| शीर्षक | SourceCodester SourceCodester KLiK Social Media Website v1.0.1 CRLF Injection |
|---|
| विवरण | During security testing of the user registration functionality in signup.inc.php, multiple HTTP header injection vulnerabilities were discovered. The application takes user-supplied input from the uid (username) and mail (email) parameters submitted via POST request and unsafely concatenates them into the Location HTTP response header without proper sanitization, validation, or encoding.
By injecting CR (Carriage Return, %0d) and LF (Line Feed, %0a) characters into either the uid or mail parameters, an attacker can manipulate the HTTP response structure. The vulnerabilities are triggered during various registration error conditions, including:
Empty required fields
Invalid email format
Invalid username format (alphanumeric check failure)
Password mismatch
Duplicate username |
|---|
| स्रोत | ⚠️ https://github.com/msaad1999/KLiK-SocialMediaWebsite |
|---|
| उपयोगकर्ता | g111 (UID 92409) |
|---|
| सबमिशन | 27/04/2026 04:07 AM (6 महीनों पहले) |
|---|
| संयम | 24/05/2026 08:52 AM (27 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 365403 [KLiK SocialMediaWebsite 1.0 HTTP POST Request Parameter अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|