SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Netsparker confirmed the vulnerability by executing a test SQL Query on the back-end database. In these tests, SQL Injection was not obvious but the different responses from the page based on the injection test allowed us to identify and confirm the SQL Injection.
Impact
Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
Reading, Updating and Deleting arbitrary data from the database
Executing commands on the underlying operating system
Reading, Updating and Deleting arbitrary tables from the database
Actions to Take
See the remedy for solution.
If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
Locate the all dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM change all legacy code to use these new libraries)
Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.
Remedy
A robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.
Required Skills for Successful Exploitation
There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..
Impact
During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.
Actions to Take
See the remedy for solution
Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.
Remedy
Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.
var view_all_board = document.getElementById("view_all_board"); if(view_all_board) view_all_board.style.height = "450px"; var IMAGE_ROOT = 'http://www.paperg.com/beta/';var flyerboard_root = 'http://www.paperg.com/jsfb/';var remote_ip = '173.193.214.243';var view = '';var edit = '0';var EMBED_URL1552 = 'http://www.paperg.com/jsfb/embed.php?view=all&pid=891&cid=0&bid=1552';// links stylesheets in headfunction pg_linkss(filename) { var head = document.getElementsByTagName('head')[0]; link = document.createElement('link'); link.rel = 'stylesheet'; link.media = 'all'; link.type = 'text/css'; link.href = filename; head.appendChild(link);} // includes scripts in headfunction pg_include(filename) { var head = document.getElementsByTagName('head')[0]; script = document.createElement('script'); script.src = filename; script.type = 'text/javascript'; head.appendChild(script);} // includes scripts in bodyfunction include_body(filename) { var objBody = document.getElementsByTagName("body").item(0); var script = document.createElement('script'); script.src = filename; script.type = 'text/javascript'; objBody.insertBefore(script, objBody.firstChild);} var PG_fancybox_init = function(){ if($pg_jq != null && $pg_jq("a.fancy_iframe").length > 0) { if(typeof $pg_jq.fn.fancybox == 'undefined') { //$pg_jq.getScript("http://www.paperg.com/jsfb/includes/fancybox/jquery.easing-1.3.pack.js"); $pg_jq.getScript("http://www.paperg.com/jsfb/includes/fancybox/jquery.fancybox-1.3.4.pack.js", function() { $pg_jq.fancybox.init(); //call this because it doesn't always fire $pg_jq("a.fancy_iframe").fancybox({"onStart":function(){hide_other_objects();},"onClosed" : show_other_objects, "onComplete" : PG_expand_frame,"top":"0", "left":"0", "height":"0", "width":"0","transitionIn":"elastic", "transitionOut":"elastic", "scrolling":"no","padding":"0","type": "iframe"}); $pg_jq("a.fancy_iframe").click(function(){hide_other_objects();$pg_jq.fancybox.showActivity();}); }); } else { $pg_jq.fancybox.init(); //call this because it doesn't always fire $pg_jq("a.fancy_iframe").fancybox({"onStart":function(){hide_other_objects();},"onClosed" : show_other_objects, "onComplete" : PG_expand_frame,"top":"0", "left":"0", "height":"0", "width":"0","transitionIn":"elastic", "transitionOut":"elastic", "scrolling":"no","padding":"0","type": "iframe"}); $pg_jq("a.fancy_iframe").click(function(){hide_other_objects();$pg_jq.fancybox.showActivity();}); } } else { setTimeout('PG_fancybox_init();', 1000); }}//ie8.js and ie7.js used by some sites to emulate the respective browsers in //older versions make wrapper tags <!></!> that mess with css stylesfunction PG_float_aliens(){ var i; var flyer_wrapper_div; var tag_type; for(i = 0; i < 6; i++) { flyer_wrapper_div = document.getElementById("PG_flyer" + i); if(flyer_wrapper_div) { tag_type = flyer_wrapper_div.parentNode.nodeName; if(tag_type == '!') { flyer_wrapper_div.parentNode.style.float = 'left'; flyer_wrapper_div.parentNode.style.display = 'none'; flyer_wrapper_div.parentNode.style.display = 'inline-block'; } } else { break; } }}function PG_jq_wait(){ if(typeof jQuery == 'undefined' || typeof jQuery.find == 'undefined') { setTimeout("PG_jq_wait();", 100); } else { $pg_jq = jQuery.noConflict(true); PG_fancybox_init(); }}function PG_includes(){ pg_linkss("http://www.paperg.com/jsfb/css/fb/screen.css"); var browser=navigator.appName; version=navigator.appVersion.split('MSIE'); ieVer=parseInt(version[1]); if(browser=="Microsoft Internet Explorer") { if(ieVer < 7) pg_linkss("http://www.paperg.com/jsfb/css/fb/screen_ie6.css"); }}function PG_jq_includes(){ pg_linkss("http://www.paperg.com/jsfb/includes/fancybox/jquery.fancybox-1.3.4.css"); if(typeof jQuery == 'undefined' || typeof jQuery.find == 'undefined') { pg_include("//ajax.googleapis.com/ajax/libs/jquery/1.3.1/jquery.min.js"); PG_jq_wait(); } else if(jQuery.fn.jquery == '1.2.6' || jQuery.fn.jquery == '1.4.4') { jQuery.getScript("//ajax.googleapis.com/ajax/libs/jquery/1.3.1/jquery.min.js", function() {PG_jq_wait();}); } else { $pg_jq = jQuery; PG_fancybox_init(); }}function check_pg_exists(){ var pg_link_node = document.getElementById("PG_link"); var pg_flyerboard_node = document.getElementById('PG_fb'); if(!pg_link_node || !pg_flyerboard_node) { alert("Flyerboard code has been altered. Please consult your webmaster"); if(pg_flyerboard_node) pg_flyerboard_node.style.display = "none"; } else { var textToCheck = pg_link_node.innerHTML; if(textToCheck.indexOf("http://www.paperg.com") == -1) { alert("Flyerboard code has been altered. Please consult your webmaster"); if(pg_flyerboard_node) pg_flyerboard_node.style.display = "none"; } }}//monitor iframe to see if the element "done_loading" existsvar PG_expand_frame = function(){ var fancy_frame = document.getElementById('fancybox-frame'); if(location.hash != "#d") { var temp = fancy_frame.src.split("#"); if(temp.length != 2) { fancy_frame.src = fancy_frame.src + "#" + document.location.href; } $pg_jq("#fancybox-close").hide(); setTimeout(PG_expand_frame, 1000); } else { var new_top = ($pg_jq(window).height() - 700 ) / 2+$pg_jq(window).scrollTop(); if(new_top < 0) { new_top = 0; } $pg_jq('#fancybox-wrap').animate({ top: new_top + "px", left: ($pg_jq(window).width() - 800 ) / 2+$pg_jq(window).scrollLeft() + "px", width: '800px', height: '585px'}, 'fast', 'swing', function() { $pg_jq.fancybox.hideActivity(); $pg_jq("#fancybox-close").show();} ); $pg_jq("#fancybox-content").css({'width': '800px', 'height': '585px'}); location.hash = "a12"; }} function checkAll() { var boxes = document.getElementsByName("boards[]"); for (i = 0; i < boxes.length; i++) { boxes[i].checked = true; } } function uncheckAll() { var boxes = document.getElementsByName("boards[]"); for (i = 0; i < boxes.length; i++) { boxes[i].checked = false; } }/** * flyerboard.functions.js * * functions for use on intial load of the flyerboard, including opening and closing of the flyerviewer and tracking. *///keep track of all hidden elements, so that we can rehide them latervar PG_hidden_elements = [];var PG_visible_elements = [];var PG_default_elements = [];function sort_into_array_by_visibility(element){ switch(element.style.visibility) { case "hidden": PG_hidden_elements.push(element); break; case "visible": PG_visible_elements.push(element); break; default: PG_default_elements.push(element); break; }}/*Hide all other objects/embeds so as to avoid layering issue.*/var hide_other_objects = function(){ var mg=document.getElementsByTagName("object"); for(var i=0;i < mg.length;i++) { var id=mg[i].id||mg[i].name; if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } mg=document.getElementsByTagName("embed"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } mg=document.getElementsByTagName("iframe"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } } mg=document.getElementsByTagName("select"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } } };/*Once flyerviewer is closed, resume showing all other objects -- assuming they weren't already hidden*/var show_other_objects = function(){ var mg=document.getElementsByTagName("object"); for(var i=0;i < mg.length;i++) { var id=mg[i].id||mg[i].name; if(id != "stframe") { mg[i].style.visibility="visible"; } } mg=document.getElementsByTagName("embed"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id != "stframe") { mg[i].style.visibility="visible"; } } mg=document.getElementsByTagName("iframe"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { mg[i].style.visibility="visible"; } } } mg=document.getElementsByTagName("select"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { mg[i].style.visibility="visible"; } } } //can probably remove all the code before this, will need to take a look for(i=0;i < PG_hidden_elements.length;i++) { PG_hidden_elements[i].style.visibility = "hidden"; } for(i=0;i < PG_visible_elements.length;i++) { PG_visible_elements[i].style.visibility = "visible"; } for(i=0;i < PG_default_elements.length;i++) { PG_default_elements[i].style.visibility = ""; } PG_hidden_elements = []; PG_visible_elements = []; PG_default_elements = []; };/** * loads the flyerviewer using an iframe * * @param int camp_id * @param int instance */function load_flyerviewer(camp_id, instance){ if(board_id == undefined || board_id[instance] == undefined) { return; } setTimeout('hide_other_objects();', 500); //document.getElementById("fv-iframe").src = 'javascript:\'\';'; iframesrc = flyerboard_root + 'inc/flyerviewer.php?cid='+camp_id+'&bid='+board_id[instance] + '&pid='+pub_id[instance]+'&wid='+widget_id[instance]+'&rand='+(Math.floor(Math.random()*500000)) + "&view=" + view + "&edit=" + edit; document.getElementById("fv-iframe").src = iframesrc; document.getElementById("fv-iframe").style.width="810px"; document.getElementById("fv-iframe").style.height="600px"; document.getElementById("fv-div").style.display = ""; centerContent("fv-div");}/** * closes the flyerviewer and clears global variables */function close_flyerviewer(){ show_other_objects(); // send close signal to flyerviewer var iwin; if(navigator.userAgent.indexOf("Safari") != -1){ iwin = frames["fv-iframe"]; }else{ iwin = document.getElementById("fv-iframe").contentWindow; } iwin.location = iframesrc + "#close"; document.getElementById("fv-div").style.display = "none"; iwin.location = "javascript:''"; }var $pg_jq = null;var $old_jq = null;var PG_tt=function(){var id='PG_tt';var top=-100;var left=15;var maxw=150;var speed=12;var timer=20;var endalpha=95;var alpha=0;var tt,t,c,b,h;var