Description
The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Mr. Tokumaru · textremotephp
https://www.exploit-db.com/exploits/37688
References (10)
Core 10
Core References
Mailing List mailing-list
x_refsource_mlist
http://openwall.com/lists/oss-security/2012/09/05/15
Third Party Advisory x_refsource_confirm
http://security-tracker.debian.org/tracker/CVE-2011-1398
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1027463
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/55078
Various Sources x_refsource_misc
https://bugs.php.net/bug.php?id=60227
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1307.html
Mailing List mailing-list
x_refsource_mlist
http://openwall.com/lists/oss-security/2012/08/29/5
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html
Various Sources mailing-list
x_refsource_mlist
http://article.gmane.org/gmane.comp.php.devel/70584
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1569-1
Scores
EPSS
0.0790
EPSS Percentile
92.1%
Details
CWE
CWE-20
Status
published
Products (11)
php/php
5.3.0
php/php
5.3.1
php/php
5.3.2
php/php
5.3.3
php/php
5.3.4
php/php
5.3.5
php/php
5.3.6
php/php
5.3.7
php/php
5.3.8
php/php
5.3.9
... and 1 more
Published
Aug 30, 2012
Tracked Since
Feb 18, 2026