ocPortal 'redirect' Parameter URI Redirection Vulnerability
BID:54715
Info
ocPortal 'redirect' Parameter URI Redirection Vulnerability
| Bugtraq ID: | 54715 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 29 2012 12:00AM |
| Updated: | Jul 29 2012 12:00AM |
| Credit: | Aung Khant |
| Vulnerable: |
ocPortal ocPortal 7.1.5 |
| Not Vulnerable: |
ocPortal ocPortal 7.1.6 |
Discussion
ocPortal 'redirect' Parameter URI Redirection Vulnerability
ocPortal is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
Versions prior to ocPortal 7.1.6 are vulnerable.
ocPortal is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
Versions prior to ocPortal 7.1.6 are vulnerable.
Exploit / POC
ocPortal 'redirect' Parameter URI Redirection Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URI is available:
http://www.example.com/ocportal/index.php?page=login&type=misc&redirect=http://example1.com
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URI is available:
http://www.example.com/ocportal/index.php?page=login&type=misc&redirect=http://example1.com
Solution / Fix
ocPortal 'redirect' Parameter URI Redirection Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
ocPortal 'redirect' Parameter URI Redirection Vulnerability
References:
References:
- ocPortal Home Page (ocPortal)