ie=document.all?true:false;var objBody=document.getElementsByTagName("body").item(0);return{show:function(v,w){if(tt==null){tt=document.createElement('div');tt.setAttribute('id',id);t=document.createElement('div');t.setAttribute('id',id+'top');c=document.createElement('div');c.setAttribute('id',id+'cont');b=document.createElement('div');b.setAttribute('id',id+'bot');tt.appendChild(t);tt.appendChild(c);tt.appendChild(b);objBody.insertBefore(tt,objBody.firstChild);tt.style.opacity=0;tt.style.filter='alpha(opacity=0)';}document.onmousemove=this.pos;tt.style.display='block';c.innerHTML=v;tt.style.width=w?w+'px':'auto';if(!w&&ie){t.style.display='none';b.style.display='none';tt.style.width=tt.offsetWidth;t.style.display='block';b.style.display='block';}tt.style.width=maxw+'px';h=parseInt(tt.offsetHeight)+top;clearInterval(tt.timer);tt.timer=setInterval(function(){PG_tt.fade(1)},timer);},pos:function(e){var u=ie?event.clientY+document.documentElement.scrollTop:e.pageY;var l=ie?event.clientX+document.documentElement.scrollLeft:e.pageX;if(u-h<0)tt.style.top=0;else tt.style.top=(u-h)+'px';if(l+left<0)tt.style.left=0;else if((l+left)+maxw>document.body.clientWidth){tt.style.left=document.body.clientWidth-maxw*2+'px';}else tt.style.left=(l+left)+'px';document.onmousemove=null;},fade:function(d){var a=alpha;if((a!=endalpha&&d==1)||(a!=0&&d==-1)){var i=speed;if(endalpha-a<speed&&d==1){i=endalpha-a;}else if(alpha<speed&&d==-1){i=a;}alpha=a+(i*d);tt.style.opacity=alpha*.01;tt.style.filter='alpha(opacity='+alpha+')';}else{clearInterval(tt.timer);if(d==-1){tt.style.display='none'}}},hide:function(){clearInterval(tt.timer);tt.timer=setInterval(function(){PG_tt.fade(-1)},timer);}};}();function getScrollY(){var scrOfX=0,scrOfY=0;if(typeof(window.pageYOffset)=='number'){scrOfY=window.pageYOffset;}else if(document.body&&document.body.scrollTop){scrOfY=document.body.scrollTop;}else if(document.documentElement&&document.documentElement.scrollTop){scrOfY=document.documentElement.scrollTop;}return scrOfY;}function getScrollX(){var scrOfX=0,scrOfY=0;if(typeof(window.pageYOffset)=='number'){scrOfX=window.pageXOffset;}else if(document.body&&document.body.scrollLeft){scrOfX=document.body.scrollLeft;}else if(document.documentElement&&document.documentElement.scrollLeft){scrOfX=document.documentElement.scrollLeft;}return scrOfX;}function getPosY(e){var ev=(!e)?window.event:e;var posy;if(ev.pageY){posy=ev.pageY;}else if(ev.clientY){posy=ev.clientY+getScrollY();}if(!posy){return 0;}else{return posy;}}function getPosX(e){var ev=(!e)?window.event:e;var posx;if(ev.pageX){posx=ev.pageX;}else if(ev.clientX){posx=ev.clientX;}if(!posx){return 0;}else{return posx;}}function getWindowHeight(){var windowHeight=0;if(typeof(window.innerHeight)=='number'){windowHeight=window.innerHeight;}else{if(document.documentElement&&document.documentElement.clientHeight){windowHeight=document.documentElement.clientHeight;}else{if(document.body&&document.body.clientHeight){windowHeight=document.body.clientHeight;}}}return windowHeight;}function getWindowWidth(){var windowWidth=0;if(typeof(window.innerWidth)=='number'){windowWidth=window.innerWidth;}else{if(document.documentElement&&document.documentElement.clientWidth){windowWidth=document.documentElement.clientWidth;}else{if(document.body&&document.body.clientWidth){windowWidth=document.body.clientWidth;}}}return windowWidth;}function var_exists(variable){var query=window.location.search.substring(1);var vars=query.split("&");for(var i=0;i<vars.length;i++){var pair=vars[i].split("=");if(pair[0]==variable){return 1;}}return 0;}function centerContent(divID){var windowHeight=getWindowHeight();var windowWidth=getWindowWidth();var contentElement=document.getElementById(divID);if(windowHeight>0){var contentHeight=contentElement.offsetHeight;var top=((windowHeight/2)-(contentHeight/2))+getScrollY();if(((windowHeight/2)-(contentHeight/2))+getScrollY()<0){top=0;}if(top<0){top=0;}contentElement.style.top=top+'px';}if(windowWidth>0){var contentWidth=contentElement.offsetWidth;var left=((windowWidth/2)-(contentWidth/2));if(((windowWidth/2)-(contentWidth/2))<0){left=0;}contentElement.style.left=left+'px';}} PG_includes();
//-- getting all script elements from document var PG_scripts = document.getElementsByTagName('script');
//-- grabbing our script element // we need to explicitly search for it because sometimes scripts are deferred and our script may not be the last element var PG_scriptEl = PG_scripts[ PG_scripts.length - 1 ];
if(PG_scriptEl.src != "http://www.paperg.com/jsfb/embed.php?view=all&pid=891&cid=0&bid=1552") { var page_script = ''; var i = 0; for(i = 0; i < PG_scripts.length; i++) { page_script = PG_scripts[i]; if(page_script.src == "http://www.paperg.com/jsfb/embed.php?view=all&pid=891&cid=0&bid=1552") { PG_scriptEl = page_script; } } }
//-- getting parent of script element var PG_scriptParent = PG_scriptEl.parentNode;
if(!board_id) var board_id=[]; if(!pub_id) var pub_id=[]; if(!widget_id) var widget_id=[];
Netsparker identified that the target web server is disclosing the PHP version in use through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of PHP.
Impact
An attacker can look for specific security vulnerabilities for the version identified. Also the attacker can use this information in conjunction with the other vulnerabilities in the application or the web server.
