*Opoint Media Intelligence Unvalidated Redirects and Forwards (URL Redirection) Security Vulnerabilities* Exploit Title: Opoint Media Intelligence click.php? &noblink parameter URL Redirection Security Vulnerabilities Vendor: Opoint Product: Opoint Media Intelligence Vulnerable Versions: Tested Version: Advisory Publication: April 14, 2015 Latest Update: April 14, 2015 Vulnerability Type: URL Redirection to Untrusted Site ('Open Redirect') [CWE-601] CVE Reference: * Impact CVSS Severity (version 2.0): CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend) Impact Subscore: 4.9 Exploitability Subscore: 8.6 Discover and Writer: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore] *Suggestion Details:* *(1) Vendor & Product Description:* *Vendor:* Opoint *Product & Vulnerable Version:* Opoint Media Intelligence *Vendor URL & Download*: Opoint Media Intelligence can be got from here, http://www.opoint.com/index.php?page=home *Product Introduction Overview:* "Today, some libraries want to enhance their online presence in ways that go beyond the traditional OPAC and the "library portal" model to better integrate the latest Web functionality. With Opoint Media Intelligence, libraries will be able to take advantage of the latest Web technologies and engage Web-savvy users more effectively than ever before. Opoint Media Intelligence is a complete update of the Web OPAC interface" "Opoint Media Intelligence breaks through the functional and design limitations of the traditional online catalog. Its solid technology framework supports tools for patron access such as Spell Check; integrated Really Simple Syndication (RSS) feeds; a suite of products for seamless Campus Computing; and deep control over information content and presentation with Cascading Style Sheets (CSS). Opoint Media Intelligence is also a platform for participation when integrated with Innovative's Patron Ratings features and Community Reviews product. What's more, with Opoint Media Intelligence's RightResult? search technology, the most relevant materials display at the top so patrons get to the specific items or topics they want to explore immediately. Opoint Media Intelligence can also interconnect with Innovative's discovery services platform, Encore. And for elegant access through Blackberry? Storm? or iPhone?, the AirPAC provides catalog searching, item requesting, and more." *(2) Vulnerability Details:* Opoint Media Intelligence web application has a security bug problem. It can be exploited by Unvalidated Redirects and Forwards (URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs. Other Opoint products 0day vulnerabilities have been found by some other bug hunter researchers before. Opoint has patched some of them. Web Security Watch is an aggregator of security reports coming from various sources. It aims to provide a single point of tracking for all publicly disclosed security issues that matter. "Its unique tagging system enables you to see a relevant set of tags associated with each security alert for a quick overview of the affected products. What's more, you can now subscribe to an RSS feed containing the specific tags that you are interested in - you will then only receive alerts related to those tags." It has published suggestions, advisories, solutions details related to Open Redirect vulnerabilities. *(2.1)* The first code programming flaw occurs at "func/click.php?" page with "&noblink" parameter. *References:* http://tetraph.com/security/open-redirect/opoint-media-intelligence-unvalidated-redirects-and-forwards/ http://securityrelated.blogspot.com/2015/04/opoint-media-intelligence-unvalidated.html http://www.inzeed.com/kaleidoscope/computer-web-security/opoint-media-intelligence-open-redirect/ http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/opoint-media-intelligence-open-redirect/ https://computerpitch.wordpress.com/2015/04/14/opoint-media-intelligence-open-redirect/ http://www.iedb.ir/author-Wang%20Jing.html http://www.websecuritywatch.com/open-redirect-vulnerability-in-wordpress-newsletter-2-6-x-2-5-x/ http://lists.openwall.net/full-disclosure/2015/03/02/7 http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1646 -- Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. http://www.tetraph.com/wangjing/ https://twitter.com/justqdjing