Hi list. I checked some ideas and think that reflected XSS in user-agent and other http request headers fileds (cookies for example) can be exploited via http request smuggling\splitting cache poisoning attacks using described techniques. So vendors who discard such vulnerabilities as not explotable should take it into account.
Regards, Sergey V. Gordeychik, MCSE, MCT, CISSP _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
