Description
An open redirect vulnerability exists in admin/auth.php of NooMS 1.1. The g_site_url parameter is used to build the redirect target without validation, so a remote URL supplied in the request is followed.
Impact
An attacker can craft a link that appears to point at the trusted site but sends the visitor to an arbitrary external page. Because the link starts at the administrative login script, it is well suited to phishing for administrator credentials.
Solution
Take the site URL from the server side configuration instead of the request, or reject any g_site_url value that is not a local path.