cURL header injection

curl-header-inject.php

<?php

$proxy = 'http://127.0.0.1:8080';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,"http://www.w3af.org/");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_PROXY, $proxy);

$headers = array();
$headers[] = "Foo: 0\r\nX: Y";

curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

$server_output = curl_exec ($ch);

curl_close ($ch);

/*
    This HTTP request is sent (note the injected X: Y header):

        GET / HTTP/1.1
        Host: www.w3af.org
        Accept: */*
        Foo: 0
        X: Y
        Connection: close

*/

?>