2021-06-29 10:05:09 +00:00
id : CVE-2021-24406
info :
name : wpForo Forum < 1.9.7 - Open Redirect
author : 0x_Akoko
description : The plugin did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login.
reference : https://wpscan.com/vulnerability/a9284931-555b-4c96-86a3-09e1040b0388
2021-09-10 11:26:40 +00:00
severity : medium
2021-06-30 18:13:06 +00:00
tags : wordpress,redirect,cve,cve2021
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.10
cve-id : CVE-2021-24406
cwe-id : CWE-601
2021-06-29 10:05:09 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/community/?foro=signin&redirect_to=https://example.com/"
matchers :
- type : regex
regex :
- '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
part : header
