Avideo: Reflected XSS in the login page

[ahussam]

Login page is vulnerable to XSS user?redirectUri="><img%20src=x%20onerror=alert(1)>
Make sure to filter the redirectUri parameter.

[DanielnetoDotCom]

Thanks again

[ahussam]

This issue won't be fixed with your patch since an attacker can pass a valid URL with XSS vector in the parameter e.g http://www.google.com/?x="><img src=x onerror=alert(1)>
@DanielnetoDotCom

[DanielnetoDotCom]

I tried it here and does not seem to have any effect https://demo.avideo.com/user?redirectUri=http://www.google.com/?x=%22%3E%3Cimg%20src=x%20onerror=alert(1)%3E

[ahussam]

Check this vector:

https://demo.avideo.com/user?redirectUri=http://www.google.com/%22%3E%3Cscript%3Ealert(1)%3C/script%3E

@DanielnetoDotCom

[DanielnetoDotCom]

Thanks, what about now?

[ahussam]

Fixed

[ronaldod]

Just curious why not sanitize?

$_POST = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);

[DanielnetoDotCom]

I did not know that.

but do you think it worth filter all post array? maybe add this only for some specific vars?

[ronaldod]

Depending on the expecting chars that are passed you can sanitize the whole post. It is worth the investigation. Now you are blacklisting instead of whitelisting.