UC Gateway Investment SiteEngine v5.0 - Open Redirect

mediumseverity

5.8CVSS score

8.2%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action.

Impact

Attackers can redirect users to malicious sites for phishing or malware distribution.

Fix

Apply the latest patches or updates provided by the vendor to fix the open redirect vulnerability.

How to confirm it

Send: GET {{BaseURL}}/api.php?action=logout&forward=http://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:http?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$/

Run it with nuclei: nuclei -id CVE-2008-7269 -u <target>

The full check

id: CVE-2008-7269

info:
  name: UC Gateway Investment SiteEngine v5.0 - Open Redirect
  author: ctflearner
  severity: medium
  description: |
    Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action.
  impact: |
    Attackers can redirect users to malicious sites for phishing or malware distribution.
  remediation: |
    Apply the latest patches or updates provided by the vendor to fix the open redirect vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2008-7269
    - https://www.exploit-db.com/exploits/6823
    - https://github.com/tr3ss/newclei
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:P
    cvss-score: 5.8
    cve-id: CVE-2008-7269
    cwe-id: CWE-20
    epss-score: 0.08234
    epss-percentile: 0.94939
    cpe: cpe:2.3:a:boka:siteengine:5.0:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 1
    vendor: boka
    product: siteengine
    shodan-query:
      - html:"SiteEngine"
      - http.html:"siteengine"
    fofa-query: body="siteengine"
  tags: cve,cve2008,redirect,siteengine,boka,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api.php?action=logout&forward=http://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:http?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'

References

Use this check only on systems you are authorised to test. Where the data comes from