4Images 1.7.10 - adminindex.php?redirect Arbitrary Site Redirect

2012-01-31T00:00:00
ID EXPLOITPACK:68C3FAC757CFE80334A5C867E04FE9F9
Type exploitpack
Reporter RandomStorm
Modified 2012-01-31T00:00:00

Description

4Images 1.7.10 - adminindex.php?redirect Arbitrary Site Redirect

                                        
                                            source: https://www.securityfocus.com/bid/51774/info
  
4images is prone to multiple input-validation vulnerabilities including:
  
1. A cross-site scripting vulnerability.
2. An open-redirection vulnerability.
3. An SQL-injection vulnerability.
  
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
  
4images 1.7.10 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/index.php?__csrf=931086345abbb83f9a70c87dc4719248& action=login&redirect=http://google.com&loginusername=admin&loginpassword=pass