Es posible poder navegar a cualquier pagina en Point Smart application

Summary

We thank @andresbebe for the report and for providing clear reproduction steps with a proof-of-concept code demonstrating the vulnerability. MercadoLibre acknowledged the issue and worked on a fix internally.

A vulnerability has been identified in the Point Smart application where users can navigate outside the intended application environment through a link. This navigation capability potentially allows for the vectorization of phishing attacks.

En el POS en "Mas opciones" --->En el link "Ayudenos a mejorar" {F3844562} ---> Link "Con tecnologia Qualtrics" {F3844565} --->Sitio de qualtrics {F3844567} --->"Free Account" {F3844568} --->"La pagina ROMPE" {F3844570} --->Abajo links de Youtube,Linkedin,facebook y twitter(X) {F3844573} --->Link de youtube---> {F3844580} Creamos en un perfil propio de youtube un enlace de google: {F3844618} ---> Podemos salir navegando... {F3844621}