Executive brief
Neto CMS, an e-commerce platform used for managing online stores, contains a security flaw that allows attackers to manipulate web traffic. By sending a specially crafted web request, an attacker can trick the system into executing malicious code. This could lead to the theft of customer data, unauthorized access to the store management interface, or a complete takeover of the website.
Technical details
A CRLF injection (HTTP Response Splitting) vulnerability exists in Neto CMS versions 6.313.0 through 6.314.0. The flaw stems from improper neutralization of carriage return and line feed sequences (CWE-93) within HTTP headers. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request that injects malicious headers or content into the server's response. This can be leveraged to perform Cross-Site Scripting (XSS) or, as reported, achieve arbitrary code execution. While the attack vector is network-based, it typically requires some level of user interaction (UI:R) to trigger the malicious response in a victim's browser.
Affected products
- Neto Neto CMS 6.313.0 through 6.314.0
Timeline
- 2025-10-01: disclosed
- 2025-10-01: advisory