# Title: Open Redirect DoorGets CMS # Version: 7.0 # vendor: https://github.com/doorgets/doorGets/ # Tested on: Windows 64-bit # Author: Rudra Sarkar (@rudr4_sarkar) # CVE: 2016-3726 1. Affected Param back= 2. Full URL http://127.0.0.1/dg-user/?controller=authentification&back=http%3A%2F%2Fexploitlab.ex%2F 3. Go to login page you will get this type of URL 4. Now time for Redirect 5. Change the back= parm URL http://exploitlab.ex/dg-user/?controller=authentification&back=http%3a%2f%2fevil.com%2f 6. Evil URL Like http://evil.com/ i encode the special charecter. 7. Now enter the URL in browser and press enter you will see login page. 8. Now Login using your email password 9. You will redirected to http://evil.com # Timeline 18-06-17: Reported to the vendor 28-06-17: No reply from vendor 01-07-17: Assigned CVE-2016-3726