CFP Time · Report #474397
Error Page Content Spoofing or Text Injection
Validstatus
lowseverity
19upvotes
7 Jan 2019disclosed
How it was found
Description: hello sir, i found that one you once you write any thing after / in www.cfptime.org/ is reflected in the error page example go to www.cfptime.org/texthere you will see test here in the 404 error page
Steps To Reproduce:
2.see that The requested URL /!!!ATENTION! This server is on Maintenance please go to WWW.EVIL.COM since it was not found on this server. is found in the page i added attached picture as poc
Supporting Material/References:
i attached picture as poc
Impact
attacker could use this as phishing process to attack users