var view_all_board = document.getElementById("view_all_board"); if(view_all_board) view_all_board.style.height = "450px"; var IMAGE_ROOT = 'http://www.paperg.com/beta/';var flyerboard_root = 'http://www.paperg.com/jsfb/';var remote_ip = '173.193.214.243';var view = '';var edit = '0';var EMBED_URL1552 = 'http://www.paperg.com/jsfb/embed.php?view=all&pid=891&cid=0&bid=1552';// links stylesheets in headfunction pg_linkss(filename) { var head = document.getElementsByTagName('head')[0]; link = document.createElement('link'); link.rel = 'stylesheet'; link.media = 'all'; link.type = 'text/css'; link.href = filename; head.appendChild(link);} // includes scripts in headfunction pg_include(filename) { var head = document.getElementsByTagName('head')[0]; script = document.createElement('script'); script.src = filename; script.type = 'text/javascript'; head.appendChild(script);} // includes scripts in bodyfunction include_body(filename) { var objBody = document.getElementsByTagName("body").item(0); var script = document.createElement('script'); script.src = filename; script.type = 'text/javascript'; objBody.insertBefore(script, objBody.firstChild);} var PG_fancybox_init = function(){ if($pg_jq != null && $pg_jq("a.fancy_iframe").length > 0) { if(typeof $pg_jq.fn.fancybox == 'undefined') { //$pg_jq.getScript("http://www.paperg.com/jsfb/includes/fancybox/jquery.easing-1.3.pack.js"); $pg_jq.getScript("http://www.paperg.com/jsfb/includes/fancybox/jquery.fancybox-1.3.4.pack.js", function() { $pg_jq.fancybox.init(); //call this because it doesn't always fire $pg_jq("a.fancy_iframe").fancybox({"onStart":function(){hide_other_objects();},"onClosed" : show_other_objects, "onComplete" : PG_expand_frame,"top":"0", "left":"0", "height":"0", "width":"0","transitionIn":"elastic", "transitionOut":"elastic", "scrolling":"no","padding":"0","type": "iframe"}); $pg_jq("a.fancy_iframe").click(function(){hide_other_objects();$pg_jq.fancybox.showActivity();}); }); } else { $pg_jq.fancybox.init(); //call this because it doesn't always fire $pg_jq("a.fancy_iframe").fancybox({"onStart":function(){hide_other_objects();},"onClosed" : show_other_objects, "onComplete" : PG_expand_frame,"top":"0", "left":"0", "height":"0", "width":"0","transitionIn":"elastic", "transitionOut":"elastic", "scrolling":"no","padding":"0","type": "iframe"}); $pg_jq("a.fancy_iframe").click(function(){hide_other_objects();$pg_jq.fancybox.showActivity();}); } } else { setTimeout('PG_fancybox_init();', 1000); }}//ie8.js and ie7.js used by some sites to emulate the respective browsers in //older versions make wrapper tags <!></!> that mess with css stylesfunction PG_float_aliens(){ var i; var flyer_wrapper_div; var tag_type; for(i = 0; i < 6; i++) { flyer_wrapper_div = document.getElementById("PG_flyer" + i); if(flyer_wrapper_div) { tag_type = flyer_wrapper_div.parentNode.nodeName; if(tag_type == '!') { flyer_wrapper_div.parentNode.style.float = 'left'; flyer_wrapper_div.parentNode.style.display = 'none'; flyer_wrapper_div.parentNode.style.display = 'inline-block'; } } else { break; } }}function PG_jq_wait(){ if(typeof jQuery == 'undefined' || typeof jQuery.find == 'undefined') { setTimeout("PG_jq_wait();", 100); } else { $pg_jq = jQuery.noConflict(true); PG_fancybox_init(); }}function PG_includes(){ pg_linkss("http://www.paperg.com/jsfb/css/fb/screen.css"); var browser=navigator.appName; version=navigator.appVersion.split('MSIE'); ieVer=parseInt(version[1]); if(browser=="Microsoft Internet Explorer") { if(ieVer < 7) pg_linkss("http://www.paperg.com/jsfb/css/fb/screen_ie6.css"); }}function PG_jq_includes(){ pg_linkss("http://www.paperg.com/jsfb/includes/fancybox/jquery.fancybox-1.3.4.css"); if(typeof jQuery == 'undefined' || typeof jQuery.find == 'undefined') { pg_include("//ajax.googleapis.com/ajax/libs/jquery/1.3.1/jquery.min.js"); PG_jq_wait(); } else if(jQuery.fn.jquery == '1.2.6' || jQuery.fn.jquery == '1.4.4') { jQuery.getScript("//ajax.googleapis.com/ajax/libs/jquery/1.3.1/jquery.min.js", function() {PG_jq_wait();}); } else { $pg_jq = jQuery; PG_fancybox_init(); }}function check_pg_exists(){ var pg_link_node = document.getElementById("PG_link"); var pg_flyerboard_node = document.getElementById('PG_fb'); if(!pg_link_node || !pg_flyerboard_node) { alert("Flyerboard code has been altered. Please consult your webmaster"); if(pg_flyerboard_node) pg_flyerboard_node.style.display = "none"; } else { var textToCheck = pg_link_node.innerHTML; if(textToCheck.indexOf("http://www.paperg.com") == -1) { alert("Flyerboard code has been altered. Please consult your webmaster"); if(pg_flyerboard_node) pg_flyerboard_node.style.display = "none"; } }}//monitor iframe to see if the element "done_loading" existsvar PG_expand_frame = function(){ var fancy_frame = document.getElementById('fancybox-frame'); if(location.hash != "#d") { var temp = fancy_frame.src.split("#"); if(temp.length != 2) { fancy_frame.src = fancy_frame.src + "#" + document.location.href; } $pg_jq("#fancybox-close").hide(); setTimeout(PG_expand_frame, 1000); } else { var new_top = ($pg_jq(window).height() - 700 ) / 2+$pg_jq(window).scrollTop(); if(new_top < 0) { new_top = 0; } $pg_jq('#fancybox-wrap').animate({ top: new_top + "px", left: ($pg_jq(window).width() - 800 ) / 2+$pg_jq(window).scrollLeft() + "px", width: '800px', height: '585px'}, 'fast', 'swing', function() { $pg_jq.fancybox.hideActivity(); $pg_jq("#fancybox-close").show();} ); $pg_jq("#fancybox-content").css({'width': '800px', 'height': '585px'}); location.hash = "a12"; }} function checkAll() { var boxes = document.getElementsByName("boards[]"); for (i = 0; i < boxes.length; i++) { boxes[i].checked = true; } } function uncheckAll() { var boxes = document.getElementsByName("boards[]"); for (i = 0; i < boxes.length; i++) { boxes[i].checked = false; } }/** * flyerboard.functions.js * * functions for use on intial load of the flyerboard, including opening and closing of the flyerviewer and tracking. *///keep track of all hidden elements, so that we can rehide them latervar PG_hidden_elements = [];var PG_visible_elements = [];var PG_default_elements = [];function sort_into_array_by_visibility(element){ switch(element.style.visibility) { case "hidden": PG_hidden_elements.push(element); break; case "visible": PG_visible_elements.push(element); break; default: PG_default_elements.push(element); break; }}/*Hide all other objects/embeds so as to avoid layering issue.