Babel 0.4.1 Open Redirection

Credit: Jan Kopriva
Risk: Low
Local: No
Remote: Yes
CWE: CWE-601

Affected Software: Babel: Multilingual Site module for CMS Made Simple Affected Version: 0.4.1 and earlier Patched Version: None - project is no longer under development CVE Identifier: TBD Vulnerability type: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') Severity Rating: CVSS v3 Base Score: 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Security Researcher: Jan Kopriva @ Alef Nula Summary: The Babel multi-language module for CMSMS contains an open redirection vulnerability in a script within the redirect.php file. The script takes an argument specifying a URL to which a browser should be redirected. This URL may be completely arbitrary. It is therefore possible to craft a link to a Babel-enabled site which causes redirection to any URL specified, even outside the originating domain. This is especially useful for phishing attacks, when attacker creates a link to a safe site, which, without the knowledge of a user, redirects him or her to a fake/malicious site. All CMSMS sites with Babel module installed are affected, since redirect.php is always publically accessible. Detailed description: The Babel module ( provides CMSMS sites with the capacity to easily switch between multiple translations of web page content. Desired translation may be chosen by sending a GET request to Under normal conditions, this PHP script takes two arguments - "newlang" and "newurl". The first argument sets the desired language for the translation and the second one sets URL which should be displayed in selected language. A non-working example of what the URL might look like is The vulnerability is caused by the absence of any filtering when the parameter "newurl" is processed (the parametr "newlang" is - for our purposes - optional and may be omitted). Further information regarding the vulnerability may be found at: Proof of Concept: Recommendation: Removal of the Babel module from any affected site. Disclosure timeline: Developer Contacted: 2. 2. 2019 Developer Responded: 11. 2. 2019 (project abandoned, no new versions are to be expected) Disclosure to CSIRT network: 14. 2. 2019 Public Disclosure: 23. 2. 2019

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022,


Back to Top