Description

There is a goto parameter inside login.php webpage that is vulnerable to dom xss via redirection to javascript uri The goto parameter is reflected inside the reponse within

<script>top.location.href="HERE";</script> 

when the user login it is possible to redirect to javascript uri so we can trigger XSS to run javascript.

There is a filter that removes parentheses but we can use backtick instead ` There is also a filter that remove `alert` word but the filter is not recursive so the following payload will work `javascript:aalertlert`xss where the inner alert (inside another alert) will be removed but not the outter alert

Step to reproduce

• open the following url https://8745a5db48cf-neolex.a.firstbloodhackers.com/login.php?action=login&goto=javascript:aalertlert`xss`
• log in to your account
• You will see the alert box showing up , javascript is executed

Fix

You should whitelist the goto payload so it must start with / or http

Impact

The impact is XSS an attacker can execute javascript on behalf on the user, it means they can steal the session cookie of the victim