#Affected Vendor: http://www.impresscms.org/ #Date: 03/09/2014 #Discovered by: JoeV #Type of vulnerability: URL Redirection #Tested on: Windows 7 #Version : 1.3.7 #Description: Impress CMS is susceptible to URL direction attack. When a malicious user sends a payload as "http://localhost/user.php?xoops_redirect="maliciouslink"", user enters the credentials and gets redirected to the malicious link. Payload - http://localhost/user.php?xoops_redirect="malicious link or port number"