CyberRota Analysis
AI-GeneratedSaurus CMS Community Edition is vulnerable due to an unauthenticated open redirect in its logout handling code, allowing attackers to manipulate the URL parameter without proper validation. This flaw can lead to phishing attacks, where users are redirected to malicious sites post-logout, potentially compromising their credentials. Organizations using this CMS should prioritize remediation to protect their users from phishing and credential theft risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.