CVE-2020-18268

MEDIUMNuclei

Z-Blog <=1.5.2 - Open Redirect

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-18268 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php."

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMZ-Blog <=1.5.2 - Open RedirectCVSS 6.1

Z-Blog 1.5.2 and earlier contains an open redirect vulnerability via the redirect parameter in zb_system/cmd.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the execution of further attacks.

Remediation

Upgrade Z-Blog to version 1.5.3 or later to fix the open redirect vulnerability.

WeaknessesCWE-601
Authors0x_Akoko
Template tagscvecve2020redirectzblogphpauthenticatedzblogcnvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:zblogcn:z-blogphp:*:*:*:*:*:*:*:*
https://github.com/zblogcn/zblogphp/issues/216 https://github.com/zblogcn/zblogphp/issues/209 https://nvd.nist.gov/vuln/detail/CVE-2020-18268 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3