HexBrain

Nextcloud · Report #213056

Invalid request may lead content spoofing for phishing

Validstatus
11upvotes
12 Apr 2017disclosed

How it was found

HI,

I found that site have invalid request may lead to content spoof.

Proof Of Concept:

https://logs.nextcloud.com/redirect_uri?And_move_t0_malicioussite.com

Thanks,

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original