*/var hide_other_objects = function(){ var mg=document.getElementsByTagName("object"); for(var i=0;i < mg.length;i++) { var id=mg[i].id||mg[i].name; if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } mg=document.getElementsByTagName("embed"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } mg=document.getElementsByTagName("iframe"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } } mg=document.getElementsByTagName("select"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } } };/*Once flyerviewer is closed, resume showing all other objects -- assuming they weren't already hidden*/var show_other_objects = function(){ var mg=document.getElementsByTagName("object"); for(var i=0;i < mg.length;i++) { var id=mg[i].id||mg[i].name; if(id != "stframe") { mg[i].style.visibility="visible"; } } mg=document.getElementsByTagName("embed"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id != "stframe") { mg[i].style.visibility="visible"; } } mg=document.getElementsByTagName("iframe"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { mg[i].style.visibility="visible"; } } } mg=document.getElementsByTagName("select"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { mg[i].style.visibility="visible"; } } } //can probably remove all the code before this, will need to take a look for(i=0;i < PG_hidden_elements.length;i++) { PG_hidden_elements[i].style.visibility = "hidden"; } for(i=0;i < PG_visible_elements.length;i++) { PG_visible_elements[i].style.visibility = "visible"; } for(i=0;i < PG_default_elements.length;i++) { PG_default_elements[i].style.visibility = ""; } PG_hidden_elements = []; PG_visible_elements = []; PG_default_elements = []; };/** * loads the flyerviewer using an iframe * * @param int camp_id * @param int instance */function load_flyerviewer(camp_id, instance){ if(board_id == undefined || board_id[instance] == undefined) { return; } setTimeout('hide_other_objects();', 500); //document.getElementById("fv-iframe").src = 'javascript:\'\';'; iframesrc = flyerboard_root + 'inc/flyerviewer.php?cid='+camp_id+'&bid='+board_id[instance] + '&pid='+pub_id[instance]+'&wid='+widget_id[instance]+'&rand='+(Math.floor(Math.random()*500000)) + "&view=" + view + "&edit=" + edit; document.getElementById("fv-iframe").src = iframesrc; document.getElementById("fv-iframe").style.width="810px"; document.getElementById("fv-iframe").style.height="600px"; document.getElementById("fv-div").style.display = ""; centerContent("fv-div");}/** * closes the flyerviewer and clears global variables */function close_flyerviewer(){ show_other_objects(); // send close signal to flyerviewer var iwin; if(navigator.userAgent.indexOf("Safari") != -1){ iwin = frames["fv-iframe"]; }else{ iwin = document.getElementById("fv-iframe").contentWindow; } iwin.location = iframesrc + "#close"; document.getElementById("fv-div").style.display = "none"; iwin.location = "javascript:''"; }var $pg_jq = null;var $old_jq = null;var PG_tt=function(){var id='PG_tt';var top=-100;var left=15;var maxw=150;var speed=12;var timer=20;var endalpha=95;var alpha=0;var tt,t,c,b,h;var ie=document.all?true:false;var objBody=document.getElementsByTagName("body").item(0);return{show:function(v,w){if(tt==null){tt=document.createElement('div');tt.setAttribute('id',id);t=document.createElement('div');t.setAttribute('id',id+'top');c=document.createElement('div');c.setAttribute('id',id+'cont');b=document.createElement('div');b.setAttribute('id',id+'bot');tt.appendChild(t);tt.appendChild(c);tt.appendChild(b);objBody.insertBefore(tt,objBody.firstChild);tt.style.opacity=0;tt.style.filter='alpha(opacity=0)';}document.onmousemove=this.pos;tt.style.display='block';c.innerHTML=v;tt.style.width=w?w+'px':'auto';if(!w&&ie){t.style.display='none';b.style.display='none';tt.style.width=tt.offsetWidth;t.style.display='block';b.style.display='block';}tt.style.width=maxw+'px';h=parseInt(tt.offsetHeight)+top;clearInterval(tt.timer);tt.timer=setInterval(function(){PG_tt.fade(1)},timer);},pos:function(e){var u=ie?event.clientY+document.documentElement.scrollTop:e.pageY;var l=ie?event.clientX+document.documentElement.scrollLeft:e.pageX;if(u-h<0)tt.style.top=0;else tt.style.top=(u-h)+'px';if(l+left<0)tt.style.left=0;else if((l+left)+maxw>document.body.clientWidth){tt.style.left=document.body.clientWidth-maxw*2+'px';}else tt.style.left=(l+left)+'px';document.onmousemove=null;},fade:function(d){var a=alpha;if((a!=endalpha&&d==1)||(a!=0&&d==-1)){var i=speed;if(endalpha-a<speed&&d==1){i=endalpha-a;}else if(alpha<speed&&d==-1){i=a;}alpha=a+(i*d);tt.style.opacity=alpha*.01;tt.style.filter='alpha(opacity='+alpha+')';}else{clearInterval(tt.timer);if(d==-1){tt.style.display='none'}}},hide:function(){clearInterval(tt.timer);tt.timer=setInterval(function(){PG_tt.fade(-1)},timer);}};}();function getScrollY(){var scrOfX=0,scrOfY=0;if(typeof(window.pageYOffset)=='number'){scrOfY=window.pageYOffset;}else if(document.body&&document.body.scrollTop){scrOfY=document.body.scrollTop;}else if(document.documentElement&&document.documentElement.scrollTop){scrOfY=document.documentElement.scrollTop;}return scrOfY;}function getScrollX(){var scrOfX=0,scrOfY=0;if(typeof(window.pageYOffset)=='number'){scrOfX=window.pageXOffset;}else if(document.body&&document.body.scrollLeft){scrOfX=document.body.scrollLeft;}else if(document.documentElement&&document.documentElement.scrollLeft){scrOfX=document.documentElement.scrollLeft;}return scrOfX;}function getPosY(e){var ev=(!e)?window.event:e;var posy;if(ev.pageY){posy=ev.pageY;}else if(ev.clientY){posy=ev.clientY+getScrollY();}if(!posy){return 0;}else{return posy;}}function getPosX(e){var ev=(!e)?window.event:e;var posx;if(ev.pageX){posx=ev.pageX;}else if(ev.clientX){posx=ev.clientX;}if(!posx){return 0;}else{return posx;}}function getWindowHeight(){var windowHeight=0;if(typeof(window.innerHeight)=='number'){windowHeight=window.innerHeight;}else{if(document.documentElement&&document.documentElement.clientHeight){windowHeight=document.documentElement.clientHeight;}else{if(document.body&&document.body.clientHeight){windowHeight=document.body.clientHeight;}}}return windowHeight;}function getWindowWidth(){var windowWidth=0;if(typeof(window.innerWidth)=='number'){windowWidth=window.innerWidth;}else{if(document.documentElement&&document.documentElement.clientWidth){windowWidth=document.documentElement.clientWidth;}else{if(document.body&&document.body.clientWidth){windowWidth=document.body.clientWidth;}}}return windowWidth;}function var_exists(variable){var query=window.location.search.substring(1);var vars=query.split("&");for(var i=0;i<vars.length;i++){var pair=vars[i].split("=");if(pair[0]==variable){return 1;}}return 0;}function centerContent(divID){var windowHeight=getWindowHeight();var windowWidth=getWindowWidth();var contentElement=document.getElementById(divID);if(windowHeight>0){var contentHeight=contentElement.offsetHeight;var top=((windowHeight/2)-(contentHeight/2))+getScrollY();if(((windowHeight/2)-(contentHeight/2))+getScrollY()<0){top=0;}if(top<0){top=0;}contentElement.style.top=top+'px';}if(windowWidth>0){var contentWidth=contentElement.offsetWidth;var left=((windowWidth/2)-(contentWidth/2));if(((windowWidth/2)-(contentWidth/2))<0){left=0;}contentElement.style.left=left+'px';}} PG_includes();
//-- getting all script elements from document var PG_scripts = document.getElementsByTagName('script');
//-- grabbing our script element // we need to explicitly search for it because sometimes scripts are deferred and our script may not be the last element var PG_scriptEl = PG_scripts[ PG_scripts.length - 1 ];
if(PG_scriptEl.src != "http://www.paperg.com/jsfb/embed.php?view=all&pid=891&cid=0&bid=1552") { var page_script = ''; var i = 0; for(i = 0; i < PG_scripts.length; i++) { page_script = PG_scripts[i]; if(page_script.src == "http://www.paperg.com/jsfb/embed.php?view=all&pid=891&cid=0&bid=1552") { PG_scriptEl = page_script; } } }
//-- getting parent of script element var PG_scriptParent = PG_scriptEl.parentNode;
if(!board_id) var board_id=[]; if(!pub_id) var pub_id=[]; if(!widget_id) var widget_id=[];
The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. In rare conditions this may be a clue for an SQL Injection vulnerability. Most of the time Netsparker will detect and report that problem separately.
