Open Redirect Vulnerability in iWebShop-5 Login Redirect

Executive Summary

This vulnerability is an open redirect flaw in the iWebShop-5 e-commerce system up to version 5.16. It exists in the login redirect function of the file plugins/_userInfo/_userInfo.php. The issue allows attackers to manipulate the callback parameter to redirect users to arbitrary malicious websites after successful login. The exploit is triggered by sending a crafted request with a malicious callback URL.

Useful 0 Not Useful 0

Detection Guidance

To detect this open redirect vulnerability in iWebShop-5, inspect the login flow for improper handling of the callback parameter. Check server logs for requests containing callback with external URLs. Use tools like curl to test if the application redirects to arbitrary domains when the callback parameter is manipulated. Example: curl -v 'http://target.com/login?callback=http://evil.com'

Review the files mentioned in the vulnerability report (plugins/_userInfo/_userInfo.php, controllers/simple.php, lib/web/controller/controller_class.php) for code that processes the callback parameter without proper validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables phishing attacks where users are tricked into visiting attacker-controlled sites after logging in. Attackers can steal session tokens, credentials, or other sensitive data. It may also be chained with other attacks like cookie fixation. Users of affected systems could unknowingly expose personal or financial information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables open redirect attacks, which could be exploited for phishing or credential theft. Such attacks may violate GDPR's requirement for secure data processing (Article 32) and HIPAA's safeguards for protecting patient data (45 CFR § 164.308). Unauthorized redirects could lead to unauthorized access to personal or health data, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict the callback parameter to relative paths only. Reject absolute URLs (http:, https:, //) and backslash variants. Implement a server-side allow-list of trusted internal routes for callbacks.

Update to the latest version of iWebShop-5 if a patch is available. If no patch exists, apply input validation to sanitize the callback parameter before redirection.

Useful 0 Not Useful 0