Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, Mage_ProductAlert_AddController::stockAction() reads the uenc query parameter and passes it directly to $this->_redirectUrl($backUrl) without calling $this->_isUrlInternal(). When the supplied product_id does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as uenc. This vulnerability is fixed in 20.18.0.

Affected: Packagist: openmage/magento-lts

## Summary `Mage_ProductAlert_AddController::stockAction()` reads the uenc query parameter and passes it directly to `$this->_redirectUrl($backUrl)` without calling `$this->_isUrlInternal()` When the supplied `product_id` does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as `uenc`.

## Vulnerable path:

```php // app/code/core/Mage/ProductAlert/controllers/AddController.php : stockAction()

$backUrl = $this->getRequest()->getParam(Mage_Core_Controller_Front_Action::PARAM_NAME_URL_ENCODED); // raw, no decode $productId = (int) $this->getRequest()->getParam('product_id');

if (!$backUrl || !$productId) { $this->_redirect('/'); return; }

$product = Mage::getModel('catalog/product')->load($productId);

if (!$product->getId()) { $session->addError($this->__('Not enough parameters.')); $this->_redirectUrl($backUrl); // ← NO _isUrlInternal() check return; } ```

### Secure peer (priceAction()):

```php if (!$product->getId()) { if ($this->_isUrlInternal($backUrl)) { // ← validation present $this->_redirectUrl($backUrl); } else { $this->_redirect('/'); } return; } ```

## Steps to Reproduce

### Prerequisites - OpenMage LTS ≤ 20.16.0 with Product Alerts enabled (default configuration) - A valid, logged-in customer session on the target store

#### Step 1 – Authenticate as a Customer (Attacker controls the crafted link; victim must be logged in)

The `preDispatch…