CVE-2018-15683

Vulnerability

An open redirect vulnerability exists in the BTITeam XBTIT torrent tracker software. The returnto parameter on the login page (/index.php?page=login) is not validated, allowing an attacker to supply a URL pointing to an arbitrary external domain. If a user is already authenticated when visiting the login page, the software immediately redirects them to the value of returnto without confirmation. This issue was identified in all versions up to the discovery date in August 2018 [1].

Exploitation

An attacker must craft a malicious link that includes a returnto parameter set to an external website (e.g., https://evil.com). The attacker then tricks a logged-in user into clicking this link (e.g., via phishing or social engineering). Since the user is already authenticated, the software instantly redirects them to the attacker-controlled site without any warning or user confirmation. No further authentication or privileges are required beyond the user's existing session [1].

Impact

Successful exploitation allows an attacker to redirect authenticated users to an arbitrary external site. This can be leveraged for phishing attacks, credential theft, or malware distribution by directing victims to a malicious page that mimics the legitimate site or serves malicious content. The open redirect can also be used to bypass URL-based security filters or to facilitate other social engineering attacks [1].

Mitigation

As of the publication date (September 5, 2018), no official patch or fixed version has been publicly released. The vendor (BTITeam) has not provided a specific update addressing this issue. Users are advised to monitor for future releases and, if possible, manually validate the returnto parameter on the server side to ensure it points to a trusted domain. No workaround is documented in the available references [1].