vasserver.dyndns.org

HTTP Response Splitting Vulnerability

--------------------

TITLE:
Snitz Forums 2000 HTTP Response Splitting Vulnerability

SECUNIA ADVISORY ID:
SA12590

VERIFY ADVISORY:
http://secunia.com/advisories/12590/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
Snitz Forums 2000 3.4.x
http://secunia.com/product/1483/

DESCRIPTION:
Maestro has reported a vulnerability in Snitz Forums 2000, which can be exploited by malicious people to conduct script insertion and cross-site scripting attacks.

Input passed to the "location" parameter in "/down.asp" isn't properly sanitised before being used in a HTTP header. This may allow execution of arbitrary HTML and script code in a user's browser session associated with an affected site.

This can also be exploited to perform web cache poisoning.

The vulnerability has been reported in version 3.4.04. Other versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY:
Maestro De-Seguridad

See http://forum.snitz.com/forum/topic.asp?TOPIC_ID=54791 for information and fix.

fyi - http://secunia.com/advisories/12590/

quote:Originally posted by HuwR - Snitz Forums Admin

to fix this issue, simply remove the following line from down.asp (approx line 76)

if request.form("location") <> "" then response.redirect(request.form("location"))

it is not required.

thanks for the heads up