what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New


Posted Aug 29, 2002
Authored by Mark Litchfield | Site ngssoftware.com

OLE controls or OCX controls, are components (or objects) you can insert into a Web page or other application to reuse packaged functionality someone else programmed. An unchecked buffer exists in the ActiveX control used to display specially formatted text. This could be executed by encouraging an unsuspecting user to visit a malicious web page.

tags | exploit, web, activex
SHA-256 | 7c6b577c63be58c08729f85ca1894a7f7b06ba1e0c5bfe3bcc43ca20f299264a


Change Mirror Download
A vulnerability exists in the test.php script of OmniHTTPd.  The script
makes a classic coding error -- trusting unsanitized user input. The query
string and cookie values are returned unfiltered. Of most concern, of
course, is the query string:


The impact of this vulnerability will vary by site. A production site would
most likely *not* have the sample scripts installed, but it would be wise to

"The reason the mainstream is thought
of as a stream is because it is
so shallow."
- Author Unknown

OmniHTTPd's Test.shtml sample is also vulnerable to a similar issue:


Will pop up an alert containing the above URL. Of course, this has other
uses (cookie theft, faking sources, etc.)

I've discovered another vulnerability in one of the OmniHTTPd sample apps.
This time, the culprit is "/cgi-bin/redir.exe". This app is vulnerable to a
newline injection issue. The vulnerability occurs because the "URL" query
parameter (case sensitive) is decoded and placed directly into the response
as the "Location" header. If an attacker places urlencoded newlines
("%0D%0A") into the parameter, the headers following the "Location" header,
as well as the resultant entity, can be controlled.

I had a tough time exploiting this vulnerability to add headers, because
OmniHTTPd would not add my header. :-( However, I was able to exploit this
vulnerability to produce the following output:

[Begin Server Response]
HTTP/1.0 302 Redirection
Content-Type: text/html
Date: Sun, 25 Aug 2002 16:36:39 GMT
Location: http://www.yahoo.com/
Server: OmniHTTPd/2.10


[End Server Response]

This will pop up an alert, and then redirect to yahoo.com on browsers that
display redirect entities (IE will not work for this)

I was a bit puzzled by the "Server" header between the Location and the
entity, but I figured out that OmniHTTPd was inserting the header after CGI
processing was complete.

Exploit URL:


"The reason the mainstream is thought
of as a stream is because it is
so shallow."
- Author Unknown

Login or Register to add favorites

File Archive:

September 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    2 Files
  • 2
    Sep 2nd
    21 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    17 Files
  • 5
    Sep 5th
    34 Files
  • 6
    Sep 6th
    29 Files
  • 7
    Sep 7th
    11 Files
  • 8
    Sep 8th
    25 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    26 Files
  • 12
    Sep 12th
    23 Files
  • 13
    Sep 13th
    17 Files
  • 14
    Sep 14th
    22 Files
  • 15
    Sep 15th
    16 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    19 Files
  • 19
    Sep 19th
    60 Files
  • 20
    Sep 20th
    23 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    8 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By