Description

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The only sanitization is remove_xss(), an XSS keyword/entity scrubber. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T02:16:53.490Z",
  "pubdate": "2026-09-21T02:16:53.490Z",
  "executiveSummary": "A critical open redirect vulnerability exists in WuzhiCMS versions up to 4.1.0, specifically within the Login component accessed via /index.php?m=member&v=Login. The flaw originates from the improper handling of the 'forward' argument, which allows an attacker to redirect users to arbitrary, potentially malicious, third-party domains.\nThis vulnerability is classified as an open redirect, which can be leveraged as part of sophisticated social engineering or phishing campaigns. By manipulating the 'forward' parameter, remote, unauthenticated attackers can craft deceptive links that appear to originate from a trusted WuzhiCMS installation, significantly increasing the probability of user compromise.\nThe vulnerability is exacerbated by insufficient input sanitization, as the application relies solely on an XSS filter (remove_xss()) that does not inspect or restrict the destination URL provided via the redirection parameter. Because the vendor has been non-responsive to disclosures, no official patch is currently available. Organizations deploying affected versions are at risk of link-manipulation attacks, necessitating immediate defensive measures to prevent external redirection vectors.",
  "technicalDetails": "The vulnerability resides in the login processing logic of WuzhiCMS, specifically within the module handling user authentication (/index.php?m=member&v=Login). The application utilizes a 'forward' URL parameter to redirect users to a specific location after a successful authentication event. The root cause of this vulnerability is the lack of server-side validation or canonicalization for the URL passed to the 'forward' parameter.\nDuring the request handling process, the application accepts the 'forward' argument without verifying if the target domain matches the application's legitimate base domain. The developer attempted to implement security controls using the 'remove_xss()' function, which is designed to mitigate Cross-Site Scripting by scrubbing malicious scripts or HTML entities. However, 'remove_xss()' is entirely ineffective against open redirect vectors, as it does not validate the integrity or the domain of a URL string.\nThe attack flow follows a straightforward progression: A remote, unauthenticated attacker constructs a malicious URL targeting the vulnerable endpoint, appending a crafted payload to the 'forward' parameter (e.g., /index.php?m=member&v=Login&forward=http://malicious-site.com). When a victim clicks the link and completes the authentication process, the application processes the untrusted 'forward' parameter and issues an HTTP 302 redirect response to the browser, directing the user to the attacker-controlled destination.\nBecause the 'forward' parameter is not subject to a whitelist of allowed domains or path validation, the application allows for absolute URLs pointing to external domains. This behavior facilitates phishing, where attackers use the trusted site's domain to redirect users to a credential-harvesting page. Since the redirection occurs post-authentication, users are more likely to trust the legitimacy of the process. The impact is primarily a high degree of leverage for social engineering, potentially leading to session hijacking, credential theft, or the delivery of further client-side exploits. There are no privilege requirements for this attack, and the vulnerability is accessible over standard network protocols (HTTP/HTTPS) without requiring prior authentication or internal access to the system."
}