Description
Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Cotonti Cotonti
Default version status: unaffected
0 to ≤ 1.0.0affected
pkg:composer/cotonti/cotontiReferences
- https://github.com/Cotonti/Cotonti/issues/1891 ↗
- https://github.com/Cotonti/Cotonti/pull/1899 ↗
- https://github.com/Cotonti/Cotonti/blob/1.0.0/system/functions.php ↗
- https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/ratings/ratings.ajax.php ↗
- https://github.com/Cotonti/Cotonti ↗
- https://www.vulncheck.com/advisories/cotonti-through-1.0.0-open-redirect-via-unanchored-cot-url-check-regex ↗