Reflected XSS on the /register.php endpoint with the ref vulnerable parameter

FirstBlood-#446 — Reflected XSS on the /register.php endpoint with the ref vulnerable parameter
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-25, johandu97 Level 4 reported:


        Summary
Improper input validation leads to attackers injecting malicious characters causing XSS vulnerabilities
POC

Hi @zseano, I found reflected xss on /register.php endpoint with ref vulnerable parameter
Use payload to bypass filter: JavascRipt:alert(1)
Send url to victim: https://c6329b4c0ecc-johandu97.a.firstbloodhackers.com/register.php?ref=JavascRipt:alert(1), when victim click into Return to previous page, xss is executed




Recommendations
Validate/santize malicious inputs that cause xss like < > ' " ...

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: /register.php

Parameter: ref

Payload: JavascRipt:alert(1)

FirstBlood ID: 32
Vulnerability Type: Reflective XSS

The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as %09 will also bypass the filter.

BugBountyHunter

Summary

POC

Recommendations