n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix P1/P2 audit findings: shell-escape upload cmds, parameterize okta PII, harden JS parsing, restrict PHP to capture.php, tojson redirect_url

Browse Source
This commit is contained in:
n0mad1k
2026-06-25 10:25:35 -04:00
parent 014e3177b4
commit 231e70b942
5 changed files with 26 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/phishing/templates/js-payload.js.j2
+9 -5
View File
@@ -2,10 +2,14 @@
var u = new URLSearchParams(window.location.search);
var src = u.get('u') || '';
var dest = {{ redirect_url | tojson }};
if (src.indexOf('rid=') !== -1 || src.indexOf('RId=') !== -1) {
var params = new URLSearchParams(new URL(decodeURIComponent(src)).search);
var rid = params.get('rid') || params.get('RId');
if (rid) dest += (dest.indexOf('?') !== -1 ? '&' : '?') + 'rid=' + encodeURIComponent(rid);
}
try {
if (src && (src.indexOf('rid=') !== -1 || src.indexOf('RId=') !== -1)) {
var params = new URLSearchParams(new URL(src).search);
var rid = params.get('rid') || params.get('RId');
if (rid && rid.length <= 128) {
dest += (dest.indexOf('?') !== -1 ? '&' : '?') + 'rid=' + encodeURIComponent(rid);
}
}
} catch (e) {}
window.location.replace(dest);
})();