? Snowfox CMS v1.0 (rd param) Open Redirect Vulnerability Vendor: Globiz Solutions Product web page: http://www.snowfoxcms.org Affected version: 1.0 Summary: Snowfox is an open source Content Management System (CMS) that allows your website users to create and share content based on permission configurations. Desc: Input passed via the 'rd' GET parameter in 'selectlanguage.class.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. =========================================================================== \modules\system\controller\selectlanguage.class.php: ---------------------------------------------------- 28: if ($results && isset($inputs['rd'])){ 29: header("location: ".$inputs['rd']); 30: } 31: return $results; =========================================================================== Tested on: Apache/2.4.7 (Win32) PHP/5.5.6 MySQL 5.6.14 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2014-5206 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5206.php 12.11.2014 -- http://10.0.18.3/snowfox/?uri=user/select-language&formAction=submit&rd=http://www.zeroscience.mk&languageId=us-en