I was pen-testing a site recently which I found a few issues in, and this continues to a previous question I asked about Null-byte string termination in web applications.
I have noticed that the site does not filter out URL Encoded CR/LF characters, and if I inject these characters, they do get respected in the source code (you can see the code gets shifted down in the page).
I have checked the returning headers, but there is no sign of any data which I try to inject, also any XSS characters I do inject get filtered (html entities) by the page ('<' => <
, etc)
So my question is, is this CRLF injection potentially exploitable?
Thanks!