event Handlers to trigger the XSS without closing the input tag
2) I used option b)  found that some event handlers are filtered so used intruder to find the best event handler which can be used with minimum activity from victim. and found the onfocusin event handler
3) () where removed So used `` instead of ()
Final Payload irfan"%20%20onfocusin=confirm`1`%20autofocus>

Steps

1) Just Send this URL to the Victim

        https://05ecafffaada-0xirfan.a.firstbloodhackers.com/login.php?goto=irfan%22%20%20onfocusin=confirm`1`%20autofocus%3E

Impact

The XSS can be used to steal cookies which leads to ATO

P3 Medium

Endpoint: /login

Parameter: goto

Payload: irfan"%20%20onfocusin=confirm`1`%20autofocus>


FirstBlood ID: 26
Vulnerability Type: Reflective XSS

The developers thought they had fixed ?goto= when reflected in an input tag on login.php from a similar bug (ID 39), but because this endpoint uses legacy code their changes were not applied here and thus the XSS was forgotten.