Very long names on demo.openmage.org could redirect victim users to malicious url redirects via email contacts.

Summary: We found that the maximum length of the first and last name fields was not set to 32 characters at registration and to 1000 characters when using the profile update form. The attacker can use this method as a malware attack, the user will redirect to a website that contains malware or …

POST /customer/account/createpost/ HTTP/1.1
Host: demo.openmage.org/
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 91

Content-Disposition: form-data; name="error_url"


------WebKitFormBoundaryZaGjL6AhSOgUPeQl …