OWOX, Inc. · Report #171473
HTTP Response Splitting(CRLF injection) in bi.owox.com
Validstatus
13upvotes
20 Dec 2016disclosed
How it was found
Hello, I found a CRLF injection vulnerability in bi.owox.com
More about HTTP response splitting https://www.owasp.org/index.php/Testing_for_HTTP_Splitting/Smuggling_(OTG-INPVAL-016)
POC (Burp) > Adding a new header with %0d%0a
{F122461}
Regards, Florin