Open Redirect in WuzhiCMS Login Component

Executive Summary

This vulnerability is an open redirect flaw in WuzhiCMS versions up to 4.1.0. It affects the login page where the 'forward' parameter can be manipulated to redirect users to arbitrary URLs after successful login. The only protection is a basic XSS scrubber called remove_xss().

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /index.php?m=member&v=login with a 'forward' parameter containing an external URL. Check server logs for redirects to suspicious domains after login attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could trick you into visiting a legitimate-looking login page with a malicious 'forward' parameter. After you log in, you would be redirected to a fake site controlled by the attacker, potentially stealing your credentials or installing malware. This is often used for phishing attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling phishing attacks. If exploited, attackers may trick users into entering credentials on malicious sites, potentially leading to unauthorized access to personal or health data. However, the vulnerability itself does not directly violate these regulations but could facilitate breaches that do.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict the 'forward' parameter to only accept relative paths or whitelist same-origin URLs. Block absolute URLs to external domains. Update WuzhiCMS to the latest version if available.

Useful 0 Not Useful 0