During a web application penetration test, a tester discovers that the application includes user-supplied input in an HTTP redirect URL parameter without validation: https://app.com/redirect?url=https://victim.com. What vulnerability is present and what is the risk?
Select an answer to reveal the explanation.
Short Explanation
You've got an open redirect here. The app trusts the url parameter, so an attacker can send users through app.com to a malicious site. That makes the link look legit and helps phishing or credential harvesting.
Full Explanation
The correct vulnerability is an open redirect. It occurs because the application includes user-supplied input in a redirect URL parameter without validation, allowing an attacker to craft a URL on the legitimate domain (app.com) that redirects users to an attacker-controlled site. Users see the trusted domain in the link and are less suspicious, making open redirects effective phishing aids and useful for credential harvesting. The SQL injection option is wrong because SQL injection requires database query interaction; URL redirect parameters do not interact with databases in the way described. The SSRF option is wrong because SSRF causes the server to make requests to internal resources; an open redirect sends the user's browser to an external URL, not the server making internal requests. The XSS option is wrong because XSS requires reflected JavaScript in the page; a redirect sends the browser elsewhere without executing scripts in the current page context.