Horde Webmail version 5.1 suffers from an open redirection vulnerability.
f3bfdd6bd23da3ad823bbc2c0e6dd878f8671a1ae58971fcb65267ec1cb64052
[+] Horde webmail - Open Redirect Vulnerability
[+] Date: 31/03/2014
[+] Risk: Low
[+] Remote: Yes
[+] Author: Felipe Andrian Peixoto
[+] Vendor Homepage: http://www.horde.org/apps/webmail
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on: Windows 7 and Linux
[+] Vulnerable File: go.php
[+] Dork: inurl:horde/util/go.php?
[+] Version: 5.1 probably other versions too
[+] Exploit : http://host/horde/util/go.php?url=[ Open Redirect Vul ]
[+] PoC: http://webmail.pmf.sc.gov.br/horde/util/go.php?url=http://www.horde.org/apps/webmail
http://www.imp.polymtl.ca/horde/util/go.php?url=http://www.horde.org/apps/webmail
Note : An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation.
This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.
Reference :https://www.owasp.org/index.php/Open_redirect