FirstBlood-#550 — Goto paramerter at /login.php vulnerable to reflective xss.
This issue was discovered on FirstBlood v2
On 2021-10-26, vishal Level 2 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
BugBountyHunter Membership
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Discription : goto paramerter at /login.php vulnerable to reflective xss.
Step's to Reproduce:
- visit /login.php
- add ?goto=javascript:confirm\x28document.cookie\x29 at the end of url.
- enter valid login credential's which can be generated using registration bypass i have reported earlier.
- You must get a current cookie session alert box pop up as below.
Let me know, if anything missing or further information is required.
Thanks and Regards - Vishal
P3 Medium
Endpoint: /login.php
Parameter: goto
Payload: javascript:confirm\x28document.cookie\x29
FirstBlood ID: 39
Vulnerability Type: Reflective XSS
Our mistake: The parameter "goto" on login.php should of been "fixed" when redirecting to prevent XSS but due to an oversight from Sean and Karl, the new code did not make it into production. This has since updated since the event ended and you're recommended to re-try. It's related to bug ID 26 because the idea was developers fixed *this* one (when redirecting) but forgot the other reflection.