Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the returnto parameter to login.php or (2) the returnto parameter in a delete action to news.php. NOTE: this can be leveraged for cross-site scripting (XSS) by redirecting to a data: URI.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-06-19T19:00:00

Updated: 2024-08-07T05:36:21.019Z

Reserved: 2009-06-19T00:00:00

Link: CVE-2009-2138

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2009-06-19T19:30:00.267

Modified: 2024-11-21T01:04:13.177

Link: CVE-2009-2138

cve-icon Redhat

No data.