Executive brief
Cotonti is a PHP content management framework. The cot_url_check() function fails to properly validate redirect destinations, allowing attackers to redirect users to attacker-controlled websites. An attacker can craft a malicious URL that bypasses validation checks and tricks users into visiting phishing sites or other malicious hosts.
Technical details
The cot_url_check() function uses a regular expression lacking an end-of-string anchor to validate redirect destinations, allowing bypass via hostnames prefixed with the legitimate site domain. The ratings plugin and other redirect callers are vulnerable to this flaw. An attacker-supplied hostname starting with the expected domain will pass validation but redirect to an attacker-controlled host.
Affected products
- Cotonti Cotonti through 1.0.0
Timeline
- 2026-09-18: disclosed