[Low-Hanging Fruit] Craigsphone Transcoder Open URL Redirection

["Jeremi Gosney" <epixoip () hush com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Craigsphone is a mobile phone app for viewing and managing
Craigslist pages. It relies on a WAP transcoding service for re-
formatting and serving pages on Craigslist. The transcoder does not
perform any validation on the 'uri' parameter, allowing it to
function as an open redirect.

POC:
http://nextmobileweb.com/craigslist/tr_page?uri=http://www.google.co
m
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQMCAAYFAkohBAAACgkQacHgESW3wZqZUgP/cVREs3jGqhLdJhCEsloWJAdcJ/if
8Y/mxM3Sml+KPdA/TffnY46zaFtuGQ34wrw9g3Mus0e/6NKdEBX8PYaevGNJnMx/4YOX
U8xF7lPT/NUPB7KaOcjCnRthNAGkuc1C5J9MhQt44Psetz+cNOVQEht1XOJPjIIqlGJA
HDVm/do=
=RmL6
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/