Remedy
Do not provide any error messages on production environments. Save error messages with a reference number to a backend storage such as a text file or database, then show this number and a static user-friendly error message to the user.
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '0:0:25'--'' at line 1 var view_all_board = document.getElementById("view_all_board"); if(view_all_board) view_all_board.style.height = "450px"; var IMAGE_ROOT = 'http://www.paperg.com/beta/';var flyerboard_root = 'http://www.paperg.com/jsfb/';var remote_ip = '173.193.214.243';var view = '';var edit = '0';var EMBED_URL1;WAITFOR DELAY '0:0:25'-- = 'http://www.paperg.com/jsfb/embed.php?view=all&pid=891&cid=0&bid=1;WAITFOR%20DELAY%20%270:0:25%27--';// links stylesheets in headfunction pg_linkss(filename) { var head = document.getElementsByTagName('head')[0]; link = document.createElement('link'); link.rel = 'stylesheet'; link.media = 'all'; link.type = 'text/css'; link.href = filename; head.appendChild(link);} // includes scripts in headfunction pg_include(filename) { var head = document.getElementsByTagName('head')[0]; script = document.createElement('script'); script.src = filename; script.type = 'text/javascript'; head.appendChild(script);} // includes scripts in bodyfunction include_body(filename) { var objBody = document.getElementsByTagName("body").item(0); var script = document.createElement('script'); script.src = filename; script.type = 'text/javascript'; objBody.insertBefore(script, objBody.firstChild);} var PG_fancybox_init = function(){ if($pg_jq != null && $pg_jq("a.fancy_iframe").length > 0) { if(typeof $pg_jq.fn.fancybox == 'undefined') { //$pg_jq.getScript("http://www.paperg.com/jsfb/includes/fancybox/jquery.easing-1.3.pack.js"); $pg_jq.getScript("http://www.paperg.com/jsfb/includes/fancybox/jquery.fancybox-1.3.4.pack.js", function() { $pg_jq.fancybox.init(); //call this because it doesn't always fire $pg_jq("a.fancy_iframe").fancybox({"onStart":function(){hide_other_objects();},"onClosed" : show_other_objects, "onComplete" : PG_expand_frame,"top":"0", "left":"0", "height":"0", "width":"0","transitionIn":"elastic", "transitionOut":"elastic", "scrolling":"no","padding":"0","type": "iframe"}); $pg_jq("a.fancy_iframe").click(function(){hide_other_objects();$pg_jq.fancybox.showActivity();}); }); } else { $pg_jq.fancybox.init(); //call this because it doesn't always fire $pg_jq("a.fancy_iframe").fancybox({"onStart":function(){hide_other_objects();},"onClosed" : show_other_objects, "onComplete" : PG_expand_frame,"top":"0", "left":"0", "height":"0", "width":"0","transitionIn":"elastic", "transitionOut":"elastic", "scrolling":"no","padding":"0","type": "iframe"}); $pg_jq("a.fancy_iframe").click(function(){hide_other_objects();$pg_jq.fancybox.showActivity();}); } } else { setTimeout('PG_fancybox_init();', 1000); }}//ie8.js and ie7.js used by some sites to emulate the respective browsers in //older versions make wrapper tags <!></!> that mess with css stylesfunction PG_float_aliens(){ var i; var flyer_wrapper_div; var tag_type; for(i = 0; i < 6; i++) { flyer_wrapper_div = document.getElementById("PG_flyer" + i); if(flyer_wrapper_div) { tag_type = flyer_wrapper_div.parentNode.nodeName; if(tag_type == '!') { flyer_wrapper_div.parentNode.style.float = 'left'; flyer_wrapper_div.parentNode.style.display = 'none'; flyer_wrapper_div.parentNode.style.display = 'inline-block'; } } else { break; } }}function PG_jq_wait(){ if(typeof jQuery == 'undefined' || typeof jQuery.find == 'undefined') { setTimeout("PG_jq_wait();", 100); } else { $pg_jq = jQuery.noConflict(true); PG_fancybox_init(); }}function PG_includes(){ pg_linkss("http://www.paperg.com/jsfb/css/fb/screen.css"); var browser=navigator.appName; version=navigator.appVersion.split('MSIE'); ieVer=parseInt(version[1]); if(browser=="Microsoft Internet Explorer") { if(ieVer < 7) pg_linkss("http://www.paperg.com/jsfb/css/fb/screen_ie6.css"); }}function PG_jq_includes(){ pg_linkss("http://www.paperg.com/jsfb/includes/fancybox/jquery.fancybox-1.3.4.css"); if(typeof jQuery == 'undefined' || typeof jQuery.find == 'undefined') { pg_include("//ajax.googleapis.com/ajax/libs/jquery/1.3.1/jquery.min.js"); PG_jq_wait(); } else if(jQuery.fn.jquery == '1.2.6' || jQuery.fn.jquery == '1.4.4') { jQuery.getScript("//ajax.googleapis.com/ajax/libs/jquery/1.3.1/jquery.min.js", function() {PG_jq_wait();}); } else { $pg_jq = jQuery; PG_fancybox_init(); }}function check_pg_exists(){ var pg_link_node = document.getElementById("PG_link"); var pg_flyerboard_node = document.getElementById('PG_fb'); if(!pg_link_node || !pg_flyerboard_node) { alert("Flyerboard code has been altered. Please consult your webmaster"); if(pg_flyerboard_node) pg_flyerboard_node.style.display = "none"; } else { var textToCheck = pg_link_node.innerHTML; if(textToCheck.indexOf("http://www.paperg.com") == -1) { alert("Flyerboard code has been altered. Please consult your webmaster"); if(pg_flyerboard_node) pg_flyerboard_node.style.display = "none"; } }}//monitor iframe to see if the element "done_loading" existsvar PG_expand_frame = function(){ var fancy_frame = document.getElementById('fancybox-frame'); if(location.hash != "#d") { var temp = fancy_frame.src.split("#"); if(temp.length != 2) { fancy_frame.src = fancy_frame.src + "#" + document.location.href; } $pg_jq("#fancybox-close").hide(); setTimeout(PG_expand_frame, 1000); } else { var new_top = ($pg_jq(window).height() - 700 ) / 2+$pg_jq(window).scrollTop(); if(new_top < 0) { new_top = 0; } $pg_jq('#fancybox-wrap').animate({ top: new_top + "px", left: ($pg_jq(window).width() - 800 ) / 2+$pg_jq(window).scrollLeft() + "px", width: '800px', height: '585px'}, 'fast', 'swing', function() { $pg_jq.fancybox.hideActivity(); $pg_jq("#fancybox-close").show();} ); $pg_jq("#fancybox-content").css({'width': '800px', 'height': '585px'}); location.hash = "a12"; }} function checkAll() { var boxes = document.getElementsByName("boards[]"); for (i = 0; i < boxes.length; i++) { boxes[i].checked = true; } } function uncheckAll() { var boxes = document.getElementsByName("boards[]"); for (i = 0; i < boxes.length; i++) { boxes[i].checked = false; } }/** * flyerboard.functions.js * * functions for use on intial load of the flyerboard, including opening and closing of the flyerviewer and tracking. *///keep track of all hidden elements, so that we can rehide them latervar PG_hidden_elements = [];var PG_visible_elements = [];var PG_default_elements = [];function sort_into_array_by_visibility(element){ switch(element.style.visibility) { case "hidden": PG_hidden_elements.push(element); break; case "visible": PG_visible_elements.push(element); break; default: PG_default_elements.push(element); break; }}/*Hide all other objects/embeds so as to avoid layering issue.*/var hide_other_objects = function(){ var mg=document.getElementsByTagName("object"); for(var i=0;i < mg.length;i++) { var id=mg[i].id||mg[i].name; if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } mg=document.getElementsByTagName("embed"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } mg=document.getElementsByTagName("iframe"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } } mg=document.getElementsByTagName("select"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { sort_into_array_by_visibility(mg[i]); mg[i].style.visibility="hidden"; } } } };/*Once flyerviewer is closed, resume showing all other objects -- assuming they weren't already hidden*/var show_other_objects = function(){ var mg=document.getElementsByTagName("object"); for(var i=0;i < mg.length;i++) { var id=mg[i].id||mg[i].name; if(id != "stframe") { mg[i].style.visibility="visible"; } } mg=document.getElementsByTagName("embed"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id != "stframe") { mg[i].style.visibility="visible"; } } mg=document.getElementsByTagName("iframe"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { mg[i].style.visibility="visible"; } } } mg=document.getElementsByTagName("select"); for(i=0;i < mg.length;i++) { id=mg[i].id||mg[i].name; if(id.substring(2,0)!="fv") { if(id != "stframe") { mg[i].style.visibility="visible"; } } } //can probably remove all the code before this, will need to take a look for(i=0;i < PG_hidden_elements.length;i++) { PG_hidden_elements[i].style.visibility = "hidden"; } for(i=0;i < PG_visible_elements.length;i++) { PG_visible_elements[i].style.visibility = "visible"; } for(i=0;i < PG_default_elements.length;i++) { PG_default_elements[i].style.visibility = ""; } PG_hidden_elements = []; PG_visible_elements = []; PG_default_elements = []; };/** * loads the flyerviewer using an iframe * * @param int camp_id * @param int instance */function load_flyerviewer(camp_id, instance){ if(board_id == undefined || board_id[instance] == undefined) { return; } setTimeout('hide_other_objects();', 500); //document.getElementById("fv-iframe").src = 'javascript:\'\';'; iframesrc = flyerboard_root + 'inc/flyerviewer.php?cid='+camp_id+'&bid='+board_id[instance] + '&pid='+pub_id[instance]+'&wid='+widget_id[instance]+'&rand='+(Math.floor(Math.random()*500000)) + "&view=" + view + "&edit=" + edit; document.getElementById("fv-iframe").src = iframesrc; document.getElementById("fv-iframe").style.width="810px"; document.getElementById("fv-iframe").style.height="600px"; document.getElementById("fv-div").style.display = ""; centerContent("fv-div");}/** * closes the flyerviewer and clears global variables */function close_flyerviewer(){ show_other_objects(); // send close signal to flyerviewer var iwin; if(navigator.userAgent.indexOf("Safari") != -1){ iwin = frames["fv-iframe"]; }else{ iwin = document.getElementById("fv-iframe").contentWindow; } iwin.location = iframesrc + "#close"; document.getElementById("fv-div").style.display = "none"; iwin.location = "javascript:''"; }var $pg_jq = null;var $old_jq = null;var PG_tt=function(){var id='PG_tt';var top=-100;var left=15;var maxw=150;var speed=12;var timer=20;var endalpha=95;var alpha=0;var tt,t,c,b,h;var ie=document.all?true:false;var