b2evolution CMS 6.11.6 Open Redirection

2021.02.11
Credit: Nakul Ratti
Risk: Low
Local: No
Remote: Yes
CWE: CWE-601


Ogólna skala CVSS: 5.8/10
Znaczenie: 4.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

# Exploit Title: *Open redirect in b2evolution CMS 6.11.6 redirect_to parameter in email_passthrough.php* # Google Dork: N/A # Date: 10/02/2021 # Exploit Author: Soham Bakore, Nakul Ratti # Vendor Homepage: https://b2evolution.net/ # Software Link: https://b2evolution.net/downloads/6-11-6-stable?download=12405 # Version: 6.11.6 # Tested on: latest version of Chrome, Firefox on Windows and Linux # CVE : *CVE-2020-22840* Vulnerable File: -------------------------- http://host/htsrv/email_passthrough.php <http://host/evoadm.php> Vulnerable Issue: -------------------------- redirect_to parameter has no input validation/domain whitelisting. --------------------------Proof of Concept----------------------- Steps to Reproduce: 1. Send the following link : *http://127.0.0.1/htsrv/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fgoogle.com <http://127.0.0.1/htsrv/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fgoogle.com>* to the unsuspecting user 2. The user will be redirected to Google.com or any other attacker controlled domain 3. This can be used to perform malicious phishing campaigns on unsuspecting users


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top