b2evolution CMS 6.11.6 Open Redirection

2021.02.11
Credit: Nakul Ratti
Risk: Low
Local: No
Remote: Yes
CWE: CWE-601


CVSS Base Score: 5.8/10
Impact Subscore: 4.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: None

# Exploit Title: *Open redirect in b2evolution CMS 6.11.6 redirect_to parameter in email_passthrough.php* # Google Dork: N/A # Date: 10/02/2021 # Exploit Author: Soham Bakore, Nakul Ratti # Vendor Homepage: https://b2evolution.net/ # Software Link: https://b2evolution.net/downloads/6-11-6-stable?download=12405 # Version: 6.11.6 # Tested on: latest version of Chrome, Firefox on Windows and Linux # CVE : *CVE-2020-22840* Vulnerable File: -------------------------- http://host/htsrv/email_passthrough.php <http://host/evoadm.php> Vulnerable Issue: -------------------------- redirect_to parameter has no input validation/domain whitelisting. --------------------------Proof of Concept----------------------- Steps to Reproduce: 1. Send the following link : *http://127.0.0.1/htsrv/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fgoogle.com <http://127.0.0.1/htsrv/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fgoogle.com>* to the unsuspecting user 2. The user will be redirected to Google.com or any other attacker controlled domain 3. This can be used to perform malicious phishing campaigns on unsuspecting users


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top