Description

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-13T16:19:07.580Z",
  "pubdate": "2026-08-13T16:19:07.580Z",
  "executiveSummary": "Saurus CMS Community Edition suffers from an unauthenticated open redirect vulnerability residing within its logout handling mechanism.\nThe flaw allows remote attackers to supply arbitrary URLs via the url parameter using either GET or POST methods.\nUpon processing a logout request, the application passes the supplied parameter directly into the HTTP Location header without implementing domain allowlists, scheme validation, or relative path enforcement.\nSuccessful exploitation enables threat actors to craft malicious logout URLs that redirect authenticated users to external, attacker-controlled phishing infrastructure immediately following session destruction.\nThis behavior facilitates advanced social engineering attacks, credential harvesting, and potential OAuth redirect abuse against unsuspecting users.\nThe vulnerability presents significant risk implications as it requires no prior authentication or elevated privileges, lowering the barrier to entry for malicious actors.\nExploitation relies on inducing a victim to interact with a maliciously crafted link pointing to the vulnerable logout endpoint.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and lack of validation within the logout handling logic located in classes/port.inc.php.\nThe component fails to enforce security controls such as domain allowlisting, URI scheme validation, or relative path restrictions on the url parameter accepted via HTTP GET or POST methods.\nAs a result, the application dynamically incorporates user-supplied input directly into the HTTP Location header response without verifying its destination.\nNetwork exposure is fully external, allowing any unauthenticated remote attacker on the network to interact directly with the vulnerable endpoint without holding any administrative or standard user privileges.\nThe attack flow proceeds as follows: an attacker crafts a malicious URI targeting the logout handler in classes/port.inc.php, appending an arbitrary external domain or a javascript: URI scheme to the vulnerable url parameter.\nThe attacker distributes this crafted link to authenticated users of Saurus CMS Community Edition via phishing emails, malicious web pages, or other communication vectors.\nWhen the victim accesses the malicious link, the Saurus CMS application processes the request, destroys the active user session, and issues an HTTP response containing the unvalidated Location header.\nThe victim's browser interprets the malicious Location header and automatically redirects the user to the attacker-controlled external domain or executes the injected URI payload.\nPost-exploitation impact includes seamless transitions from a trusted application context to malicious phishing pages designed to capture subsequent credentials, manipulate session tokens, or facilitate secondary attacks such as OAuth redirect abuse under the guise of an authentic session termination."
}