objBody=document.getElementsByTagName("body").item(0);return{show:function(v,w){if(tt==null){tt=document.createElement('div');tt.setAttribute('id',id);t=document.createElement('div');t.setAttribute('id',id+'top');c=document.createElement('div');c.setAttribute('id',id+'cont');b=document.createElement('div');b.setAttribute('id',id+'bot');tt.appendChild(t);tt.appendChild(c);tt.appendChild(b);objBody.insertBefore(tt,objBody.firstChild);tt.style.opacity=0;tt.style.filter='alpha(opacity=0)';}document.onmousemove=this.pos;tt.style.display='block';c.innerHTML=v;tt.style.width=w?w+'px':'auto';if(!w&&ie){t.style.display='none';b.style.display='none';tt.style.width=tt.offsetWidth;t.style.display='block';b.style.display='block';}tt.style.width=maxw+'px';h=parseInt(tt.offsetHeight)+top;clearInterval(tt.timer);tt.timer=setInterval(function(){PG_tt.fade(1)},timer);},pos:function(e){var u=ie?event.clientY+document.documentElement.scrollTop:e.pageY;var l=ie?event.clientX+document.documentElement.scrollLeft:e.pageX;if(u-h<0)tt.style.top=0;else tt.style.top=(u-h)+'px';if(l+left<0)tt.style.left=0;else if((l+left)+maxw>document.body.clientWidth){tt.style.left=document.body.clientWidth-maxw*2+'px';}else tt.style.left=(l+left)+'px';document.onmousemove=null;},fade:function(d){var a=alpha;if((a!=endalpha&&d==1)||(a!=0&&d==-1)){var i=speed;if(endalpha-a<speed&&d==1){i=endalpha-a;}else if(alpha<speed&&d==-1){i=a;}alpha=a+(i*d);tt.style.opacity=alpha*.01;tt.style.filter='alpha(opacity='+alpha+')';}else{clearInterval(tt.timer);if(d==-1){tt.style.display='none'}}},hide:function(){clearInterval(tt.timer);tt.timer=setInterval(function(){PG_tt.fade(-1)},timer);}};}();function getScrollY(){var scrOfX=0,scrOfY=0;if(typeof(window.pageYOffset)=='number'){scrOfY=window.pageYOffset;}else if(document.body&&document.body.scrollTop){scrOfY=document.body.scrollTop;}else if(document.documentElement&&document.documentElement.scrollTop){scrOfY=document.documentElement.scrollTop;}return scrOfY;}function getScrollX(){var scrOfX=0,scrOfY=0;if(typeof(window.pageYOffset)=='number'){scrOfX=window.pageXOffset;}else if(document.body&&document.body.scrollLeft){scrOfX=document.body.scrollLeft;}else if(document.documentElement&&document.documentElement.scrollLeft){scrOfX=document.documentElement.scrollLeft;}return scrOfX;}function getPosY(e){var ev=(!e)?window.event:e;var posy;if(ev.pageY){posy=ev.pageY;}else if(ev.clientY){posy=ev.clientY+getScrollY();}if(!posy){return 0;}else{return posy;}}function getPosX(e){var ev=(!e)?window.event:e;var posx;if(ev.pageX){posx=ev.pageX;}else if(ev.clientX){posx=ev.clientX;}if(!posx){return 0;}else{return posx;}}function getWindowHeight(){var windowHeight=0;if(typeof(window.innerHeight)=='number'){windowHeight=window.innerHeight;}else{if(document.documentElement&&document.documentElement.clientHeight){windowHeight=document.documentElement.clientHeight;}else{if(document.body&&document.body.clientHeight){windowHeight=document.body.clientHeight;}}}return windowHeight;}function getWindowWidth(){var windowWidth=0;if(typeof(window.innerWidth)=='number'){windowWidth=window.innerWidth;}else{if(document.documentElement&&document.documentElement.clientWidth){windowWidth=document.documentElement.clientWidth;}else{if(document.body&&document.body.clientWidth){windowWidth=document.body.clientWidth;}}}return windowWidth;}function var_exists(variable){var query=window.location.search.substring(1);var vars=query.split("&");for(var i=0;i<vars.length;i++){var pair=vars[i].split("=");if(pair[0]==variable){return 1;}}return 0;}function centerContent(divID){var windowHeight=getWindowHeight();var windowWidth=getWindowWidth();var contentElement=document.getElementById(divID);if(windowHeight>0){var contentHeight=contentElement.offsetHeight;var top=((windowHeight/2)-(contentHeight/2))+getScrollY();if(((windowHeight/2)-(contentHeight/2))+getScrollY()<0){top=0;}if(top<0){top=0;}contentElement.style.top=top+'px';}if(windowWidth>0){var contentWidth=contentElement.offsetWidth;var left=((windowWidth/2)-(contentWidth/2));if(((windowWidth/2)-(contentWidth/2))<0){left=0;}contentElement.style.left=left+'px';}} PG_includes();
//-- getting all script elements from document var PG_scripts = document.getElementsByTagName('script');
//-- grabbing our script element // we need to explicitly search for it because sometimes scripts are deferred and our script may not be the last element var PG_scriptEl = PG_scripts[ PG_scripts.length - 1 ];
if(PG_scriptEl.src != "http://www.paperg.com/jsfb/embed.php?view=all&pid=891&cid=0&bid=1;WAITFOR%20DELAY%20%270:0:25%27--") { var page_script = ''; var i = 0; for(i = 0; i < PG_scripts.length; i++) { page_script = PG_scripts[i]; if(page_script.src == "http://www.paperg.com/jsfb/embed.php?view=all&pid=891&cid=0&bid=1;WAITFOR%20DELAY%20%270:0:25%27--") { PG_scriptEl = page_script; } } }
//-- getting parent of script element var PG_scriptParent = PG_scriptEl.parentNode;
if(!board_id) var board_id=[]; if(!pub_id) var pub_id=[]; if(!widget_id) var widget_id=[];
Netsparker identified that the target web site is using a MySQL Server. This is generally not a security issue and is reported here for information purposes.
Impact
This issue is reported as additional information only, there is no direct impact arising from this issue.
