## https://sploitus.com/exploit?id=PACKETSTORM:181620
====================================================================================================================================
| # Title : Online Exam System 1.0 HTML Form found in redirect page Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) |
| # Vendor : https://www.kashipara.com/project/download/project2/user/2024/202406/kashipara.com_exam-zip.zip |
====================================================================================================================================
poc :
[+] An HTML form was found in the response body of this page. However, the current page redirects the visitor to another page by returning an HTTP status code of 301/302.
Therefore, all browser users will not see the contents of this page and will not be able to interact with the HTML form.
Sometimes programmers don't properly terminate the script after redirecting the user to another page. For example:
<?php
if (!isset($_SESSION["authenticated"])) {
header("Location: auth.php");
}
?>
<title>Administration page</title>
<form action="/admin/action" method="post">
<!-- ... form inputs ... -->
</form>
<!-- ... the rest of the administration page ... -->
This script is incorrect because the script is not terminated after the "header("Location: auth.php");" line.
An attacker can access the content the administration page by using an HTTP client that doesn't follow redirection (like HTTP Editor).
This creates an authentication bypass vulnerability.
The correct code would be
<?php
if (!isset($_SESSION[auth])) {
header("Location: auth.php");
exit();
}
?>
<title>Administration page</title>
<form action="/admin/action" method="post">
<!-- ... form inputs ... -->
</form>
<!-- ... the rest of the administration page ... -->
This vulnerability affects /exam/admin/quesadd.php.
Greetings to :==================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R |
================================================================