osCommerce HTTP Response Splitting
Vendor: osCommerce
Product: osCommerce
Version: <= 2.2-MS2
Website: http://www.oscommerce.com
BID: 13979
CVE: CVE-2005-1951
OSVDB: 17284
SECUNIA: 15670
osCommerce is a very popular eCommerce application that allows for individuals to host their own online shop. All current versions of osCommerce are vulnerable to HTTP Response Splitting. These HTTP Response Splitting vulnerabilities may allow for an attacker to steal sensitive user information, or cause temporary web site defacement. The suggested fix for this issue is to make sure that CRLF sequences are not passed to the application.

HTTP Response Splitting:
osCommerce is vulnerable to HTTP Response Splitting. The problem lies in includes/application_top.php Here is some of the vulnerable code.
// performed by the 'buy now' button in product listings and review page
case 'buy_now' :        
if (isset($HTTP_GET_VARS['products_id'])) {
  if (tep_has_product_attributes($HTTP_GET_VARS['products_id'])) {
    tep_redirect(tep_href_link(FILENAME_PRODUCT_INFO, 'products_id=' . $HTTP_GET_VARS['products_id']));
  } else {
    $cart->add_cart($HTTP_GET_VARS['products_id'], $cart->get_quantity($HTTP_GET_VARS['products_id'])+1);
tep_redirect(tep_href_link($goto, tep_get_all_get_params($parameters)));
In the tep_has_product_attributes() function the products_id variable is typecast to an integer, and used in a query, so any malicious input must be appended to a valid product id. Also, the product must have attributes (product id 22 in the default install does).


As we can see from the above example, the returned headers include out "test" parameter. The same logic behind this vulnerability also applies to the "cust_order" parameter.


The only difference here is that the user must be logged in for this particular example will work. Also vulnerable is the banner.php script. When calling the script with the action parameter set to "url" an attacker may include malicious data in the "goto" parameter.

This was submitted to the osCommerce bugtracker several weeks ago. No fix has been released as of today. Users may edit the source code to prevent CRLF sequences from being passed to the application.

James Bercegay of the GulfTech Security Research Team