HexBrain

CFP Time · Report #474397

Error Page Content Spoofing or Text Injection

Validstatus
lowseverity
19upvotes
7 Jan 2019disclosed

How it was found

Description: hello sir, i found that one you once you write any thing after / in www.cfptime.org/ is reflected in the error page example go to www.cfptime.org/texthere you will see test here in the 404 error page

Steps To Reproduce:

1.go https://www.cfptime.org/!!!ATENTION!%20This%20server%20is%20on%20Maintenance%20please%20go%20to%20WWW.EVIL.COM%20since%20it%20was

2.see that The requested URL /!!!ATENTION! This server is on Maintenance please go to WWW.EVIL.COM since it was not found on this server. is found in the page i added attached picture as poc

Supporting Material/References:

i attached picture as poc

Impact

attacker could use this as phishing process to attack users

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original