CVE-2020-21998 PoC — Subreddit Home Automation 输入验证错误漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-21998.yaml

Associated Vulnerability

Title:Subreddit Home Automation 输入验证错误漏洞 (CVE-2020-21998)
Description:Subreddit Home Automation是Subreddit社区的一个自动化设备。一个自动化电灯。 HomeAutomation 3.3.2 存在安全漏洞，该漏洞源于api.php脚本中的redirect GET参数传递的输入在用于重定向用户之前没有被正确验证。这可能被利用来重定向用户到任意网站。

Description

HomeAutomation 3.3.2 contains a redirect vulnerability caused by improper verification of the 'redirect' GET parameter in 'api.php', letting attackers redirect users to arbitrary websites, exploit requires user interaction with a crafted link.

File Snapshot


 id: CVE-2020-21998

info:
  name: HomeAutomation 3.3.2 - Open Redirect
  author: 0x_Akoko
  severity

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!