Description

An open redirect vulnerability exists in admin/auth.php of NooMS 1.1. The g_site_url parameter is used to build the redirect target without validation, so a remote URL supplied in the request is followed.

Impact

An attacker can craft a link that appears to point at the trusted site but sends the visitor to an arbitrary external page. Because the link starts at the administrative login script, it is well suited to phishing for administrator credentials.

Solution

Take the site URL from the server side configuration instead of the request, or reject any g_site_url value that is not a local path.

References