Open redirect via unvalidated Referer header

Open redirect in Intelliants Subrion CMS 4.2.0 through 4.2.1 allows remote attackers to redirect users via a crafted Referer header. The login handler in front/login.php stores the HTTP Referer value in session state without validating its origin, and iaUsers::authorize later uses that value as the post-login destination. Exploitation requires a target to submit a login after arriving with an attacker-controlled Referer, enabling phishing through a trusted site rather than direct data access or code execution.