I am currently pentesting a site for a client of mine and I found a very strange 'bug'.
They have a search box on the home page which if I enter
te\tst and hit search, it redirects to the search results page (not via ajax), and in the title it shows the keywords which I searched for, however, the control character actually gets executed.
So the title tag says this:
"te st | site name" <-- Executed the \t and created 4 spaces.
So my questions really are:
- Could this be classed as a potential vulnerability?
- Is there anyway that this can be exploited?
Just FYI, it does also execute other control-characters not just the tab. I just tried \r\n and it new-lined it.
Also, it only executes the control characters if they are encapsulated within other characters, so:
\r\n doesn't work
te\r\nst will return te[new line]st