b2evolution CMS 6.11.6 Open Redirection ≈ Packet Storm – Digitalmunition




Exploit/Advisories no-image-featured-image.png

Published on February 11th, 2021 📆 | 3348 Views ⚑

0

b2evolution CMS 6.11.6 Open Redirection ≈ Packet Storm

# Exploit Title: *Open redirect in b2evolution CMS 6.11.6 redirect_to
parameter in email_passthrough.php*
# Google Dork: N/A
# Date: 10/02/2021
# Exploit Author: Soham Bakore, Nakul Ratti
# Vendor Homepage: https://b2evolution.net/
# Software Link:
https://b2evolution.net/downloads/6-11-6-stable?download=12405
# Version: 6.11.6
# Tested on: latest version of Chrome, Firefox on Windows and Linux
# CVE : *CVE-2020-22840*

Vulnerable File:
————————–
http://host/htsrv/email_passthrough.php

Vulnerable Issue:
————————–
redirect_to parameter has no input validation/domain whitelisting.

————————–Proof of Concept———————–
Steps to Reproduce:

1. Send the following link :
*http://127.0.0.1/htsrv/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fgoogle.com
*
to
the unsuspecting user
2. The user will be redirected to Google.com or any other attacker
controlled domain
3. This can be used to perform malicious phishing campaigns on unsuspecting
users

Source link

Tagged with:



Leave a Reply