Overview #
An Open Redirection vulnerability exists in OrangeForum version 1.4.0. The vulnerability allows remote attackers to redirect users to arbitrary external websites.
Vulnerability Details #
Affected Versions: 1.4.0 and earlier
Root Cause: Insufficient validation of redirect URLs allows attackers to redirect users to malicious websites.
Exploitation Requirements #
- No authentication required
- Victim must click a crafted link
Impact #
Remote attackers can exploit this vulnerability to:
- Redirect users to phishing sites
- Steal user credentials via fake login pages
- Distribute malware
Proof of Concept #
Details available upon request.
Solution #
Upgrade to a patched version of OrangeForum that includes proper URL validation.
References #
- Vendor notification sent
Timeline #
2018-01-01— Discovered
Credits: Omar Kurt