Joomla! 'return' Parameter Open Redirection Vulnerability
BID:42629
Info
Joomla! 'return' Parameter Open Redirection Vulnerability
| Bugtraq ID: | 42629 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 24 2010 12:00AM |
| Updated: | Aug 24 2010 12:00AM |
| Credit: | Mr.MLL |
| Vulnerable: |
SocialMPN SocialMPN 1.0.5 Joomla Joomla 1.5 Joomla Joomla 1.0.15 Joomla Joomla 1.0.14 Joomla Joomla 1.0.13 Joomla Joomla 1.0.12 Joomla Joomla 1.0.11 Joomla Joomla 1.0.10 Joomla Joomla 1.0.9 Joomla Joomla 1.0.8 Joomla Joomla 1.0.7 Joomla Joomla 1.0.4 Joomla Joomla 1.0.3 Joomla Joomla 1.0.2 Joomla Joomla 1.0.1 Joomla Joomla 1.0 |
| Not Vulnerable: | |
Discussion
Joomla! 'return' Parameter Open Redirection Vulnerability
Joomla! is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
Joomla! version 1.5 and prior are vulnerable; other versions may also be affected.
Joomla! is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
Joomla! version 1.5 and prior are vulnerable; other versions may also be affected.
Exploit / POC
Joomla! 'return' Parameter Open Redirection Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to following a malicious URI.
The following example URI is available:
http://www.example.com/path/index.php?option=cookiecheck&return=http://Google.com/
An attacker can exploit this issue by enticing an unsuspecting victim to following a malicious URI.
The following example URI is available:
http://www.example.com/path/index.php?option=cookiecheck&return=http://Google.com/
Solution / Fix
Joomla! 'return' Parameter Open Redirection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].