source: https://www.securityfocus.com/bid/49673/info
Toko LiteCMS is prone to an HTTP-response-splitting vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
Toko LiteCMS 1.5.2 is vulnerable; other versions may also be affected.
Cross Site Scripting Vulnerabilities
Toko Lite CMS 1.5.2 (EditNavBar.php) Multiple Parameters XSS POST Injection
Exploit!
HTTP Response Splitting
====================================================================
/edit.php:
--------------------------------------------------------------------
3: $charSet = "iso-8859-1";
4: $dir = "ltr";
5:
6: if ( isset( $_POST[ "charSet" ] ) )
7: {
8: $charSet = $_POST[ "charSet" ];
9:
10: if ( $charSet == "windows-1255" )
11: {
12: $dir = "rtl";
13: }
14: }
15:
16: header( "Content-Type: text/html; charset=" . $charSet );