pfSense » pfSense Packages

sgerror.php is also still accessible even with the internal error redirector redirecting to external site like Google.com.

Please see attached photos

Redirector does direct also to Google now however I can still get to sgerror.php

This should in theory no longer be accessible if you are not using it or it is set to EXT URL.

That action is just echoing back the input to the user but as it passes through a query string and so on, the contents are not evaluated, only printed. It ends up encoded in a way that doesn't make it possible to execute anything. I tossed a bunch of different inputs at it (various PHP commands, exec commands, javascript tags, and so on) and thus far have been unable to produce anything other than benign output. Not even rendered HTML, just URL encoded strings.

It could maybe use an extra layer of encoding for safety but it doesn't appear to be critical unless it's something browser-specific that I've been unable to trigger.

Also in the future, this is NOT the place or method to report suspected security issues. Please report them responsibly as detailed on https://www.netgate.com/security and do not discuss them publicly.