u5CMS 3.9.3 Open Redirect

`  
u5CMS 3.9.3 Multiple Open Redirect Vulnerabilities  
  
  
Vendor: Stefan P. Minder  
Product web page: http://www.yuba.ch  
Affected version: 3.9.3 and 3.9.2  
  
Summary: u5CMS is a little, handy Content Management System for medium-sized  
websites, conference / congress / submission administration, review processes,  
personalized serial mails, PayPal payments and online surveys based on PHP and  
MySQL and Apache.  
  
Desc: Input passed via the 'uri' GET parameter in 'meta2.php' script and using  
Cookie 'pidvesa' is not properly verified before being used to redirect users.  
This can be exploited to redirect a user to an arbitrary website e.g. when a  
user clicks a specially crafted link to the affected script hosted on a trusted  
domain.  
  
==============================================================================  
\u5admin\pidvesa.php:  
---------------------  
  
Line 5: if ('<?php echo $_COOKIE['pidvesa']?>'!='') location.href='<?php echo $_COOKIE['pidvesa']?>'+'.php';  
  
==============================================================================  
  
Tested on: Apache 2.4.10 (Win32)  
PHP 5.6.3  
MySQL 5.6.21  
  
  
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2015-5227  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5227.php  
  
  
29.12.2014  
  
---  
  
  
#1  
  
This request example adds '.php' at the end to the pidvesa cookie value:  
  
GET /u5cms/u5admin/pidvesa.php HTTP/1.1  
Host: 10.0.50.3  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Cookie: PHPSESSID=mkmhuo3gquomkki4lurhap45o3; aclan=de; pidvesa=http://zeroscience.mk/evil/script;  
Connection: keep-alive  
  
- To redirect to: http://zeroscience.mk/evil/script.php  
  
  
--  
  
#2  
  
GET /u5cms/u5admin/meta2.php?uri=http://zeroscience.mk HTTP/1.1  
`