cve/2013/CVE-2013-2248.md

CVE-2013-2248

Description

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.

POC

Reference

• http://struts.apache.org/release/2.3.x/docs/s2-017.html
• http://struts.apache.org/release/2.3.x/docs/s2-017.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html

Github

• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/SexyBeast233/SecBooks
• https://github.com/woods-sega/woodswiki