id: CVE-2020-18268 info: name: Z-Blog <=1.5.2 - Open Redirect author: 0x_Akoko severity: medium description: Z-Blog 1.5.2 and earlier contains an open redirect vulnerability via the redirect parameter in zb_system/cmd.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. remediation: | Upgrade Z-Blog to version 1.5.3 or later to fix the open redirect vulnerability. reference: - https://github.com/zblogcn/zblogphp/issues/216 - https://github.com/zblogcn/zblogphp/issues/209 - https://nvd.nist.gov/vuln/detail/CVE-2020-18268 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2020-18268 cwe-id: CWE-601 epss-score: 0.00138 epss-percentile: 0.4903 cpe: cpe:2.3:a:zblogcn:z-blogphp:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: zblogcn product: z-blogphp tags: cve,cve2020,redirect,zblogphp,authenticated http: - raw: - | POST /zb_system/cmd.php?act=verify HTTP/1.1 Host: {{Hostname}} Content-Length: 81 Content-Type: application/x-www-form-urlencoded Connection: close btnPost=Log+In&username={{username}}&password={{md5("{{password}}")}}&savedate=0 - | GET /zb_system/cmd.php?atc=login&redirect=http://www.interact.sh HTTP/2 Host: {{Hostname}} cookie-reuse: true matchers: - type: regex part: header regex: - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1 # digest: 4b0a0048304602210097083cdc2dffcaccdbd6616665b03aed889512984c5c0b7215de8838589cfca2022100e120b5c4987447ce66daf67ec3fd2c63c7992732f20a458043db94f7a7e40b03:922c64590222798bb761d5b6d8e72950