Description

When a user, who has access to admin page and who is not logged in, opens a page like http://forkcms.site/private/de/authentication?querystring=//google.de/ and the user enters their credentials, the user is redirected to https://google.de.

When a user, who has access to admin page and who is already logged in, opens the same page, the user will be automatically redirected to https://google.de.

There are different payloads which can be used here (listed below in the Proof of Concept part).

Proof of Concept

Open a page like this (replace forkcms.site with you own address).

http://forkcms.site/private/de/authentication?querystring=//google.de/
http://forkcms.site/private/de/authentication?querystring=/%5cgoogle.com
http://forkcms.site/private/de/authentication?querystring=//google%00.com

Impact

This way, an attacker could redirect the user to any page the attacker conrols.