Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-0748. PoCs published by gonzxph.
AI-analyzed exploit summary This PoC demonstrates an open redirect vulnerability in BTCPayServer 1.7.5 and lower, where the `returnUrl` parameter in the recovery seed backup endpoint can be manipulated to redirect users to an arbitrary domain. The attack requires user interaction to click a crafted link and confirm an action.
Description
Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
Exploits (1)
This PoC demonstrates an open redirect vulnerability in BTCPayServer 1.7.5 and lower, where the `returnUrl` parameter in the recovery seed backup endpoint can be manipulated to redirect users to an arbitrary domain. The attack requires user interaction to click a crafted link and confirm an action.
References (2)
Scores
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H