b2evolution CMS 6.11.6 Open Redirection

b2evolution CMS version 6.11.6 suffers from an open redirection vulnerability.


MD5 | deeacf09d2a642f1cd3efdcaa569ed88

# Exploit Title: *Open redirect in b2evolution CMS 6.11.6 redirect_to
parameter in email_passthrough.php*
# Google Dork: N/A
# Date: 10/02/2021
# Exploit Author: Soham Bakore, Nakul Ratti
# Vendor Homepage: https://b2evolution.net/
# Software Link:
https://b2evolution.net/downloads/6-11-6-stable?download=12405
# Version: 6.11.6
# Tested on: latest version of Chrome, Firefox on Windows and Linux
# CVE : *CVE-2020-22840*

Vulnerable File:
--------------------------
http://host/htsrv/email_passthrough.php <http://host/evoadm.php>

Vulnerable Issue:
--------------------------
redirect_to parameter has no input validation/domain whitelisting.

--------------------------Proof of Concept-----------------------
Steps to Reproduce:

1. Send the following link :
*http://127.0.0.1/htsrv/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fgoogle.com
<http://127.0.0.1/htsrv/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fgoogle.com>*
to
the unsuspecting user
2. The user will be redirected to Google.com or any other attacker
controlled domain
3. This can be used to perform malicious phishing campaigns on unsuspecting
users

Related Posts